98 lines
5.4 KiB
Markdown
98 lines
5.4 KiB
Markdown
# MVP Acceptance
|
|
|
|
The MVP is complete only when the following scenarios work together in the production Swift application. Passing the current native capability proof alone is not sufficient.
|
|
|
|
## Product scenario
|
|
|
|
Given that enabled Collectors have observed normal work, when the user opens the Companion Island and asks, "What was I working on, and what should I do next?", then Mastermind:
|
|
|
|
- responds through the configured Local Provider;
|
|
- uses relevant knowledge from screen, workspace, calendar, terminal, and audio Sources;
|
|
- distinguishes user-confirmed Facts from inferred Assertions;
|
|
- identifies conflicting or stale knowledge;
|
|
- states when evidence is insufficient;
|
|
- attaches an inspectable Context Receipt.
|
|
|
|
## Presence
|
|
|
|
- Mastermind launches as a menu bar application without a Dock icon.
|
|
- Only the stable Menu Bar Item is visible at rest.
|
|
- Hover reveals the Companion Island on the primary display.
|
|
- Click expands it and focuses text input.
|
|
- Show Mastermind in the menu provides a reliable fallback.
|
|
- The expanded surface contains assistant, history, source, provider, graph, audit, and privacy controls.
|
|
|
|
## Continuous collection
|
|
|
|
- Enabled Collectors start after launch unless paused state was persisted.
|
|
- Screen collection follows the display containing the key window and processes meaningful changes rather than every full frame.
|
|
- Microphone and system audio remain separate through local ASR.
|
|
- Workspace collection is limited to explicitly connected roots.
|
|
- Calendar and Reminders are read-only and limited to selected calendars and lists.
|
|
- Terminal collection retains command metadata but not stdout or stderr by default.
|
|
- Low Power Mode and thermal pressure reduce processing without corrupting state.
|
|
- One failed Collector does not stop healthy Collectors.
|
|
|
|
## Local-only processing
|
|
|
|
- Packet inspection and integration tests confirm that Source content does not leave the Mac.
|
|
- The configured Local Provider accepts only loopback or Unix-socket endpoints.
|
|
- OCR, ASR, embeddings, Fact extraction, retrieval, and answer generation work without internet access.
|
|
- Raw screen frames, audio, OCR text, and full transcripts are destroyed after local reduction.
|
|
- When a required local processor is unavailable, Mastermind records a Gap and does not queue raw content.
|
|
|
|
## Knowledge integrity
|
|
|
|
- Observations are immutable until retention removes them.
|
|
- Assertions retain time, confidence, and Provenance.
|
|
- Conflicting Assertions coexist and produce an explicit conflict instead of silent overwrite.
|
|
- Only explicit user confirmation or correction creates a Fact.
|
|
- Confirmed Facts survive normal age and size eviction.
|
|
- Ambiguous entity matches stay separate until confidence is sufficient or the user merges them.
|
|
- Context retrieval treats instructions inside Source content as untrusted data.
|
|
|
|
## Retention and control
|
|
|
|
- Inferred context defaults to 90 days and 2 GB and can be reconfigured.
|
|
- Eviction uses `lastObservedAt` and does not evict confirmed Facts.
|
|
- Assistant History has no automatic TTL.
|
|
- The user can delete one Assistant Session or all Assistant History.
|
|
- Pause All immediately stops every Collector and remains paused after relaunch.
|
|
- Resume All restarts only enabled and permitted Collectors.
|
|
- The encrypted archive round-trips context, history, policies, and settings without Provider credentials.
|
|
|
|
## Trust and diagnostics
|
|
|
|
- The Menu Bar Item menu shows the real state of every Collector despite the stable glyph.
|
|
- macOS capture indicators and permission surfaces remain unmodified.
|
|
- Activity Log records Collector lifecycle, Gaps, permission errors, and Provider requests without Source content.
|
|
- Context Receipts name the Provider and all supporting Sources and Observations.
|
|
- The sanitized diagnostic bundle contains no prompts, answers, Facts, OCR, ASR, or Provider payloads.
|
|
- Mastermind's windows are excluded from its own screen context.
|
|
- Third-party capture exclusion is presented and tested as best effort, never guaranteed.
|
|
|
|
## Assistant boundary
|
|
|
|
- The assistant streams text answers in Russian, English, and mixed-language work.
|
|
- Outputs are answers, plans, or drafts only.
|
|
- The production target contains no Computer Control, Tool Executor, autonomous action, Codex login, Codex app-server, or hidden experimental Cloud Provider.
|
|
- If the Local Provider is unavailable, existing graph search, history, settings, and diagnostics remain accessible.
|
|
|
|
## Definition of done
|
|
|
|
- Automated tests cover domain invariants, retention, encryption boundaries, policy defaults, independent Collector failure, and raw-buffer disposal.
|
|
- Integration tests use synthetic Sources and local mock sidecars.
|
|
- Manual tests cover macOS permissions, microphone, system audio, screen exclusion, primary-display changes, Launch at Login, sleep/wake, Low Power Mode, and relaunch while paused.
|
|
- Logs and fixtures contain no captured user content.
|
|
- Canonical documentation and implementation vocabulary agree with `CONTEXT.md`.
|
|
|
|
## Architectural compliance
|
|
|
|
- [ ] Code follows **Strict Clean Architecture** with capability modules.
|
|
- [ ] Dependency Rule is enforced at compile-time between targets.
|
|
- [ ] No global EventBus; communication uses ports and typed async streams.
|
|
- [ ] Context Graph updates are performed by idempotent projectors with durable checkpoints.
|
|
- [ ] Privacy-sensitive egress is gated by a central fail-closed Egress Gate.
|
|
- [ ] Swift 6 Strict Concurrency is enabled and produces no warnings.
|
|
- [ ] All semantic declarations have Russian DocC per the **Commenting Standard**.
|