CTO verdict at FRE-1480: two sentences at db3e695 were false.
(b) sendDefaultPii = false does not stop Sentry receiving the connection
IP (sentry-cocoa 9.26.1 sets infer_ip = auto for Cocoa; only the Sentry
project's Prevent Storing of IP Addresses switch stops it) — the shipped
Settings rows already say so. The IP sentence is restored.
The iPhone paragraph described an opt-in build no tester has: the build
in TestFlight (ios-v0.3.2, 2026-10-22) predates FRE-355 and starts
Sentry on every launch with no off switch. The paragraph now says that.
Header comment and marketing/drafts/privacy-page.md rows corrected to
match (release range narrowed to 0.3.0-0.15.0; evidence rows record the
IP and the TestFlight provenance). privacy-page.patch regenerated.
Suite: merge tree of a0e6ff1 + this branch runs the same failure set as
clean a0e6ff1 (2 junit failures, the known Lineage-redirect
environmental pair); the host's env-validation aborts account for the
count noise. Zero new failures.
v0.15.1 (2026-11-04) is the first release tag containing FRE-355's merge
6e74b261, and the live appcast serves v0.15.2. The page's own Contingency
made the always-on (b) conditional on no release shipping FRE-355; that
condition no longer holds, so the always-on text would be false on the
build the page deploys with.
Swap applied with two corrections against the pre-written contingency
text, both measured in the shipped starter (Sources/NookApp/main.swift,
CrashReporting.onTracesSampleRate):
- session pings and performance traces (0.1) still flow while enabled,
so they are named — the contingency's own completeness warning;
- sendDefaultPii = false means no IP is attached, so the swap text's
'Sentry also receives your IP address' is dropped, not kept.
iPhone paragraph corrected the same way (iOS gates identically:
ios/AgentNookMobile/App.swift startIfEnabled, SettingsView default off).
Last Updated -> November 6, 2026. privacy-page.patch regenerated
(c1c498e..branch); draft sequencing/evidence rows updated.
FRE-354 ruled the page 'verified after corrections — do not apply as it
stands'. This applies all of them, plus the two copy decisions the verdict
delegated to the CMO (fuller iPhone paragraph; full (c) block with the
LAN/tailnet sentence and the matching section-3 clause).
- (b) no macOS username (sendDefaultPii sets the IP only), session pings
named; still the always-on form: no release tag contains FRE-355's
opt-in merge (6e74b261; v0.15.0 predates it), so the page stays true on
the build users run. Contingency swap owed with the first release that
ships FRE-355.
- (a) device-name sentence corrected (no activations UI exists); fail-open
scoped to trial/status, activation needs a connection once.
- (c) relay qualified as the default path; relay sees IDs/names/platforms;
direct LAN/tailnet pairing sentence added.
- (j) 'not a cloud service' instead of two absolutes FRE-322 flagged;
tailnet path named.
- iPhone companion paragraph added (TestFlight beta is in users' hands,
same Sentry config, push token disclosed). Push-token evidence row
recorded for FRE-333's inventory.
- Opening, section heading ('What leaves your devices') and section 3
('content', not all traffic) per the verdict; Last Updated bumped.
- Draft evidence table and contingency warning rewritten per the verdict
(the old warning named a username Sentry never sends).
Suite on this tree: 441 pass / 3 skip / 53 fail / 2 errors — failure and
error sets byte-identical to clean master d44133f (458/3/53/2; the delta
is master's remote-claims.test.ts, 17 passing tests this branch's base
predates). Local only; the push is the sponsor's (card 392a8465).
FRE-333's egress inventory landed after this patch was first written, and its
own §G proposed a page text. This is that text corrected against the inventory
it cites, six differences, each forced by a row:
- the opening no longer says prompts are "never sent to us" (sealed frames
transit our relay; a remote machine carries them by design)
- (d) Weather states that it registers with the relay even with Phone off, and
that a licensed Mac presents its license key there - SidecarController.weather()
goes through the same relayCredential(licenseKey:) as the phone path
- (a) adds /deactivate (key + UUID) and the trial email (email + UUID, once)
- (i) stops saying a trial email delivers a license key; it is one reminder
before the trial ends, the key is issued at checkout
- (b) keeps today's build (on every launch, no off switch, IP + macOS username);
the opt-in form is the Contingency swap, so the page is true on the build it
deploys with
- (j) carries the CTO's FRE-322 §2 code fact, with the remote-machine exception;
he may still cut it
Page file untouched, nothing published. Patch re-checked with git apply --check
and parse-checked with esbuild; the site's own suite is `bun test` and this host
has no bun, so that stays an apply-time obligation. Verification is FRE-354;
the Sentry opt-in is proposed as FRE-355.
The live page says the app 'sends only the minimal data required for trial
and licensing' and calls the hardware UUID masked. Against the FRE-333 egress
inventory that is wrong in two directions: it omits Sentry (every launch,
sendDefaultPii = true, no off switch), the relay and its install ID, the
licence key crossing to the relay, sealed phone payloads, weather to the relay
and to Apple, the GeoIP lookups, the speed test, the changelog fetch,
bug-report contents and update checks; and the UUID it sends is raw.
Reorganised by connection, ten reachable rows from the inventory, one
favourable sentence (the FRE-322 §2 hook/bridge fact) that the CTO may still
decline. Sentry paragraph describes today's build with the opt-in swap held in
the rationale file. Page file untouched; the patch applies cleanly to c1c498e.
Byte-identical to The-Nook drafts/faq-from-objections.md at 2c1915e3. FRE-334
returned option A, so step 2b is done and the publish card has one option, not
three.
Source issue: FRE-326.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Byte-identical to The-Nook drafts/faq-from-objections.md at b86a980b. The plan now
names the rule-3 patch and FRE-334, the Chief of Staff's withdrawal ask.
Source issue: FRE-326.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The CTO verdict on the /faq entries (FRE-329) traced the false privacy answer
to marketing/positioning.md rule 3 and its approved-claims row, and said the
rule has to come down in the same change as the /faq withdrawal or the next
page restates the claim.
This adds the exact patch for that, saved next to the page patch so both go in
as one commit when the gates clear. It is not applied: the withdrawal decision
is the Chief of Staff's (FRE-326 step 2b), and the replacement copy waits on
FRE-333's egress inventory.
It also carries the stale "macOS 14+" row, which NOOK-881 retired: the app
cannot start below 14.2, and the site has said 14.2+ since 134f41e. Rule 3's
new text is corrected against /privacy as it reads today: that page does name
the hardware UUID and the device name, and says nothing about crash reporting
with PII or the relay.
Source issues: FRE-326, FRE-329, FRE-333.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Six entries change text, exactly as FRE-329's replacement sentences: E2 keeps the row
for 15 minutes, E3 names the Login Items toggle and ~/.nook instead of "one entry, no
writes outside the directory", E4 says which terminals take a typed reply, E5 says one
island per enabled display, E6 says it never runs agents in the background, E8 lists the
five user-triggered network uses. E1 and E7 are unchanged; no entry was cut.
The page patch is regenerated from the corrected entry text, so the draft and the patch
cannot drift apart. The gate table now records the verdict (done 2026-10-29) and puts the
privacy withdrawal plus the positioning.md rule-3 strike on the Chief of Staff with a date,
because the verdict found rule 3 is the source of the false claim.
Nothing is applied to the page: src/routes/nook/faq.tsx is untouched on this branch.
Source issue: FRE-326. Verdict: FRE-329.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The draft maps every proposed /faq entry to a live question or a named
NOOK report, withdraws the privacy answer that the current build
contradicts, and holds the questions we cannot answer yet. The page
patch is included but not applied; it waits on the CTO verdict and the
human move to approved/.
Source issue: FRE-326.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
FRE-323. The one-click remote install is app-UI-only and needs hand-edited ~/.ssh/config plus a one-time ssh-copy-id (FRE-320); FRE-315 and FRE-322 hold the claim unverified and demo-gated.
- drop the Remote tile and its mock from the feature collage
- drop the "Any SSH box, one click away" breakdown, its demo and bullets
- drop "Works across every hooked agent, local or remote"
- drop the "One-click SSH setup" chip
- move the copy to marketing/drafts/remote-ssh/ and mark remote held in marketing/positioning.md
No replacement claim was added. Deploy waits on a push credential for the GitHub repo Vercel builds.
One voice, one place, so agent-drafted assets stop inventing framing
per artifact. positioning.md carries the wedge, the category-noun rule
(freno-dev/AGENTS.md competitor ban), claims each backed by code, the
honest privacy scoping and the voice/banned-phrasings list. The tree
adds calendar.json, per-channel briefs, drafts → pending → approved →
posted, metrics and listening — with the hard rule up front: approved/
is the only thing a human ever publishes from, nothing posts itself.
Issue: FRE-17
