Hotline

docs/security.md handles least privilege unusually well: reach, mcpPolicy, allowedSenders, backgroundWork, computer and folders are independent axes with deny-by-default values and explicit migrations, and the model is explicitly not an enforcement point (least_privilege=3). The same document states plainly that the person is asked nothing at call time and there are no approval cards or per-path ACLs, so confirmation is standing rather than per-action (user_confirmation=2). Data flow is described (network on under every reach, workspace data can leave, which provider origins receive voice/image traffic) but there is no consolidated user-facing data-flow statement (data_flow_transparency=2). Sensitive data uses 0600/0700 files, secret redaction and key-free image results, yet the docs admit no encryption layer of its own and that root or a disk copy reads every secret (sensitive_data_handling=2). Dependency security is the strongest area: CI runs cargo-deny advisories/licenses, cargo machete and bun audit, Cargo.toml carries a justified patch for RUSTSEC-2026-0367/0368/0369, and speech engine and models are pinned by SHA-256 (dependency_security=3). External effects are acknowledged as irreversible: dispatched side effects survive revocation and there is no recall mechanism (external_effects=1). Rollback is thin: only lease revocation and computer recreation, no version rollback or state recovery (rollback=1). Source attribution has dual license files, a release pipeline and updater signing, but publisher identity is unverified and attribution stops at the repository (source_attribution=2).

Internal consistency is good: Cargo.toml at 0.43.0, the release workflow checks tag against Cargo.toml and tauri.conf.json, and the README explains the Toad-to-Hotline rename and the Electrobun replacement (self_consistency=2). Dependency availability has Cargo.lock, bun --frozen-lockfile, pinned tool versions and a hosted-runner fallback, but sherpa-onnx-sys depends on an upstream git commit and an external script downloads binaries, which is a real availability risk (dependency_availability=2). Failure messages are concrete in the installer tests (version mismatch, checksum mismatch, missing user), while runtime error handling is only inferable from docs (failure_messages=2).

The README targets multiple models, multiple harnesses and desktop/server/phone scenarios with a clear audience (audience_and_scenarios=2). Capability boundaries are documented in depth: workspace versus machine reach, externally managed ACP, computer not widening reach, no confined shell on Windows (capability_boundaries=3). Trigger precision is not assessable: this is a persistent room rather than a trigger-invoked agent and no routing rules are shown (trigger_precision=1). Environment fit covers macOS/Windows/Linux, headless server and three container runtimes, but Windows lacks a shell sandbox, macOS lacks namespaces and Apple container keeps no volumes, so platform gaps are material (environment_fit=2).

The README is well structured and links design, development, wire, sessions and computer docs (information_architecture=2). Install notes give curl installs, a server mode and per-platform packages, but rely on an external site script with limited in-repo detail (install_notes=2). Naming stability is affected by the Toad-to-Hotline rename and leftover ELECTROBUN_ prefixes, explained but still churn (naming_stability=2). Examples and FAQ are sparse in the visible files, mostly doc links (examples_and_faq=1). Known limitations are exceptionally thorough, including accepted risks, platform differences and residual risk (known_limitations=3). Licensing is dual MIT OR Apache-2.0 and consistent across files and metadata (license=3). A version exists but no CHANGELOG content is visible, only release-pipeline references (versioning_changelog=1). Maintenance responsibility is weak: the docs mention a product decision by George, but there is no CONTRIBUTING, security contact or maintainer statement, and the publisher is unverified (maintenance_responsibility=1).

Output usability: the product shape (desktop and phone room, multi-agent collaboration) is clear, but no sample outputs or UI flows appear in the visible files (output_usability=2). Marginal value comes from multi-agent co-location, bring-your-own harness and a containerized computer, which differentiates it from single-chat tools, though the space is crowded and value depends on configuration (marginal_value=2). Cost-benefit is demanding: self-hosting needs Docker/Podman, user-paid model keys, a half-gigabyte speech model download and a complex Rust+Tauri+bun+external-binary build chain (cost_benefit=1).

claim_traceability: the security doc names concrete files and tests for most claims (e.g. wire::tests::voice_is_owner_only_through_the_real_handler), though some claims are prose only (claim_traceability=2). cross_source_corroboration: README, security.md, CI workflows and Cargo.toml corroborate each other on dependency pinning, platform support and licensing (cross_source_corroboration=2). fact_inference_separation: the docs distinguish shipped from planned, accepted risk from defect, and flag device verification as outstanding (fact_inference_separation=2).