CTO verdict at FRE-1480: two sentences at db3e695 were false.
(b) sendDefaultPii = false does not stop Sentry receiving the connection
IP (sentry-cocoa 9.26.1 sets infer_ip = auto for Cocoa; only the Sentry
project's Prevent Storing of IP Addresses switch stops it) — the shipped
Settings rows already say so. The IP sentence is restored.
The iPhone paragraph described an opt-in build no tester has: the build
in TestFlight (ios-v0.3.2, 2026-10-22) predates FRE-355 and starts
Sentry on every launch with no off switch. The paragraph now says that.
Header comment and marketing/drafts/privacy-page.md rows corrected to
match (release range narrowed to 0.3.0-0.15.0; evidence rows record the
IP and the TestFlight provenance). privacy-page.patch regenerated.
Suite: merge tree of a0e6ff1 + this branch runs the same failure set as
clean a0e6ff1 (2 junit failures, the known Lineage-redirect
environmental pair); the host's env-validation aborts account for the
count noise. Zero new failures.
v0.15.1 (2026-11-04) is the first release tag containing FRE-355's merge
6e74b261, and the live appcast serves v0.15.2. The page's own Contingency
made the always-on (b) conditional on no release shipping FRE-355; that
condition no longer holds, so the always-on text would be false on the
build the page deploys with.
Swap applied with two corrections against the pre-written contingency
text, both measured in the shipped starter (Sources/NookApp/main.swift,
CrashReporting.onTracesSampleRate):
- session pings and performance traces (0.1) still flow while enabled,
so they are named — the contingency's own completeness warning;
- sendDefaultPii = false means no IP is attached, so the swap text's
'Sentry also receives your IP address' is dropped, not kept.
iPhone paragraph corrected the same way (iOS gates identically:
ios/AgentNookMobile/App.swift startIfEnabled, SettingsView default off).
Last Updated -> November 6, 2026. privacy-page.patch regenerated
(c1c498e..branch); draft sequencing/evidence rows updated.
FRE-354 ruled the page 'verified after corrections — do not apply as it
stands'. This applies all of them, plus the two copy decisions the verdict
delegated to the CMO (fuller iPhone paragraph; full (c) block with the
LAN/tailnet sentence and the matching section-3 clause).
- (b) no macOS username (sendDefaultPii sets the IP only), session pings
named; still the always-on form: no release tag contains FRE-355's
opt-in merge (6e74b261; v0.15.0 predates it), so the page stays true on
the build users run. Contingency swap owed with the first release that
ships FRE-355.
- (a) device-name sentence corrected (no activations UI exists); fail-open
scoped to trial/status, activation needs a connection once.
- (c) relay qualified as the default path; relay sees IDs/names/platforms;
direct LAN/tailnet pairing sentence added.
- (j) 'not a cloud service' instead of two absolutes FRE-322 flagged;
tailnet path named.
- iPhone companion paragraph added (TestFlight beta is in users' hands,
same Sentry config, push token disclosed). Push-token evidence row
recorded for FRE-333's inventory.
- Opening, section heading ('What leaves your devices') and section 3
('content', not all traffic) per the verdict; Last Updated bumped.
- Draft evidence table and contingency warning rewritten per the verdict
(the old warning named a username Sentry never sends).
Suite on this tree: 441 pass / 3 skip / 53 fail / 2 errors — failure and
error sets byte-identical to clean master d44133f (458/3/53/2; the delta
is master's remote-claims.test.ts, 17 passing tests this branch's base
predates). Local only; the push is the sponsor's (card 392a8465).
FRE-333's egress inventory landed after this patch was first written, and its
own §G proposed a page text. This is that text corrected against the inventory
it cites, six differences, each forced by a row:
- the opening no longer says prompts are "never sent to us" (sealed frames
transit our relay; a remote machine carries them by design)
- (d) Weather states that it registers with the relay even with Phone off, and
that a licensed Mac presents its license key there - SidecarController.weather()
goes through the same relayCredential(licenseKey:) as the phone path
- (a) adds /deactivate (key + UUID) and the trial email (email + UUID, once)
- (i) stops saying a trial email delivers a license key; it is one reminder
before the trial ends, the key is issued at checkout
- (b) keeps today's build (on every launch, no off switch, IP + macOS username);
the opt-in form is the Contingency swap, so the page is true on the build it
deploys with
- (j) carries the CTO's FRE-322 §2 code fact, with the remote-machine exception;
he may still cut it
Page file untouched, nothing published. Patch re-checked with git apply --check
and parse-checked with esbuild; the site's own suite is `bun test` and this host
has no bun, so that stays an apply-time obligation. Verification is FRE-354;
the Sentry opt-in is proposed as FRE-355.
The live page says the app 'sends only the minimal data required for trial
and licensing' and calls the hardware UUID masked. Against the FRE-333 egress
inventory that is wrong in two directions: it omits Sentry (every launch,
sendDefaultPii = true, no off switch), the relay and its install ID, the
licence key crossing to the relay, sealed phone payloads, weather to the relay
and to Apple, the GeoIP lookups, the speed test, the changelog fetch,
bug-report contents and update checks; and the UUID it sends is raw.
Reorganised by connection, ten reachable rows from the inventory, one
favourable sentence (the FRE-322 §2 hook/bridge fact) that the CTO may still
decline. Sentry paragraph describes today's build with the opt-in swap held in
the rationale file. Page file untouched; the patch applies cleanly to c1c498e.
