Jake
3770815fbf
Closes the code-side v0.1 ship gate. All quality gates green: cargo fmt/clippy/test (~327 tests), npm check (0/0), vitest 13/13, scripts/dogfood-rebrand-drill.sh 8/8. Phase F — first-run onboarding promoted to v0.1 - FirstRunPage with skip-to-main + failure recovery + event recording - Six onboarding commands (record/list/has-completed + lumotia_events) - Storage migration v17 (onboarding_events + lumotia_events tables) UI hardening (in-scope items from v0.1-ui-hardening.md) - StatusPill + PostCaptureCard components, 21st preview entry - Sidebar recording-as-sacred-state (opacity + aria-disabled, reduced-motion) - Settings 6-section regroup + Help section + Activation log + Privacy toggle - Error-state copy sweep (DictationPage + SettingsPage, plain-language) - Global :focus-visible rule, textarea outlines restored - Ctrl+K / Ctrl+, / Escape bindings in +layout LLM resilience - rule_based_extract_tasks (regex-free imperative-verb extractor) + extract_tasks_with_fallback wrapper — task extraction never returns zero - tokio::time::timeout(120s) wraps cleanup/tags/tasks commands Release artefacts - LICENSE (canonical AGPL-3.0), CHANGELOG (Keep-a-Changelog format) - v0.1-release-notes, privacy-and-ai-use, install-warnings, tester-onboarding-kit, tester-acceptance-runbook, code-signing-setup, apple-silicon-rb08-runbook, virtual-audio-setup, v0.1-contrast-audit - Workspace versioning + AGPL spdx; npm exact-pin (10 ranges removed) - AppImage SHA-256 sidecar in build.yml - README v0.1 section + Reporting-issues; canonical repo slug Closure pass — items moved from human-required to code-complete - KI-02 Linux idle inhibit: zbus 5 → org.freedesktop.login1.Manager.Inhibit - KI-03 Windows sleep prevention: SetThreadExecutionState(ES_CONTINUOUS|...) - acquire/release_idle_inhibit Tauri commands, wired in DictationPage - Diagnostic-bundle frontend wire-up (Settings → Help button) - WCAG-AA contrast fix via .btn-filled-text utility (no token changes) - 8 destructive-action sites wrapped in plain-language confirm() guards - KNOWN-ISSUES.md + v0.1-known-limitations.md updated (KI-02/03 fixed) Scripts - pre-tag-verify.sh, tag-day.sh, smoke-linux + driver - parse-diagnostic-bundle.sh, parse-activation-log.py Per-item audit trail: docs/release/v0.1-completion-status.md Remaining: W-01…W-08 (signing certs, hardware probes, smoke matrix, tester recruitment) — see docs/release/v0.1-known-limitations.md.
5.8 KiB
name, type, tags, description
| name | type | tags | description | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
| privacy-and-ai-use | release |
|
User-facing privacy + AI-use disclosure for Lumotia v0.1. Lists what stays local, what optionally reaches the network, what NEVER leaves the machine, the AI use disclosure (local LLM + AI-assisted implementation), the MCP server caveat, the opt-in activation log, crash-dump policy, and the open-source licence framing. Linked from README + Settings → Privacy + v0.1 release notes. |
Privacy + AI-use disclosure
Lumotia v0.1 — last reviewed 2026-05-14.
What stays local
Every piece of data the app creates or captures lives only on your machine:
- Audio recordings (captured, processed, then discarded from memory — not persisted to disk by default)
- Raw transcripts (exactly what the speech engine heard, always recoverable)
- Cleaned transcripts (LLM-formatted versions; the raw is always preserved alongside)
- Extracted tasks and subtasks
- MicroStep breakdowns and focus-timer state
- Transcript and task history (SQLite database in your app-data directory)
- Downloaded speech models (Whisper, Parakeet) and LLM model files (GGUF)
- Custom vocabulary and profile terms
- Activation log events (if you opt in — see below)
- Onboarding state and preferences
Nothing in this list is ever transmitted automatically.
What optionally reaches the network
There are exactly two outbound network paths in v0.1:
1. Model downloads (huggingface.co)
When you pick or download a speech model or LLM in onboarding or Settings → Models, Lumotia fetches the model file from https://huggingface.co. The request contains only a standard HTTP GET for a specific file URL (content-addressed, pinned to a commit hash). No account, no user identifier, no transcript content is sent. The download is initiated by your explicit action. Once downloaded, the model runs fully on-device.
2. Update check (stub in v0.1)
Lumotia includes a check_for_update command wired to tauri-plugin-updater. In v0.1 this function returns immediately with no update available — no network request is made. This will change in a future release; when it does, the check will be user-initiated or clearly disclosed.
What about npm audit and supply-chain tooling?
npm audit and the supply-chain pre-flight in run.sh are development-time tools only. They run when a developer builds from source, not in the installed application. The packaged app contains no npm runtime and makes no npm network calls.
What NEVER leaves the machine
These are hard commitments, not soft defaults:
- Your voice recordings
- Your transcript text (raw or cleaned)
- Your task content
- Your extracted MicroSteps
- Your activation log
- Your history and search index
There is no telemetry system, no analytics pipeline, no crash-reporting service, and no background process that phones home. Crash dumps and logs are stored locally and are only shared if you explicitly bundle and attach them to a support issue (see below).
AI use disclosure
Lumotia uses a local large language model for two narrow purposes: transcript cleanup and task extraction. The model is downloaded once and runs entirely on your device. It never sees data outside those two call sites — there is no chat surface, no persistent conversation history, and no system prompt that accumulates your content across sessions. The raw Whisper transcript is always preserved; LLM output is additive, never destructive.
The app itself was built with AI assistance. That process is documented in docs/release/how-lumotia-is-built.md, including the audits and guardrails applied to AI-generated code before it was committed.
MCP server caveat
Lumotia includes an optional MCP server (lumotia-mcp) you can wire into Claude Desktop, Cline, or any MCP-capable client. It is:
- Read-only. No tool can create, edit, or delete transcripts or tasks.
- Stdio-only. No network listener. No TCP socket. No Unix socket.
- Off by default. You must explicitly launch it and add it to your MCP client's configuration.
The honest thing to flag: when you wire lumotia-mcp into an MCP client, that client gets read access to your entire transcript history and task list. There is no per-row permission system in v0.1. Treat it the same way you would treat giving a tool access to a folder of personal notes — only enable it if you trust the client end-to-end.
Activation log
The activation log is opt-in and local-only. It records milestone events — first capture, first export, first task extracted — in the lumotia_events table in your local database. It contains no transcript text and no audio. Nothing is sent automatically. You can read it via Settings → Diagnostics → Activation log, and you can clear it or opt out from the same screen.
Crash dumps and logs
Lumotia captures Rust panics and frontend errors to disk so you have something useful to attach if you file a bug report. Files are written to:
<app-data-dir>/crashes/— panic and crash dumps<app-data-dir>/logs/lumotia.log— runtime log
Neither location contains transcript text or audio. The diagnostic-report bundler in Settings → About assembles a redacted snapshot from these directories; it skips transcript content and audio files by default. You decide whether to share the bundle.
On Linux, <app-data-dir> is typically ~/.local/share/uk.co.corbel.lumotia.
Your data, your machine
Lumotia is open source. The repository is public. The licence is to be finalised before public beta; current intent is a permissive open-source licence. You can read every line of code that handles your data, run the test suite, and verify the claims on this page yourself. If you find a discrepancy between this document and the codebase, file an issue — we will fix whichever one is wrong.