Privacy and telemetry#

Co-Vibe records coordination metadata. It does not record private conversation or source-code content.

What Co-Vibe stores#

Co-Vibe stores:

tasks, workstreams, blockers, decisions, and completion summaries
agent session timing and status
MCP tool usage events
verified model and token counters plus explicit billing-mode metadata (service_tier/speed) when a provider event exposes it
branch names, changed file paths, diff hashes, and commit metadata
overlap warnings and human confirmation reasons
weekly summaries and share-link snapshots when a user creates them
full research/report deliverables from docs/research and docs/reports when first-connect sharing runs, or when an agent deliberately ingests one
a secret-free setup report containing agent enums, companion version, semantic config digest, and setup/service states

These records let a team see what is happening before a pull request appears.

What stays local#

The local companion does not send:

prompts
model responses
full transcripts
ordinary file contents (except research documents selected by the committed .covibe.json research_paths consent surface described below)
local database files
raw MCP tokens

Claude Code, Codex, and Cursor capture paths read only the counters and metadata needed for coordination and verified usage, including explicit billing mode when the local provider event records it. Counter-only telemetry payloads may be submitted to the server, but Co-Vibe normalizes them into counters, provenance, cost data, and a usage hash. Payloads that include prompt, transcript, or raw response fields are rejected.

Agent credentials#

Setup stores per-agent credentials in ~/.covibe/credentials.json with local file permissions. Agent config files contain a non-secret COVIBE_AGENT marker and the Co-Vibe origin, not the raw token.

MCP tokens are owned by the developer who approved setup. Revoking a token cuts off the corresponding agent.

Repo controls#

Developers can exclude a repo:

bash

covibe-local exclude

They can also switch the machine to opt-in for new repos:

bash

covibe-local exclude --new-repos

Excluded repos do not send snapshots, telemetry inbox files, session activity, or MCP calls to Co-Vibe. With the new-repos opt-in policy, first activity registers a repo as pending and sends nothing until the developer includes it.

Between full participation and exclusion sits the read-only trust tier:

bash

covibe-local readonly            # mark the current repo read-only
covibe-local readonly --list     # list read-only repos
covibe-local readonly --remove   # restore read-write

A read-only repo still recalls team learnings and coordinates normally (tasks, sessions, snapshots, and telemetry all flow), but the companion never writes brain content from it: memories import, transcript analysis runs, transcript skill flows, approve-to-upload reviews, the entire first-connect bootstrap—including research/report backfill and server-side synthesis—and the ongoing research_paths folder sync are all skipped for that repo. This is the consultant case — search the shared brain from a client checkout without contaminating it with that client's work. The setting is local-only; it needs no token or network.

The memory import also has a machine-wide pause, independent of transcript analysis: covibe-local memories disable stops agent-memory uploads from every repo on the machine until covibe-local memories enable. Setup's --no-first-share flag writes this pause (plus the transcript disable) before the watcher service installs, so declining the first-connect share has no race window. Consent updates use same-directory atomic replacement, and an existing malformed or torn consent file fails closed across transcript, memory-import, and first-share gates. A durable first-share pause also stops every later setup, watch, or manual bootstrap—including research/report backfill—at the shared boundary. After re-enabling transcripts and memories, the developer explicitly runs covibe-local brain bootstrap to perform the share.

Reports#

Paxel reports run only when the developer triggers them. Claude Code insights reports run on demand (covibe-local insights) and on a background cadence (default every 3 days; COVIBE_GSTACK_INSIGHTS_INTERVAL_MS=0 disables the auto-run). Both paths refuse while transcript reading is disabled machine-wide (covibe-local transcripts disable or setup --no-first-share), and refuse entirely on machines with excluded repos, since insights cannot honor per-repo exclusions.

Insights reports are team-visible by default — like the other first-connect knowledge sources (transcripts, memories, research docs) — so a captured report is shared with the workspace unless the owner marks it private from their profile. Report narrative sections are evaluated by the automatic typed admission lane, but prose without a complete grounded claim writes only a hash-only no_claim receipt—no candidate or learning row. Because an insights narrative can name projects and clients across every repo the developer has worked in, treat a report as shared and flip it private if it should not be. (Paxel reports remain private by default.)

Research documents#

Research documents enter the workspace through two bounded paths:

an explicit covibe_team ingest_research_doc agent call made on your instruction;
the companion's sync of the folders declared by the repo's committed .covibe.json research_paths (default docs/research + docs/reports when the file/key is absent) — the SAME scanner, run in two contexts.

That sync runs FORCED once during the first-connect bootstrap, so existing matching documents backfill immediately, and is not a continuous watcher. Repo exclusion, the new-repos opt-in policy, read-only mode, --no-first-share, and COVIBE_BRAIN_BOOTSTRAP=0 stop that bootstrap invocation at the shared runBrainBootstrap boundary before any stage reads or uploads.

Thereafter the same sync runs on a per-repo cursor at most once every 30 minutes to pick up new or changed documents — still not a continuous watcher, and NOT gated by --no-first-share (which only skips the one-shot bootstrap invocation above). An explicit "research_paths": [] opts the repo out of both invocations; excluded, pending, and read-only repos are always skipped. JSON syntax or shape errors warn and fall back to the convention folders; a config that cannot be securely opened, contained, or read within 64KiB fails closed and disables this source. Bootstrap and watch sync share a per-repo cross-process lock, and consent is rechecked before each document is opened or uploaded. The ignored .covibe/research-sync-state.json cursor avoids reading files whose size/mtime did not change and avoids uploading unchanged hashes. Configured roots and the .covibe cursor directory are realpath-contained inside the repo. A tick advances at most 5,000 new directory entries and saves a depth-bounded traversal frontier; a directory with more than 5,000 direct entries stops with a warning. An upload stop retries the same scan page before the frontier advances, while cycle-wide unseen, unreadable, or not-yet-scanned paths retain their previous cursor state. Destination state is keyed by a hash of origin+token, never the raw token. The cursor is opened no-follow and nonblocking with a 16MiB cap. Each file is opened without following a final symlink, revalidated before and after the read (including same-inode mutation), and read with a hard byte bound. New or changed documents are sent to the registry entry's Co-Vibe origin using that watcher's authenticated token, so they land in that token's tenant/workspace. Runs name the destination origin and repo in local logs. A local deletion prunes only the cursor after a complete traversal; it never deletes shared research knowledge.

Both paths store accepted documents as workspace-visible team knowledge that teammates can retrieve in full. The synthesis lane submits durable sections to automatic typed admission; report prose and incomplete claims produce no memory row. The server scrubs token-shaped secrets and enforces a 256KiB per-document cap; research can legitimately contain names, contact details, and statistics, so what the developer shares is what the workspace sees. These paths are for research deliverables, never repo code or transcripts.

Transcript-based learnings#

This feature is on by default (included by design) and opt-out at every level: covibe-local transcripts disable turns it off for the whole machine, covibe-local transcripts revoke stickily opts a single repo out, excluded repos never participate, and read-only repos never upload transcript-derived content (even findings queued before the repo was marked read-only). A revoked repo stays revoked until an explicit covibe-local transcripts grant; an explicit grant can also narrow which providers are read, and it never widens access beyond the default. Learning/skill synthesis from transcripts runs LOCALLY: for recurring patterns the companion feeds one representative, already-redacted closed-vocabulary flow to the developer's own Claude CLI. The default runner starts in an empty temporary directory with tools, skills, settings, persistence, MCP, and browser integration disabled and receives a minimal environment. There is no automatic Codex fallback: read-only Codex can still read unrelated local files. COVIBE_LOCAL_SYNTH_CMD is an explicit trust override for a developer-controlled command; it still starts in the isolated temporary directory with the minimal environment. That CLI may use a local model or its configured remote model under the developer's provider account, but it never receives raw commands, results, prompts, absolute paths, file targets, or transcript text from Co-Vibe. It receives only closed-vocabulary command, tool, outcome, and error tokens. Only the resulting typed procedure or causal learning, secret/PII-scanned fail-closed, uploads as a machine-labelled contract that the server re-scans. Every recurrent flow autonomously terminates as a skill, a causal learning, or no_claim; human approval is not part of this path. Current v6 typed claims carry three independent, companion-computed repo-salted session hashes and closed-vocabulary trace anchors present in the input. The server treats the hashes as opaque caller-supplied provenance rather than proof that it can independently verify the salting. The v2 causal-learning wire must be echoed by the server before a terminal result is consumed, so an older server causes an automatic retry instead of losing a learning. During the rolling upgrade, legacy procedure payloads retain their prior text-anchor admission behavior; current payloads carry source-trace anchors. A legacy template-only review queue remains as an optional migration fallback and is retired only after the corresponding destination completes its autonomous scan. The raw transcript store is never part of a Co-Vibe upload; only scanned typed claim fields are sent. As a backstop behind that local redaction, the server re-checks every uploaded finding against its content-safety rules and rejects anything it detects as a secret or raw content; because that detection is best-effort pattern matching, the local-analysis design (not the backstop) is what keeps raw content off the wire. Uploaded contracts become active or no_claim automatically. Verified procedures still require a certified delivery lane before they can reach agents. Any opt-out immediately stops further uploads.

After a complete, non-backlogged pass, the companion sends a content-free scan receipt before it advances the local skills cursor. Partial or truncated work retries without publishing one. The receipt contains the authenticated developer, canonical repo key, consented provider names, companion version, and numeric counts only: sessions read, recurring flows, synthesis attempts, procedure/learning uploads, existing active coverage, same-evidence-epoch deduplication, previously completed terminal shapes, no_claim, below-quality, not-teachable, and content-gate outcomes. These are per-pass counters, not a cumulative total across earlier bounded backlog passes. It contains no prompt, response, transcript, command, path, file target, or generated claim text. Workspace members can query the latest receipt per developer with covibe_team transcript_scan_status; absence means “not proven scanned,” while a zero-result receipt proves the pass ran.

The included-by-design local lane also powers transcript pattern mining (covibe-local transcripts skills). Instead of free text, it reduces each recurring session flow to a CLOSED-VOCABULARY action trace on the machine — a fixed set of tool names and the canonical command allowlist in transcript-flow-vocab.ts (npm, git, tsc, vitest, pytest, gh, pnpm, yarn, npx, tsx, node, python3, make, docker, curl) with an allow-listed second-word verb per command (git commit), while keeping repo-relative file paths out of the model prompt, plus a two-value ok/error outcome with a closed-vocabulary failure signature drawn from the paired tool result, collapsed repeat counts, and numeric counts. That reduced material is retained locally (bounded to 2,000 session-flow records per repo and 16MiB per machine) so a procedure that recurs across separate time-bounded scans is still detected. It contains no arguments, tool-result text, prose, prompts, or responses, and transcripts revoke applies to the main checkout and every live linked worktree, deleting every destination's cursor, queue, and retained history for that repository. If the shared derived history is unreadable and the repo cannot be isolated safely, revocation discards that entire derived file and reports the fallback rather than retaining the revoked repo's material. Consent and read-only policy are re-read after every asynchronous coverage or local-model step, immediately before each upload, and again inside each local state mutation lock. A revoke therefore wins over an in-flight scan: no later upload starts, its deleted cursor, queue, or history cannot be recreated, and the older run cannot add a synthesis-ledger marker. Consent and repo-policy mutations also use locked, fresh read-modify-write transactions behind one shared odd/even policy seqlock: odd is published before the policy write and the next even generation only after it completes. Comparing the exact captured even generation closes revoke→regrant and disable→enable ABA races, while the locks prevent concurrent grants, revokes, excludes, and read-only changes from erasing one another.

The developer's own local agent CLI sees one representative, already-redacted closed-vocabulary flow without file targets and returns a strict procedure. Raw commands, results, prompts, paths, and transcript text never enter that runner. The default lane requires Claude Code 2.1.169 or newer so its tool-free --safe-mode contract is available. The companion safety-scans every returned field and uploads only the typed procedure, closed-vocabulary trace anchors, an opaque flow hash, and at least three and at most 64 sorted, unique repo-salted parent-session hashes through ingest_transcript_candidates. Subagent files share their canonical parent session identity, so they cannot inflate recurrence. Those hashes come from the deterministic recurrence miner, not the synthesizing model. The server re-scans every procedure field for secrets, PII, and unsafe absolute paths, validates distinct recurrence evidence, and source-binds the result as an active unverified procedure or records no_claim. The local model proposes repo or workspace scope; that enum nomination is retained, but a one-repo transcript cannot prove workspace generality: every local admission starts repo-scoped. A workspace proposal can be widened only by the existing graduation pipeline after the identical typed claim is independently grounded in multiple repositories. Opaque caller-supplied hashes are recurrence provenance, not verification authority. Raw context and the retained enum history are not uploaded by the default lane. The legacy enum-material upload is separately opt-in with COVIBE_TRANSCRIPT_ENUM_UPLOAD=1; its server-side synthesis source is retired, and even that compatibility wire omits local file targets. Cross-repo graduation may widen grounded knowledge to workspace scope, but it certifies an exact multi-repo procedure only when the cluster also clears the existing independent trust floor. Caller-supplied hashes and repo labels never satisfy that floor. Valid transcript procedures awaiting independent trust appear in a bounded Memory Transcript review inbox. This optional verification action does not gate autonomous admission. Confirm is a cookie-session human action over the exact displayed revision; the server revalidates the typed receipt and records server-owned human provenance. MCP/agent tokens cannot invoke that authority port or choose trust. Graduation then requires a second server mining observation at least 24 hours after the first; transcript timestamps cannot manufacture that age. The graduation receipt lets the canonical workspace procedure enter the existing skill-delivery lane. Explicit workspace-global publication authority remains a separate boundary: the local model can propose a repo skill, but cannot silently publish a machine-global skill.

The word “skill” in transcript scan counters means a complete typed procedure candidate admitted autonomously as active memory. It becomes an executable, companion-managed skill only after the unchanged source-authorized verification/graduation policy clears it. Human confirmation can accelerate that trust path but is not a scan, synthesis, or learning-admission gate.

Historical scans default to the newest 180 days (COVIBE_TRANSCRIPT_HISTORY_DAYS, bounded to 1-3,650), stop cooperatively after 60 seconds, 25 changed files, or 32MiB, and resume from independent findings and skills cursors. One JSONL record is capped at 1MiB. Header, attribution, Cursor metadata, and SQLite response bytes share the allowance; SQLite page I/O is separately deadline-bounded with fair database shares and rotation. Discovery receives 75% of each provider read budget and prioritizes unseen files. Claude, Codex, and Cursor each receive a reserved share of the remaining file, byte, and time budgets, while unused capacity flows forward to later providers. Transcript scans hard-cap the shared batch at 64 changed files; skills scans reserve the final quarter of their wall-clock allowance for recurrence mining. Recurrence mining seeds candidates only from the current scan, lets retained history add support only to those candidates, and never lets a history deadline discard completed scan progress. Current materials are retained locally before cursors advance; only an unreachable-by-default current-candidate safety-cap breach holds those cursors for operator correction.

The Codex provider includes Codex CLI and Codex Desktop rollouts from the local ~/.codex/sessions/**/rollout-*.jsonl and ~/.codex/archived_sessions/**/rollout-*.jsonl stores under one deadline, discovery-byte allowance, and head cache. Repo attribution reads only the first session_meta record, with a hard 64KiB envelope; a longer or malformed header is excluded instead of being read without a bound. The cache format is versioned, and upgrading from the former 8KiB probe invalidates its negative entries so real Desktop sessions are re-attributed. Within an admitted rollout, only user and assistant messages become turns: paired Desktop event/response copies are deduplicated, while reasoning and system/developer instructions are ignored. Function and custom tool calls are paired with their results locally and reduced to the same closed action vocabulary before any skill mining.

Large files advance through lossless 400-line byte windows with bounded action overlap. Replacement or truncation resets to byte zero; oversized records advance a bounded skip checkpoint. Reads pin no-follow, nonblocking regular-file generations. Claude recursively groups subagents and completes a resumable full-file scan of structured top-level cwd fields before admitting any group. A missing child cwd requires a verified parent. Exact source generation and whole-group membership are rechecked after reads and before autonomous typed uploads. Codex and Cursor transcript generations are bound and rechecked at those same boundaries. Cursor also binds each composer attribution to the exact workspace.json and state.vscdb generations that established its repo. Its full Git checkout identity is checked before and after the database read, so a separately initialized or metadata-forged nested repository cannot donate transcripts to its parent repository's learning scope. That identity travels with the local attribution witness and is revalidated at read, queue/cursor commit, skill commit, and typed-upload boundaries. Groups above 256 files or 16 levels are held with a durable, periodically rechecked marker; local warnings name the group and prescribe split, archive, or removal. Cursor uses workspace/composer provenance and rejects ambiguous multi-root histories. Both providers cover live worktrees without trusting non-injective provider directory keys.

Only in-window, timestamped flow history contributes recurrence. The default history is the newest 180 days (COVIBE_TRANSCRIPT_HISTORY_DAYS, bounded to 1–3,650 days). Each scan defaults to 60 seconds and is hard-capped at 10 minutes. A versioned skills cursor replays that bounded window once when the typed-claim contract changes, then returns to forward-only incremental scans. Local state fails closed under explicit bounds: legacy review queue 8MiB/2,000 items, cursor 16MiB/2,000 scopes, synthesis ledger 512KiB/2,000 timestamped hashes, and Codex attribution cache 8MiB/20,000 entries. Queue pressure holds rather than consumes the cursor; aged path state is compacted before cursor capacity checks. Ledger rows outside the history window are pruned and the oldest eligible row rotates out at the item cap, so a full valid ledger cannot permanently wedge synthesis. Malformed, oversized, symlinked, or concurrently replaced flow history blocks synthesis without overwriting the file or advancing the skills cursor. Destination state uses a non-secret origin/developer hash. History and ledger mutations use locked fresh read-modify-write cycles. Findings commit queue-before-cursor behind an optimistic snapshot fence; skills use the same fence, so concurrent or stale runs retry instead of overwriting progress. Synthesis defaults to 180 seconds and is hard-capped at 15 minutes; each candidate is capped at 30 seconds, and candidate order rotates. Deferred, failed, and unvisited work is not consumed. Scan backlogs retry within one minute; local-model or upload deferrals wait for the next scheduled pass to avoid a mixed-version model-spend loop.