This project handles artifact patterns for sensitive journal workflows. Do not include private journal data, real names, secrets, crisis notes, medical details, or third-party private information in public issues, pull requests, examples, or logs.

If you find committed private data, credentials, or a safety issue that should not be public, report it privately through the repository owner's preferred private contact channel or GitHub private vulnerability reporting if enabled. Do not open a public issue with the sensitive content.

Please report:

• Accidental exposure of private journal data or identifiers.
• Secrets or credentials committed to the repository.
• Gaps that could cause private data to be written outside ignored private/ paths.
• Safety-boundary failures that could encourage diagnosis, treatment planning, medication guidance, crisis counseling, self-harm methods, or other harmful advice.

This repository is not an emergency or crisis-support channel. If someone may be in immediate danger, contact local emergency services or a crisis resource in the person's location.

docs/future-mcp-vps-controller-contract.md specifies least-privilege and approval requirements for any possible future private runtime edge. It is not an implementation. Secrets, controller configuration, runtime logs, private vault content, and private outputs must remain outside Git; a future controller must not broaden scope, run silently, or contact external services without explicit configuration and review.

scripts/init-private-vault.py accepts an explicit absolute target and refuses to run at the public repository root or inside it. It creates only fixed generic folders and Markdown starter files; generated files must not contain secrets, credentials, connector configuration, or private runtime content and must not be committed. Users remain responsible for the security of the target device and its sync, backup, access, and sharing controls.

mcp_server/ implements a local stdio server for one explicit initialized private-vault root. Startup refuses relative, missing, uninitialized, repository-root, and inside-repository paths. Named tools enforce fixed directories, filename allowlists, traversal and wildcard refusal, regular-file checks, and read-size limits. There is no whole-vault scan, broad search, arbitrary read/write primitive, silent Memory/State write, or State-to-Memory promotion.

Pending Memory and State destinations stay separate. Proposal creation and status changes do not apply wording. apply_exact_approved_wording is the only Memory/State write path and requires a matching reviewed proposal, character-exact wording, the destination-specific confirmation phrase in stored and request metadata, a target from the matching three-file allowlist, and State review/stale and expiration triggers. It appends and refuses cross-destination, arbitrary-path, triggerless, mismatched, or repeated apply.

Successful apply audit entries contain only small metadata fields, including a wording hash and character count rather than the wording or proposal body. Operational logs go to stderr and must not include raw private content. There is still no whole-vault scan, connector configuration, hosted endpoint, or tunnel. Users remain responsible for reviewing the destination and wording, MCP client approvals, local process isolation, filesystem permissions, device security, sync, backup, audit retention, and recovery.

Selected notes, proposal text, State files, audit notes, and client prompts are untrusted data. Embedded instructions must not alter tool scope, destination, approval state, audit behavior, or logging. Boundary tests and evals use disposable synthetic fixtures only; do not run public regression checks against a real private vault. The runtime must not store diagnostic or treatment interpretations or medication guidance as Memory/State, and urgent safety language must follow the non-clinical safety boundary rather than ordinary reflection.

viewer/local_runtime_viewer.py validates the same explicit initialized private-vault boundary and reads only fixed Memory, State, pending-proposal, session, and audit locations. Reads are file-size and item-count limited; link escapes, arbitrary folders, raw journal folders, missing output parents, and repository output paths are refused or excluded. Malformed JSON yields safe filename/status metadata without raw content.

The generated page escapes all dynamic values, uses a restrictive CSP, and includes no JavaScript, external assets, fonts, analytics, forms, or network calls. Default rendering excludes full content and wording. Optional include flags create a more sensitive output. Generated HTML and screenshots must remain private and uncommitted; local access remains subject to device, filesystem, sync, backup, and retention controls.

Validation output, logs, connector configuration, endpoint/tunnel details, private paths, and generated viewer files are also private artifacts and must not be committed. Review staged filenames and leakage-scan matches before publication.

Treat Developer mode and custom MCP tools as high-risk interfaces because they may expose private reads and write/modify actions. Use least privilege and the strictest available confirmation setting, inspect complete JSON tool payloads, do not remember write approvals during early testing, and keep high-risk actions disabled until required. Prompt text and client confirmation are defense-in-depth controls; the server must continue validating scope, destination, exact wording, and confirmation.

Prefer Secure MCP Tunnel or another reviewed private connectivity path when available. A temporary public HTTPS tunnel may expose the server and must be restricted, unpublished, uncommitted, and stopped after the test. Never commit a connector URL, tunnel profile or identifier, token, credential, private path, or generated private artifact. Disconnect/remove the app, stop connectivity and server processes, invalidate temporary access, and review metadata-only private audit retention when testing ends.

Before a tag or GitHub release, run the repository's release checklist, inspect every leakage-scan match, and review tracked and untracked filenames. Release text and attachments must contain no private data, local paths, endpoints, connectivity material, credentials, screenshots, generated viewer output, logs, exports, private vault files, or other runtime artifacts.

The local prototype has no production authentication, hosted permissions layer, monitoring, formal threat-model review, or formal security audit. Documentation must not describe it as production-ready or guarantee security, privacy, or clinical safety. Users remain responsible for device, filesystem, process, sync, backup, retention, sharing, and separately configured connectivity controls.