ModelOpacity

Proof of concept guide

This guide describes what this build actually does. Every capability below has a committed evidence reference in this repository. The release check confirms that each reference exists; it does not run the behaviour itself.

This build

Platforms: Linux desktop and headless Linux are tested end to end. On Windows the installer starts and opens sign-in; collection and presence are not tested there yet. On macOS the app is built on a Mac, starts and shows its menu-bar icon. Sign-in, collection and presence are not tested there yet.
Source versions: Next 16.3.5, React 19.3.0, TypeScript 5.9.3, Node 22.23.x
Collector packaging: The desktop executable embeds the local collector. The collector and the desktop UI are open source; the hosted backend is not.

Start here

Install — The desktop app, and the collector for a Linux server.
Choose your opacity — One control with three positions, and the fields each one shares.
ActivePresence — The two lines on Discord at each position.
My Friends — Following, and what friends see.
Profile page — An unlisted page at a link that you control.
Data boundary — What stays on your computer.
Support and security — Reporting routes, and why no address is published yet.

What this build does

Capability and the committed evidence for it
Capability	Evidence in this build
The landing page states what ModelOpacity measures.	`src/app/(site)/page.tsx` — the landing page renders the approved claim
Nothing is collected until you say yes.	`src/features/onboarding/walkthrough.tsx` — set-up step 2 asks before anything is collected `tests/sharing.test.ts` — no directory field is emitted below the most-shared position
The lowest sharing level reveals total token counts only.	`src/lib/sharing.ts` — the field matrix `tests/sharing.test.ts` — the least-shared position is totals only `src/app/(site)/docs/opacity/page.tsx` — the published positions
Withheld fields are dropped before sending, not blanked.	`src/lib/sharing.ts` — project() omits a field entirely `tests/sharing.test.ts` — withheld fields are dropped, not blanked
No support or security address is published yet.	`src/lib/support.ts` — both routes are unconfirmed with no address `scripts/check-support-release.mjs` — the release gate blocks
Your activity is never attached to a report automatically.	`src/lib/support.ts` — autoAttachActivity is typed as the literal false `tests/support.test.ts` — activity is never attached
You install the desktop app, sign in with Discord, and choose what to share.	`src/features/onboarding/walkthrough.tsx` — the setup walkthrough that the installed app opens `tests/desktop-signin.test.mjs` — the device-bound sign-in handoff the walkthrough uses
A computer without a desktop can send its activity to your account.	`src/server/features/collector-sync.ts` — pairing, device tokens, and the activity intake `tests/collector-sync.test.mjs` — one-time codes, idempotency, and rejection of anything outside the event contract
This computer sends its token counts to your account.	`src/features/devices/devices-board.tsx` — the desktop link control that pairs the running computer `src/lib/desktop-bridge.ts` — the linkAccount bridge call and the account state the page reads
Counts that already reached your account stay there.	`src/server/features/collector-sync.ts` — unlinking revokes the device; stored events are not deleted with it `tests/collector-sync.test.mjs` — a revoked device token is refused while the account summary keeps its events
Deleting the account removes it, its counts, and its profile page from the servers.	`src/server/features/account-data.ts` — one transaction removes counts, devices, codes, follows, the profile page, consents and the sign-in user `tests/social.test.mjs` — after deletion no row of that account remains and another account keeps its counts
Download your counts and choices as a file.	`src/server/features/account-data.ts` — the export holds the account, choices, opacity, profile page, devices, follows and every count, and lists what it leaves out `src/app/api/account/export/route.ts` — the export is served only to the signed-in owner
A profile page shows only what the person shares, never more than their opacity allows.	`src/server/features/social.ts` — sharedView is the one path from counts to another person, and it drops every withheld field `tests/social.test.mjs` — a withheld field never appears in the view, and a wrong, off or replaced link reads the same
A follow alone shows nothing private.	`src/server/features/social.ts` — only a reciprocal follow carries a shared view; one-way rows carry the name only `tests/social.test.mjs` — a one-way follow row has no view, and unfollow ends the friendship on the next read

What this build does not do

These are absent on purpose. This guide does not describe them, and the release check fails if a claim appears for any of them without evidence.

Windows sign-in, collection and presence — the app installs and starts on Windows 11, and the sign-in handoff opens the system browser. Nobody has completed a Discord sign-in, read a tool, or published presence on Windows
macOS sign-in, collection and presence — the app is built on a Mac Mini, its tests pass there, and it starts with its menu-bar icon. Nobody has completed a Discord sign-in, read a tool, or published presence on macOS. Apple does not sign the build (D-071), and CI does not build the .dmg
Server-confirmed eligibility cutoff — US-040 is in progress
Account deletion reaching an offline computer — deletion revokes every device token on the server, but a computer that is offline keeps its local files and learns nothing until it next connects
Rank eligibility or leaderboard — explicitly out of POC scope
Public support and security routes — F-002 is open

Account deletion, in Account: Removes your account, its counts, and your profile page from our servers. Data on your computers stays.