The current CLI protects provider-owned source history, ctx-owned search state, and local usage aggregates.
- provider transcripts in provider-owned homes;
- ctx-owned Core/Tantivy lexical generations and optional flat-F32 semantic generations;
- the content-free
usage.sqlitesidecar; - configuration and import cursors;
- logs and diagnostic output;
- JSON and Markdown command output.
The local integrity boundary assumes that another process running as the same OS user does not maliciously modify the owner-private ctx data root while ctx is using it. Such a process can directly replace the active-generation pointer or rewrite candidate bytes regardless of clone strategy; defending against it requires an OS sandbox or a distinct service identity. Generation fences still fail closed on ordinary concurrent mutation, replacement, truncation, and corruption within the supported single-owner lifecycle.
On Unix, managed installation accepts user-owned executable directories with
ordinary 755 or 775 permissions and rejects world-writable directories.
Existing group and ACL grants are preserved: accounts granted write access
there are trusted to replace installed programs. Private ctx data keeps its
separate confidentiality requirements.
The default-enabled persistent daemon and explicit provider-source import route
write Core generations and derived state only under the configured ctx data
root. Search and MCP may send a bounded, content-free daemon wake, but query
processes do not become foreground history writers. Show, locate, sources, and
doctor do not write provider data or repositories. ctx status does not mutate
Core history and does not initialize or migrate local storage.
Show reads complete policy-selected normalized records from the active verified Core/Tantivy generation. It does not reopen provider history, scan for replacement transcripts, or use a network fallback.
Source repositories and provider history roots remain outside ctx ownership. Provider files are read as import sources, not modified.
Explicit hosted history adds a separate server boundary. The operator and the server's OS account are trusted with retained plaintext history. TLS protects transport; it does not hide shared history from that operator. Collection permissions are checked on search, exact citation reads and uploads. Restoring a checkpoint invalidates old credentials, invitations and grants, and makes the history private to a new owner. An older backup cannot know later withdrawals: the owner must review content before explicitly sharing it again. See hosted-history.md.
Remote evidence is untrusted historical content. It does not authorize commands, local path reads or new sharing. Connecting alone sends no history, and a remote outage does not silently change which corpus a query searches. Local history behavior stays unchanged unless the user explicitly selects a remote.
- searchable terms and imported prompts or output may contain secrets;
- local paths and repository names may reveal private work;
- copied JSON output may leave the machine;
- unsupported provider formats may be parsed incorrectly if adapters are too permissive;
- compatibility JSON fields may expose more local data-root detail than an agent needs.
- transcript output may contain secrets, and MCP hosts may retain or forward it;
- provider sources can move, be replaced, or change before a later import.
- keep imports explicit and repeatable;
- reject unknown provider formats;
- keep complete policy-selected searchable content and stable provider/source identities in immutable Core/Tantivy generations;
- preserve stable ctx citations and provider session identity;
- keep setup local and side-effect-limited;
- open provider-native SQLite histories only through short read-only logical snapshots without checkpoints or writes;
- treat JSON output as private until reviewed.
- require bounded Core body/output sizes and all-or-nothing show results.