Local AI Privacy 1.4.0

The optional ranker is default OFF, receives no raw DOM, makes no cloud request, and returns candidate IDs only.

Data minimization

Snapshot data is semantic roles/enums, aggregate preferences/counters, candidates, contracts, and constraints. Form values, passwords, text dumps, URLs, cookies, storage, and HTML are excluded.

Local-only providers

Unavailable, deterministic, placeholder, and optional Worker providers ship without model weights or external fetch.

Separate opt-in

Adapt must be enabled first; Local AI additionally requires ai.enabled: true. Failure falls back to deterministic policy order.

Events and audit

Status events carry counts/reasons/timestamps; audit records semantic before/after state. Neither is a raw page-content channel.