workspace-privacy-context.md

doc_id	workspace-privacy-context
title	Workspace privacy context
language	en
source_language	en
implementation_status	current
document_status	current
translation_status	source-only
last_verified	2026-09-04
owners	maka-backend

Workspace privacy context

WorkspacePrivacyContext is the shared contract for privacy-sensitive operations. Its current shape is deliberately small:

export interface WorkspacePrivacyContext {
  incognitoActive: boolean;
}

Authority

The Runtime Host owns the effective workspace privacy state as runtime policy. Renderers may request a change and display the current value, but a renderer-provided value is never proof of the effective state.

The current authority path is:

• apps/desktop/src/renderer/settings/general-settings-page.tsx requests settings changes.
• The effective state is the Runtime Host runtime policy: packages/core/src/runtime-policy.ts declares the readonly privacy.incognitoActive field and defaults it to false; patches are validated by the policy codec's privacy patch record rule.
• Desktop surfaces resolve the effective state from the policy via queryRuntimePolicy() (for example apps/desktop/src/main/runtime-host-search-ipc-main.ts), and core-boundary consumers validate the projected context through validateWorkspacePrivacyContext() (packages/core/src/incognito.ts) before reading any field.

Runtime Host omits notification attention from Session catalog changes while its privacy policy is active or cannot be read. Desktop does not use the local settings store to decide Host privacy.

validateWorkspacePrivacyContext() rejects malformed input; it never converts missing or invalid data to false. Boundaries that cannot resolve a valid authoritative context must fail closed.

Consumer rule

incognitoActive: false only means that incognito mode did not block the operation. It is not general permission to read, write, search, capture, or transmit data. Every consumer must still apply its own settings, permission, and retention rules.

When incognitoActive is true, each privacy-sensitive consumer defines a fail-closed result at its existing main-process boundary. The Runtime Host composition, the desktop main-process consumers, and their focused tests own the current inventory. Do not duplicate that inventory here, add another incognito flag, copy the state into a parallel store, or let a renderer self-attest.

Contract changes

Adding fields, changing scope, or changing default semantics is a cross-cutting contract change. Update the core type and validator, main-process authority path, every consumer, tests, and this document together.