failproofai 1.0.4-beta.7 → 1.0.4

package/src/audit/schedule-cli.ts

@@ -68,9 +68,13 @@ const dim = (s: string) => wrap(ANSI_DIM, s);
 const bold = (s: string) => wrap(ANSI_BOLD, s);
 
 /**
- * Turn scheduled audits on. Email is optional: `--email` signs in, while a
- * plain `--schedule` enables the local scan and desktop notification without
- * prompting for an account.
+ * Turn scheduled audits on, signing in first if needed.
+ *
+ * Scheduling and mailing are ONE decision — the reason to put a scan on a timer
+ * is to be told what it found — so this requires a session, exactly as the
+ * dashboard's `setAutoAuditAction` does. A timer set with nobody to tell is a
+ * switch that reads as on and produces nothing, discoverable only by noticing
+ * that no digest ever arrives.
  *
  * The interval is written and then RE-READ, so what is printed is what the
  * config actually kept — `readIntervalDays` owns the 1..90 clamp and a second
@@ -104,13 +108,17 @@ export async function runScheduleOn(
     if (bad) throw new ScheduleCliError(bad);
   }
 
-  const signedIn = emailArg === undefined
-    ? { user: readAuth()?.user ?? null, prompted: false }
-    : await ensureSignedIn(emailArg);
+  const { user, prompted } = await ensureSignedIn(emailArg);
 
   const next = updateConfig({
+    // Stamped in the SAME call that sets `auto`, never separately: this records
+    // that a person completed a sign-in and read the disclosure printed below,
+    // and it is what `reportHarm` gates sending on. A machine that inherited
+    // `auto` from a release where it meant "scan locally" has no stamp and
+    // sends nothing until it comes through here.
     audit: {
       auto: true,
+      reportsConsentedAt: Date.now(),
       ...(days !== undefined ? { intervalDays: days } : {}),
     },
   });
@@ -126,14 +134,12 @@ export async function runScheduleOn(
   // The list is the real payload from `report-harm.ts`: machine id, hostname,
   // platform, the window bounds and the redacted examples.
   const summary = [
-    `every ${interval} day${interval === 1 ? "" : "s"} · desktop notification on leaks`,
-    signedIn.user
-      ? `masked leak alerts also go to ${signedIn.user.email}`
-      : "email is optional · add it with --email you@example.com",
-    "email contains only the most recent masked credential exposure",
+    `every ${interval} day${interval === 1 ? "" : "s"} · reports to ${user.email}`,
+    "you only hear from it when a scan finds something harmful",
+    "each report sends: finding counts, redacted example commands, this machine's name",
   ];
 
-  if (signedIn.prompted) {
+  if (prompted) {
     // A sign-in just drew the frame, so the result continues it and the `└`
     // closes both at once — rather than the frame ending and a loose line
     // appearing underneath.
@@ -152,7 +158,7 @@ export async function runScheduleOn(
   // exists to make visible.
   warnIfDaemonWontRun();
 
-  if (signedIn.prompted) {
+  if (prompted) {
     outro("failproofai audit --status  ·  when the next scan is due");
   } else {
     process.stdout.write(dim(`\n   failproofai audit --status   when the next scan is due\n\n`));
@@ -211,22 +217,24 @@ export function runScheduleStatus(): void {
 
   // A session whose refresh window has closed cannot mint another access token,
   // so it is a destination in name only. Showing the address for one would tell
-  // somebody their alerts are going somewhere they are not.
+  // somebody their digests are going somewhere they are not.
   const live = auth && auth.refresh_expires_at * 1000 > Date.now() ? auth : null;
-  // Beside the schedule, because they are the two halves of "what does this
-  // machine do on its own" — one decides whether it scans, the other whether it
-  // is allowed to interrupt you about what it found.
-  detail.push([
-    "leak notifications",
-    config.audit.notify ? green("on") : dim("off  (failproofai audit --notify)"),
-  ]);
-
   detail.push(["reports to", live ? live.user.email : dim("— signed out")]);
   if (on && !live) {
     // The state the reporter surfaces as "signed-out". Named here for the same
-    // reason the settings panel names it: the scans and desktop notifications
-    // keep running, so silence about email would look like the feature failing.
-    detail.push(["", pink("scans and desktop alerts continue; email alerts are paused")]);
+    // reason the settings panel names it: the scans keep running, so silence
+    // about the digests would look like the feature failing.
+    detail.push(["", pink("scans continue; digests are paused until you sign in")]);
+  } else if (on && config.audit.reportsConsentedAt === undefined) {
+    // Signed in, scheduled, and still not sending: this machine set `audit.auto`
+    // when it only meant "scan locally", so nothing has consented to the digest
+    // leaving the box. Without this row the status screen would show a healthy
+    // schedule and a live address and still mail nothing, with no explanation
+    // anywhere the user can see.
+    detail.push([
+      "",
+      pink("scans continue; digests need a fresh opt-in — run `--schedule` to turn them on"),
+    ]);
   }
 
   detail.push(["daemon", describeDaemon(daemon)]);
@@ -338,32 +346,3 @@ export function asScheduleError(err: unknown): never {
   }
   throw err;
 }
-
-/**
- * Turn the desktop banner on or off.
- *
- * A separate command from `--schedule` rather than a flag on it, because they
- * are separate decisions with different lifetimes: somebody who wants the
- * weekly scan and not the banner should not have to re-state their schedule to
- * say so, and somebody silencing the banner in an annoyed moment should not
- * discover they also turned off the scan.
- *
- * Writes the same `audit.notify` key the dashboard toggle writes and the audit
- * child reads, so the two surfaces cannot disagree.
- */
-export function runNotifyToggle(enable: boolean): void {
-  try {
-    updateConfig({ audit: { notify: enable } });
-  } catch (err) {
-    process.stderr.write(
-      `Could not update the setting: ${err instanceof Error ? err.message : String(err)}\n`,
-    );
-    process.exit(1);
-  }
-  process.stdout.write(
-    enable
-      ? `\n${green("on")}  leak notifications — this machine will tell you when a scan finds a credential.\n\n`
-      : `\n${dim("off")} leak notifications — scans continue, and findings still appear in ` +
-          `\`failproofai audit\` and the emailed digest.\n\n`,
-  );
-}

package/src/audit/scoring.ts

@@ -1,55 +1,6 @@
 /**
  * Score derivation for the audit dashboard.
  *
- * ## SWITCHED OFF — nothing in the product calls any of this (2026-09-07)
- *
- * Every function below is intact and still covered by
- * `__tests__/audit/scoring.test.ts`, deliberately: the score is commented out at
- * its call sites, not deleted, so restoring it is un-commenting rather than
- * rewriting. The call sites, all commented and cross-referenced back to here:
- * `audit-dashboard.tsx` (the four `useMemo`s, the poster/how-to-improve/
- * come-back-better props, and the `score`/`grade` PostHog properties),
- * `audit-poster.tsx` (the `.poster-score` block, the PNG filename, the share
- * payload), `how-to-improve-section.tsx` (the projected sub-heading),
- * `share-templates.ts` (19 of 20 templates interpolated the number).
- *
- * ### Why
- *
- * Two reasons, one product and one correctness.
- *
- * The product reason is the owner's: the audit tried to do too many things
- * shallowly, and grading a machine 0-100 with a letter tier was not the half
- * worth keeping.
- *
- * The correctness reason is worse and is the one to read before switching it
- * back on. **`deriveScore` never reads `enabledInConfig`** — only
- * `projectedScore` does, at the filter below. So the number the dashboard
- * rendered as "enable all N → projected {score}" was undeliverable by
- * construction: a user who took the prescription, enabled the policies and
- * re-ran got the SAME score with the projection gone. Advertised up to +22,
- * delivered 0. There is also no time window, so a hit denied today is counted
- * against the machine forever.
- *
- * Two further things measured at the same time, neither of them the score's
- * fault but both worth knowing if this comes back:
- *
- *  - `penaltyFor` consumes `row.hits`, i.e. OCCURRENCES. Occurrences amplify
- *    against distinct values by 10.7x-41x and non-uniformly by class, so the
- *    sum does not preserve rank order between classes. Fixing that needs a
- *    per-distinct-value carrier, which `AuditCount` does not have.
- *  - `syntheticRank`, `scoreToPercentile` and `COHORT_SIZE` had already lost
- *    their last caller before this change — the cohort they describe does not
- *    exist. They are dead either way.
- *
- * ### To restore
- *
- * Un-comment the call sites listed above (each carries its original inline) and
- * put the score-bearing share copy back from the block at the bottom of
- * `share-templates.ts`. Make `score`/`grade` required again in `ShareCtx` and in
- * `audit-poster.tsx`'s `Props`, and the compiler will walk you through the rest.
- * Fix the `enabledInConfig` defect first, or it will be advertising the same
- * undeliverable number.
- *
  * Score is on 0-100, mapped to letter grades that anchor the leaderboard
  * + tier prose. The thresholds match the reference design (assets/audit):
  *

package/src/audit/types.ts

@@ -45,9 +45,6 @@ export interface TranscriptMetadata {
   mtimeMs: number;
   /** Byte size of the transcript file. Used for cache invalidation. */
   sizeBytes: number;
-  /** Optional host-authored session purpose. Used only to distinguish
-   * deliberate credential-scanner research from evidence of a leak. */
-  sessionDescription?: string;
 }
 
 /** Per-session detector state. Detectors mutate this freely. */
@@ -122,27 +119,6 @@ export interface AuditCount {
 }
 
 /** Per-transcript scan result (also the per-transcript cache value). */
-/** One credential sighting, already fingerprinted. */
-export interface TranscriptLeak {
-  /** Salted, machine-local id for the DISTINCT value. */
-  id: string;
-  /** Masked rendering + class + length. Never the value. */
-  fingerprint: import("./leak-fingerprint").LeakFingerprint;
-  /** Identifier it was assigned to, when it came from an assignment. */
-  name: string | null;
-  /** Rule that found it. */
-  rule: string;
-  /** Whether a vendor shape matched — gates whether an alert may name a console. */
-  shaped: boolean;
-  timestamp: string;
-  cwd: string;
-  toolName: string;
-  /** Sent by the agent, or received by it. Different exposures, different fixes. */
-  direction: "input" | "result";
-  /** Home-shortened path the value was read from or written to, when there was one. */
-  path: string | null;
-}
-
 export interface TranscriptAuditResult {
   /** Cache key: matches TranscriptMetadata.transcriptPath. */
   transcriptPath: string;
@@ -164,20 +140,6 @@ export interface TranscriptAuditResult {
   hitsByName: Record<string, number>;
   /** Up to 3 example commands per policy/detector (later coalesced upstream). */
   examplesByName: Record<string, { timestamp: string; cwd: string; example: string }[]>;
-  /**
-   * Credentials found in this transcript, one entry per SIGHTING.
-   *
-   * Deliberately separate from `hitsByName`, which counts by RULE and cannot
-   * enumerate distinct values. These carry the fingerprint rather than the
-   * credential — the raw value never leaves `scanOneTranscript`.
-   *
-   * Optional so a cached result written before this field existed still parses;
-   * absent reads as "this transcript predates leak scanning", not "clean".
-   */
-  leaks?: TranscriptLeak[];
-  /** The session was explicitly generating/researching credential fixtures,
-   * so its matches are examples rather than evidence of user leakage. */
-  leakScanSuppressed?: "credential-research";
   /** First/last timestamp per name. */
   rangeByName: Record<string, { first: string; last: string }>;
 }
@@ -217,20 +179,6 @@ export interface AuditResult {
    *  Lets the dashboard answer "is this policy already on?" for
    *  detector-mapped policies that may not have hit during this audit. */
   enabledBuiltinNames: string[];
-  /** Ids of credentials encountered by this scan, including ones already in
-   *  the persistent leak record. Scheduled desktop notifications key on this
-   *  list so every completed scan that still sees a leak can notify; the
-   *  narrower `newLeakIds` remains for first-seen-only surfaces. */
-  leakIds?: string[];
-  /**
-   * Ids of credentials seen for the FIRST time in this scan.
-   *
-   * What a notice keys on. Not "findings this scan saw" — a key already in the
-   * record must not re-alert however many fresh sightings it picks up, and one
-   * seen for the first time must alert even though its rule has fired before.
-   * Optional so a cached result predating leak scanning still parses.
-   */
-  newLeakIds?: string[];
 }
 
 /** CLI-supplied options for `runAudit()`. Set by `bin/failproofai.mjs`. */

package/src/hooks/builtin-policies.ts

@@ -126,80 +126,15 @@ const JWT_RE = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/;
 
 // sanitizeApiKeys
 const API_KEY_PATTERNS: Array<[RegExp, string]> = [
-  // ── Anthropic ── prefix doc-verified: platform.claude.com says a key
-  // "starts with `sk-ant-`" and its own example is `sk-ant-api03-...`.
-  [/sk-ant-api03-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
-  // Minted by the Claude CLI's OAuth flow and billed against a Pro/Max
-  // subscription rather than the API account — a different thing to revoke.
-  [/sk-ant-oat01-[A-Za-z0-9\-_]{20,}/, "Anthropic OAuth token"],
   [/sk-ant-[A-Za-z0-9\-_]{20,}/, "Anthropic API key"],
-
-  // ── OpenAI ── the body charset EXCLUDES `-` and `_` on purpose: with them,
-  // this rule's run would bridge the hyphen in `sk-proj-` and report every
-  // project key a second time under the wrong label.
   [/sk-proj-[A-Za-z0-9\-_]{20,}/, "OpenAI project API key"],
-  [/(?<!\w)sk-svcacct-[A-Za-z0-9\-_]{20,}/, "OpenAI service-account key"],
-  // Highest blast radius in the family: it authenticates the organisation
-  // admin surface, and lives at a DIFFERENT console from the other keys.
-  [/(?<!\w)sk-admin-[A-Za-z0-9\-_]{20,}/, "OpenAI admin key"],
-
-  // ── OpenAI-compatible gateways ──
-  [/sk-or-v1-[A-Za-z0-9\-_]{20,}/, "OpenRouter API key"],
-  // A BARE `sk-` CANNOT BE ATTRIBUTED, and calling it OpenAI is what this rule
-  // used to do. LiteLLM's own docs say its virtual keys "must start with sk-",
-  // and DeepSeek plus every other OpenAI-compatible proxy mints the same shape
-  // — so on a machine running a gateway (this one does) the old label sent the
-  // user to the wrong console to revoke a key that was never OpenAI's. The
-  // honest label names the family, not a vendor.
-  [/sk-[A-Za-z0-9]{20,}/, "OpenAI-compatible key (issuer unknown)"],
-
-  // ── GitHub ── all five documented types. github.blog's token-format post
-  // names ghp/gho/ghu/ghs/ghr; only two of them shipped before.
-  [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
+  [/sk-[A-Za-z0-9]{20,}/, "OpenAI API key"],
   [/ghp_[A-Za-z0-9]{36}/, "GitHub personal access token"],
-  [/gho_[A-Za-z0-9]{36}/, "GitHub OAuth token"],
-  [/ghu_[A-Za-z0-9]{36}/, "GitHub user-to-server token"],
-  [/ghs_[A-Za-z0-9]{36}/, "GitHub server-to-server token"],
-  [/ghr_[A-Za-z0-9]{36}/, "GitHub refresh token"],
-  [/glpat-[A-Za-z0-9\-_]{20,}/, "GitLab personal access token"],
-
-  // ── AWS ── the ID is the PUBLIC half; the paired 40-char secret is the
-  // credential. Reported anyway because an exposed ID names the account and is
-  // what a user searches their console for. `ASIA` (temporary STS) was missing.
+  [/github_pat_[A-Za-z0-9_]{82}/, "GitHub fine-grained token"],
   [/AKIA[A-Z0-9]{16}/, "AWS access key ID"],
-  [/ASIA[A-Z0-9]{16}/, "AWS temporary access key ID"],
-
-  // ── Payments ── Stripe documents `pk_*` as "Safe to expose: Yes", so only
-  // the secret and restricted halves appear here.
   [/sk_live_[A-Za-z0-9]{24,}/, "Stripe live secret key"],
   [/sk_test_[A-Za-z0-9]{24,}/, "Stripe test secret key"],
-  [/rk_live_[A-Za-z0-9]{24,}/, "Stripe restricted key"],
-
-  // ── Google ── `AIza` also covers Firebase Web and Maps browser keys, which
-  // are public by design, so the label stays non-committal about severity.
   [/AIza[0-9A-Za-z\-_]{35}/, "Google API key"],
-
-  // ── Messaging ── the Telegram bot token was matched by ZERO of the shipped
-  // patterns and was found only because a phone-number regex tripped over it;
-  // two live-looking ones sit in this machine's corpus right now. Slack's
-  // prefixes were in the Rust collector but not here — one of nine such
-  // divergences between the two engines.
-  [/\d{8,10}:[A-Za-z0-9_-]{35}/, "Telegram bot token"],
-  [/xox[baprs]-[A-Za-z0-9-]{10,}/, "Slack token"],
-  [/xapp-[0-9]-[A-Za-z0-9-]{10,}/, "Slack app-level token"],
-
-  // ── Model hosts ──
-  [/hf_[A-Za-z0-9]{30,}/, "Hugging Face token"],
-  [/gsk_[A-Za-z0-9]{40,}/, "Groq API key"],
-  [/r8_[A-Za-z0-9]{30,}/, "Replicate token"],
-  [/xai-[A-Za-z0-9]{40,}/, "xAI API key"],
-
-  // ── Registries ──
-  [/npm_[A-Za-z0-9]{36}/, "npm access token"],
-  [/dop_v1_[a-f0-9]{64}/, "DigitalOcean token"],
-  [/shpat_[a-fA-F0-9]{32}/, "Shopify access token"],
-  [/sb_secret_[A-Za-z0-9\-_]{20,}/, "Supabase secret key"],
-  [/sbp_[a-f0-9]{40}/, "Supabase personal token"],
 ];
 
 // sanitizeConnectionStrings

package/src/hooks/configure-wizard.ts

@@ -74,7 +74,6 @@ import {
   probeDaemonEndToEnd,
   uninstallDaemonService,
 } from "./daemon-service";
-import { installMacNotifier } from "../audit/macos-notifier";
 import { hookLogWarn } from "./hook-logger";
 import {
   readCloudCredentials,
@@ -106,7 +105,6 @@ import {
   type RetryProbe,
 } from "./onboarding-attempt";
 import { acquireOnboardingLock } from "./onboarding-lock";
-import { readConfigRaw, updateConfig } from "./fp-config";
 
 export interface WizardIO {
   stdin?: TTYIn;
@@ -756,19 +754,6 @@ export async function runConfigureWizard(
   // question, and no flag can supply it.
   const preAnswered = Boolean(answers.token);
 
-  // Capture the preference BEFORE the daemon setup writes config.json. A fresh
-  // machine reaches `setDaemonConfigured(true)` with no config file; that helper
-  // necessarily materialises the conservative no-file default (`auto: false`).
-  // Looking after that write cannot distinguish "the user switched it off"
-  // from "setup just wrote its fallback", which is how new installs ended up
-  // with a seven-day scheduler that was explicitly disabled.
-  const initialAudit = readConfigRaw().raw.audit;
-  const hadExplicitAuditAuto =
-    !!initialAudit &&
-    typeof initialAudit === "object" &&
-    !Array.isArray(initialAudit) &&
-    typeof (initialAudit as Record<string, unknown>).auto === "boolean";
-
 
   // Running the wizard itself under sudo configures the WRONG ACCOUNT, and
   // does it silently: homedir() becomes /root, so the hooks land in root's
@@ -1453,50 +1438,10 @@ export async function runConfigureWizard(
   // binary filename are both derived from it.
   if (daemonInstalled) {
     setDaemonConfigured(true, cliVersion);
-    // A completed setup is the default opt-in to the LOCAL seven-day scan. It
-    // does not imply an email address or make a network request: reporting is
-    // independently gated by the signed-in audit identity. Reconfiguration
-    // preserves an explicit `auto: false`, so the user's off switch remains an
-    // off switch instead of being undone whenever they repair or upgrade the
-    // daemon.
-    if (!hadExplicitAuditAuto) {
-      try {
-        updateConfig({ audit: { auto: true } });
-      } catch {
-        // The daemon and hooks are already installed. Keep setup successful;
-        // the status screen will expose that scheduling could not be persisted.
-      }
-    }
     // Only now — the unit points at the new binary, so older ones are no
     // longer referenced by anything. Keeps the previous version for an
     // offline rollback.
     pruneOldDaemonBinaries();
-
-    // The delivery path for what the scheduled audit finds. macOS only, and a
-    // no-op everywhere else: a Linux box's audit talks to the session bus
-    // itself, while on a Mac the daemon runs outside the GUI session and cannot
-    // reach Notification Center at all — see `audit/macos-notifier.ts`.
-    //
-    // Installed here, with the daemon, because it exists only to deliver what
-    // the daemon's scheduled scan produces, and removed alongside it by
-    // `uninstall`. Silent, and not a step in the wizard: it needs no password,
-    // asks nothing, and narrating it would be an apology for the delivery half
-    // of a feature the user just switched on. What they are actually asked —
-    // does this machine scan, and may it interrupt — are real settings, and
-    // both are theirs to change afterwards.
-    //
-    // Its failure is not the wizard's failure. A Mac where `osacompile` is
-    // missing or launchd refuses the job must still finish installing its
-    // daemon, its hooks and its policies, which are the parts that enforce
-    // anything; the notice in-CLI still reaches them either way.
-    const notifier = installMacNotifier();
-    if (process.platform === "darwin" && !notifier.installed) {
-      hookLogWarn(`macOS notification helper was not installed: ${notifier.reason ?? "unknown error"}`);
-      stdout.write(
-        "\nSystem notifications could not be installed. Scheduled scans and email alerts\n" +
-          "still work; re-run `failproofai config` after checking the local LaunchAgent.\n\n",
-      );
-    }
   }
 
   // Telemetry runs concurrently with the install (never rejects, 5s-bounded) so

package/src/hooks/fp-config.ts

@@ -308,65 +308,49 @@ export interface FpConfig {
   };
   audit: {
     /**
-     * Scan this machine on a schedule. Delivery is deliberately separate:
-     * desktop notifications are controlled by `notify`, while a verified local
-     * email identity adds email alerts without changing the timer.
+     * Scan this machine on a schedule, and mail a digest when a scan finds
+     * something harmful.
      *
-     * A signed-out machine with this on is therefore the normal local-only
-     * state rather than a contradiction: it keeps scanning, keeps its local
-     * dashboard current, and raises desktop notifications for credential leaks.
-     * A refresh token expiring must not silently switch off a background
-     * security feature.
+     * ONE switch, not two. An earlier revision split this into `auto` (scan
+     * locally, no account) and `email_enabled` (mail me, sign in), and the two
+     * could only ever disagree — a machine scanning on a timer with nothing to
+     * report it to is a feature that looks on and does nothing visible. The
+     * reason to put a scan on a timer is to be TOLD, so scheduling and mailing
+     * are the same decision and take the same switch.
      *
-     * ON for a configured machine that has never stated an opinion, OFF for
-     * every machine we could not read an opinion from — which is not the same
-     * default twice, and the difference is the whole design.
+     * A signed-out machine with this on is therefore a real, expected state
+     * rather than a contradiction: it keeps scanning and keeps its local
+     * dashboard current, and the UI says "signed out" until somebody signs back
+     * in. Auth gates SETTING it up, never the machine's ongoing work — a
+     * refresh token expiring must not silently switch off a background feature
+     * somebody configured months ago.
      *
-     * The scan reads the CONTENTS of every session transcript on disk, so the
-     * conservative instinct is to keep it off until asked. But the thing it
-     * looks for now is a leaked credential, and a credential nobody scans for
-     * is a credential nobody revokes: a switch that is off by default is a
-     * feature that, for most users, never runs. Setup is where the machine's
-     * owner is told what it does, so completing setup is the opinion.
-     *
-     * Hence the split. Once `config.json` exists AND carries an `audit` table,
-     * this is on unless it says exactly `false`. Absent file, unparseable JSON,
-     * or no `audit` table at all still read as OFF, because those are the three
-     * ways of not knowing, and "we could not tell" must never turn a transcript
-     * scan on. `crates/failproofaid/src/audit_lane.rs` makes the identical
-     * distinction over the identical bytes — the daemon and this reader must
-     * agree, or the settings page describes a machine that is doing something
-     * else.
-     *
-     * Turning it on sends nothing remotely on its own. Email requires a valid
-     * identity in `audit/session.json`; without one, scans and notifications
-     * remain fully local.
+     * OFF by default, and the asymmetry with `telemetry.enabled` above is
+     * deliberate: the audit reads the CONTENTS of every session transcript on
+     * disk — prompts, file contents, command output — so nothing scans on a
+     * timer until somebody asks for it.
      */
     auto: boolean;
     /**
-     * Raise a desktop notification when a scan finds a credential.
-     *
-     * Separate from `auto` because they answer different questions: `auto` is
-     * whether the machine scans, this is whether it interrupts. Somebody who
-     * wants the scan and not the banner is a coherent person, and without this
-     * their only way to stop the banner is to stop the scan.
+     * When this machine's owner agreed that a scheduled scan may send what it
+     * finds off the box, as epoch ms. Absent means they never did.
      *
-     * ON by default. Every scheduled scan that still sees a leak may notify,
-     * which keeps a credential that remains exposed from disappearing after
-     * its first alert. A silent default would make the common case — a user who
-     * never opens the dashboard and never gave an email — a machine that finds
-     * the key and tells nobody.
+     * This does NOT reintroduce the second switch the comment above rejects,
+     * and it is never drawn as one. `auto` is what a person sets; this is a
+     * record of the disclosure they were shown when they set it. The two cannot
+     * drift, because every path that turns `auto` on stamps this in the same
+     * call and nothing stamps it alone.
      *
-     * On a headless box, container or SSH-only session there may be no desktop
-     * server to receive the banner. The scheduled scan still completes and
-     * records its result; notification failure never changes the scan outcome.
-     */
-    notify: boolean;
-    /**
-     * Legacy migration marker from the earlier harm-digest consent model.
-     * Retained when reading and writing old configs so upgrades are lossless,
-     * but it no longer gates scheduling or credential-alert email. A verified
-     * email identity is now the delivery opt-in.
+     * It exists because `auto` CHANGED MEANING. Through 1.0.0 it meant "scan
+     * this machine on a timer" and nothing more — no account, no network, and
+     * the toggle that wrote it said as much in as many words. Harm digests gave
+     * the same stored bit a second job: uploading redacted transcript excerpts
+     * to the api-server and mailing them. Without a separate record, every
+     * machine that opted into the old meaning would have started sending on
+     * upgrade, having agreed to nothing of the kind, with the only notice a
+     * line in the journal. Gating on the stamp rather than the switch is what
+     * keeps that upgrade silent in the safe direction: those machines keep
+     * scanning locally and send nothing until somebody opts in again.
      */
     reportsConsentedAt?: number;
     /** Days between scheduled runs. Wall clock, so it survives suspend. */
@@ -418,9 +402,7 @@ export const DEFAULT_CONFIG: FpConfig = {
     environment: "local",
   },
   telemetry: { enabled: true },
-  // `auto: false` is the no-file case specifically — see the field's doc for
-  // why a machine that HAS a config reads the other way.
-  audit: { auto: false, notify: true, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
+  audit: { auto: false, intervalDays: DEFAULT_AUDIT_INTERVAL_DAYS },
 };
 
 /**
@@ -513,11 +495,7 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
     const daemon = (parsed.daemon ?? {}) as Record<string, unknown>;
     const collector = (parsed.collector ?? {}) as Record<string, unknown>;
     const telemetry = (parsed.telemetry ?? {}) as Record<string, unknown>;
-    // Presence, not just contents: `audit.auto` reads differently when the
-    // table is absent than when it is present-but-silent. See the field's doc.
-    const auditPresent =
-      !!parsed.audit && typeof parsed.audit === "object" && !Array.isArray(parsed.audit);
-    const audit = (auditPresent ? parsed.audit : {}) as Record<string, unknown>;
+    const audit = (parsed.audit ?? {}) as Record<string, unknown>;
     return {
       // Anything unrecognised reads as `oss`. The failure direction matters: a
       // corrupt config must not be able to turn cloud reporting ON.
@@ -547,23 +525,15 @@ export function projectConfig(parsed: Record<string, unknown>): FpConfig {
       // reads as on — the shipped default, and what a config with no
       // [telemetry] block at all means.
       telemetry: { enabled: telemetry.enabled !== false },
-      // A configured machine with no stated opinion scans; a machine we could
-      // not read an opinion FROM does not. `auditPresent` is what separates
-      // them, and it is the reason this is not simply `!== false`: with no
-      // `audit` table there is no opinion to have been stated, only an absence,
-      // and an absence must not start reading every transcript on disk. Same
-      // three-way split as `audit_lane.rs`, over the same file.
+      // Mirror image of telemetry above: only an explicit `true` switches the
+      // scheduled scan on. Absent, misspelled, or `"yes"` all read as off,
+      // because the failure direction here is a machine that starts reading
+      // every transcript it can find on a timer nobody set.
       audit: {
-        auto: auditPresent && audit.auto !== false,
-        // Default ON, off only on an explicit `false` — a notification the user
-        // never sees is the same as no detection at all. Ungated on
-        // `auditPresent`, unlike `auto`: this is read at the moment a
-        // notification is about to fire, which means a scan already ran and the
-        // question is only whether to speak.
-        notify: audit.notify !== false,
+        auto: audit.auto === true,
         intervalDays: readIntervalDays(audit.interval_days),
-        // Preserve the legacy marker when it is valid; current behavior does
-        // not consult it.
+        // A finite number or nothing. A garbage value reads as absent, which is
+        // the direction that sends nothing.
         reportsConsentedAt:
           typeof audit.reports_consented_at === "number" &&
           Number.isFinite(audit.reports_consented_at)
@@ -614,7 +584,6 @@ const OWNED_CONFIG_KEYS: readonly (readonly string[])[] = [
   ["collector", "sources", "*", "extra_paths"],
   ["telemetry", "enabled"],
   ["audit", "auto"],
-  ["audit", "notify"],
   ["audit", "interval_days"],
   ["audit", "reports_consented_at"],
 ];
@@ -713,20 +682,16 @@ export function writeConfig(config: FpConfig, raw?: Record<string, unknown>): vo
     ...(config.telemetry.enabled ? {} : { telemetry: { enabled: false } }),
     // Written ALWAYS, unlike telemetry directly above — the two are opposites
     // on purpose. Telemetry ships on and is deliberately not advertised;
-    // the scheduled audit is configured during setup and is meant to be FOUND,
-    // and a switch
+    // the scheduled audit ships off and is meant to be FOUND, and a switch
     // nobody can see is the same as a switch that does not exist. Emitting both
     // keys unconditionally also makes "a user's setting survives a rewrite"
     // total rather than conditional.
     audit: {
       auto: config.audit.auto,
-      // Emitted unconditionally, like `auto`. A switch that only appears in the
-      // file once you have used it is a switch nobody discovers, and this one
-      // exists to be found by somebody the banner annoyed.
-      notify: config.audit.notify,
       interval_days: config.audit.intervalDays,
-      // Preserve the legacy consent marker when present. It is not used by the
-      // current local-schedule + optional-email model.
+      // Written only once there IS consent, so an untouched machine's config
+      // does not grow a key implying it was asked. It is in
+      // `OWNED_CONFIG_KEYS`, so omitting it here really removes it.
       ...(config.audit.reportsConsentedAt === undefined
         ? {}
         : { reports_consented_at: config.audit.reportsConsentedAt }),