This is the record of an abcd-managed repository

abcdBetav0.16.2 · 2026-11-06

Development record

An opt-in local model checks every prompt for secrets and personal data before it leaves the machine

intentdraftsminoritd-2609292109005937

Typed links: related_issues iss-2608261543489261 (the record this draft plans); related_adrs adr-22 (an external tool as an opt-in adapter over a native default).

Press Release

A person who opts in has every prompt checked on their own machine before it reaches the hosted model: a small local model flags or redacts secrets, private names and personal data at the moment the prompt is submitted, alongside the scanner and the banned-names lists abcd already runs. When the local model is missing or fails, abcd says so and passes the prompt through unchanged, never silently. "I wanted one plain promise: nothing leaves this machine unchecked," said Dave, a security engineer. "Now I can switch it on, see what it caught, and know when it is not running."

Why This Matters

abcd redacts on write: the history store scans every transcript before it is stored, and the banned-names lists guard what is committed. Nothing checks a live prompt before it goes to the hosted model, so a secret or a private name typed into a prompt leaves the machine as typed. iss-2608261543489261 proposes a small on-machine model at the prompt seam (the UserPromptSubmit hook) that flags or redacts before the prompt is sent, composing with the scanner and the banned-names layers rather than replacing them. The product thinker ruled on 2026-09-29 to plan it as an opt-in feature (ruling J14).

What's In Scope

  • An opt-in check at prompt submission that runs the existing scanner and banned-names layers and, when configured, a local model over the prompt.
  • The outcome shown to the person: what was flagged or redacted, before the prompt is sent.
  • Loud degradation: a missing or failing local model passes the prompt through and says the check did not run.

What's Out of Scope

  • Shipping a model: the local model is the person's own, an opt-in adapter.
  • Checking what the hosted model sends back.

Mechanism

Prompted (the claim-recording gradient): why the authors expect this to work, as a falsifiable "we expect X because Y" — not the outcome restated. Replace this line with the claim, or with the exact token None stated. alone on its line to record the claim as considered and declined.

Scope Conditions

Required (the claim-recording gradient): the population, platform, scale, or assumptions this claim holds under, one per top-level bullet — abcd intent plan stamps each with a persistent identity. Replace this line with those bullets, or with the exact token None stated. alone on its line.

Acceptance Criteria

Seeded by the run from the record and the ruling, unconfirmed: the planning interview walks each one.

  • Given the check is off, when a prompt is submitted, then nothing changes and no local model is started.
  • Given the check is on and a prompt carries a token-shaped secret, when it is submitted, then the secret is redacted or the prompt is held, and the person is told which.
  • Given the check is on and a prompt carries a name on the banned-names lists, when it is submitted, then it is flagged the same way.
  • Given the check is on and the local model is missing or fails, when a prompt is submitted, then the prompt passes through and the person is told the local-model check did not run.

SOTA

Surveyed on 2026-10-23; sources, evidence tiers and the local fit risks are in the security-isolation SOTA note.

  • The prompt seam can hold and cannot rewrite: a UserPromptSubmit hook "Blocks the prompt, so it never reaches Claude" on exit 2 or decision: "block", and "can't replace the prompt; it only injects additionalContext alongside it"; the default hook timeout there is 30 seconds (Claude Code hooks). On this host "redact" is unavailable; "hold and tell" is.
  • The prompt is the smaller channel: "Your prompts and the files Claude reads are transmitted to the Anthropic API or your configured provider with or without a sandbox"; a prompt-only check leaves file reads and tool results unchecked, so "nothing leaves this machine unchecked" should read "no prompt leaves unchecked" (Claude Code sandbox environments).
  • Rule-based detection misses what matters most, and small models do not close the gap: REDACT (June 2026) recall on HIGH-sensitivity categories Presidio (a candidate opt-in adapter) 0.07, GLiNER 0.42, OpenAI's Privacy Filter 0.57, GPT-4.1 0.74, Claude Sonnet 4.6 0.77; partial micro-F1 0.195 / 0.320 / 0.512 / 0.597 / 0.636. PIIBench (April 2026) put every detector under F1 0.14. The two rank differently and agree that a local-only gate cannot carry the promise (arXiv 2606.19881; arXiv 2604.15776).
  • The earlier local survey's hybrid figure stands (deterministic ~69%, hybrid ~83%, a practitioner benchmark): deterministic layer as the gate, local model as the assist (2026-08-22 note).
  • Presidio, a candidate opt-in adapter, is regex, checksum and NER recognisers in Python, "transitioning to a community-owned project", with "no guarantee that Presidio will find all sensitive information" (Presidio docs).
  • Fail-open at the hook is a configuration choice, not a host constraint: the default UserPromptSubmit timeout is 30 seconds and settable per hook; a hook that reaches it is cancelled and the prompt proceeds unless the hook sets onFailure: "block" (host v2.1.295 or later), which blocks the prompt on failure or timeout. A blocked prompt's text is still written to the local transcript (the block message ends with "Original prompt:" unless the hook suppresses it), which a privacy-motivated hold should disclose (Claude Code hooks).

Path 2: native, deterministic-first, hold-and-tell at the hook, with the local model as the opt-in adapter behind the existing scanner seam (adr-22's shape). The independent fit-challenge runs at plan time.

Open Questions

  • (SOTA 2026-10-23) The host answers "redact or hold" with hold: the record should say so by capability ("where the host lets a hook hold a prompt") rather than by harness.
  • (SOTA 2026-10-23) Whether the promise is narrowed to prompts, since file reads and tool results leave unchecked on every host surveyed.
  • (SOTA 2026-10-23) Fail-closed or fail-open at the hook: the host offers both (onFailure: "block", or the default that lets the prompt through); the owed ADR chooses, and hold-within-budget is a latency discipline rather than the only fail-closed posture. A held prompt's text still reaches the local transcript either way.
  • Redact or hold: does a finding rewrite the prompt, or stop it and ask the person?
  • Latency: what delay per prompt the person accepts before the check is worth switching off.
  • Which local runtimes the adapter speaks to, and whether the scanner-only half ships first without a model.
  • The owed ADR on failing open: letting a prompt through when the local check is down is a trust posture at a privacy boundary, not a detail of this intent. The decomposition calibration note predicts a SPLIT, this intent plus an ADR on that posture, and flags it for the human; the loud-degradation scope item and the last criterion above hold only once that ADR rules fail-open rather than hold-and-ask.

Audit Notes

Empty. Populated by intent-auditor when intent moves to shipped/.

Frontmatter

iditd-2609292109005937
typeintent
lifecycledrafts
severityminor

.abcd/development/intents/drafts/itd-2609292109005937-a-person-who-opts-in-has-every-prompt.md
open on GitHub ↗ · commit history ↗

References1

  • adr-22Bundled dependencies become pluggable adapters over a native defaultrelated

Referenced by1

  • iss-2608261543489261Optional feature: a local model within the harness captures prompts and sanitises, cleans and PII-checks them before they are piped through to the harness's foundation model. A small on-machine model sits at the prompt seam (the UserPromptSubmit surface is the natural hook) and rewrites or flags secrets, private names and PII locally, so nothing sensitive leaves the machine unredacted — the redact-on-write posture the history store already takes for transcripts, applied upstream to live prompts. Composes with the existing scanner and banlist layers rather than replacing them, and with the privacy legibility thread of the UX work: the product thinker gets one plain claim, nothing leaves this machine unchecked. Opt-in adapter per the host-delegated default; a missing local model degrades loudly to pass-through, never silently.related

mentions2

  • dcn-26092900000000112026-09-29 — The product thinker answered the twenty-six Group J rulings (plan or close), J1 to J26 (recorded by lane recGroupJ of autonomous run A, for orchestrator abcd-fc). The answers are kept verbatim in the local-tier file `.abcd/.work.local/scratch/reports/rulings-answered-2609-29.md`, section "Group J", dated 2026-09-29, and are restated here because that file is not committed. PLAN: the installer script becomes a minimal starter with an ownership-checked hand-over, planned as a new intent with its planning interview owed (J2, iss-377, draft itd-2609292106557115); token metering and size classes are planned as one intent (J3, iss-2608301744251874 and iss-2608301856299268), and session token accounting in the history store joins that metering intent (J4, iss-2608220150157508; all three in draft itd-2609292107351737); the sources tooling moves into abcd's core with ingest and consult as abcd verbs (J5, iss-27, whose corpus half itd-76 already delivered), and the backfill of the placeholder source entries is part of that intent (J6, iss-55; both in draft itd-2609292108089653); the grill hands off to an installed external interview skill and falls back to its own (J11, iss-165, draft itd-2609292108373494); an opt-in local-model prompt sanitiser is planned (J14, iss-2608261543489261, draft itd-2609292109005937); decision-to-transcript links are planned, with the anchor kind and the link's home settled in the planning interview owed for draft itd-171 (J16, iss-2608290819228175); the dredge synthesis, its write-ups as their own memory source class, is planned together with draft itd-25, whose planning interview is owed (J19, iss-2609211905340006); one provenance register across ingest and vendoring is planned together with draft itd-26, whose planning interview is owed (J20, iss-2609211905346507); release retention, keeping the newest release per version line, is automated by planning draft itd-70 (J21, iss-282); a rules-backend seam with an opt-in CARL adapter is planned, the native loader staying the default (J22, iss-64, draft itd-2609292109214516); core-owned managed pre-commit gates are planned with draft itd-62 (J23, iss-84); a behavioural end-to-end scenario suite per verb family is planned (J24, iss-48, draft itd-2609292109475690). Every draft stays in drafts/ until a person plans it, and each source issue links its draft and names that planning interview in its deferral. BUILD: the teaching plane, the rules-loader safety domain generated from the hazard registry, is built as a lane, the registry being the single source (J10, iss-151 and itd-103; a code lane owns it). RULED DETAILS: `source_kind` carries both, as two separate labels, one for the tool and one for the route (J13, iss-2608230752354928); the prompt router's removal signal is the full list of active domains every time, a domain's absence meaning it has stopped (J15, iss-2608261550580260); setup offers an outside AI service (for example OpenRouter) at install, skippable, once the API adapter ships (J18, iss-2609081951416843, which waits on the API adapter); the salvage-hook timeout is 120 seconds, the wait must show a counter or a message while it runs and never stall silently, and every per-event timeout is pinned in a test (J25, iss-323). J13, J15 and J25 are carried by code lanes. CLOSE: the quick-tunnel preview protocol is closed unless the need recurs (J26, iss-2608230617385431, wontfix with that reason). PARKED ON A TRIGGER: agent payment protocols are kept under watch, not now, revisited as the protocols mature (J8, iss-138); the findings-only skill waits for the skill format to be versioned and stewarded (J9, iss-139); the disposition worksheet as an intent and a site page waits until after the first study (J17, iss-2609021815529020). DECIDE LATER: the Homebrew tap stays parked (J1, iss-380); pluggable search back ends (J7, iss-26); forge-backed record numbering (J12, iss-2608210737264758).
  • dcn-26092900000000202026-09-29 — The product thinker answered the twenty-six Group J rulings (plan or close), J1 to J26 (recorded by lane recGroupJ of autonomous run A, for orchestrator abcd-fc). The answers are kept verbatim in the local-tier file `.abcd/.work.local/scratch/reports/rulings-answered-2609-29.md`, section "Group J", dated 2026-09-29, and are restated here because that file is not committed. PLAN: the installer script becomes a minimal starter with an ownership-checked hand-over, planned as a new intent with its planning interview owed (J2, iss-377, draft itd-2609292106557115); token metering and size classes are planned as one intent (J3, iss-2608301744251874 and iss-2608301856299268), and session token accounting in the history store joins that metering intent (J4, iss-2608220150157508; all three in draft itd-2609292107351737); the sources tooling moves into abcd's core with ingest and consult as abcd verbs (J5, iss-27, whose corpus half itd-76 already delivered), and the backfill of the placeholder source entries is part of that intent (J6, iss-55; both in draft itd-2609292108089653); the grill hands off to an installed external interview skill and falls back to its own (J11, iss-165, draft itd-2609292108373494); an opt-in local-model prompt sanitiser is planned (J14, iss-2608261543489261, draft itd-2609292109005937); decision-to-transcript links are planned, with the anchor kind and the link's home settled in the planning interview owed for draft itd-171 (J16, iss-2608290819228175); the dredge synthesis, its write-ups as their own memory source class, is planned together with draft itd-25, whose planning interview is owed (J19, iss-2609211905340006); one provenance register across ingest and vendoring is planned together with draft itd-26, whose planning interview is owed (J20, iss-2609211905346507); release retention, keeping the newest release per version line, is automated by planning draft itd-70 (J21, iss-282); a rules-backend seam with an opt-in CARL adapter is planned, the native loader staying the default (J22, iss-64, draft itd-2609292109214516); core-owned managed pre-commit gates are planned with draft itd-62 (J23, iss-84); a behavioural end-to-end scenario suite per verb family is planned (J24, iss-48, draft itd-2609292109475690). Every draft stays in drafts/ until a person plans it, and each source issue links its draft and names that planning interview in its deferral. BUILD: the teaching plane, the rules-loader safety domain generated from the hazard registry, is built as a lane, the registry being the single source (J10, iss-151 and itd-103; a code lane owns it). RULED DETAILS: `source_kind` carries both, as two separate labels, one for the tool and one for the route (J13, iss-2608230752354928); the prompt router's removal signal is the full list of active domains every time, a domain's absence meaning it has stopped (J15, iss-2608261550580260); setup offers an outside AI service (for example OpenRouter) at install, skippable, once the API adapter ships (J18, iss-2609081951416843, which waits on the API adapter); the salvage-hook timeout is 120 seconds, the wait must show a counter or a message while it runs and never stall silently, and every per-event timeout is pinned in a test (J25, iss-323). J13, J15 and J25 are carried by code lanes. CLOSE: the quick-tunnel preview protocol is closed unless the need recurs (J26, iss-2608230617385431, wontfix with that reason). PARKED ON A TRIGGER: agent payment protocols are kept under watch, not now, revisited as the protocols mature (J8, iss-138); the findings-only skill waits for the skill format to be versioned and stewarded (J9, iss-139); the disposition worksheet as an intent and a site page waits until after the first study (J17, iss-2609021815529020). DECIDE LATER: the Homebrew tap stays parked (J1, iss-380); pluggable search back ends (J7, iss-26); forge-backed record numbering (J12, iss-2608210737264758).