OpenJarvis Personal AI

Security docs show real least-privilege design (capability policies with default_deny, per-identity grants, file policy, GuardrailsEngine, audit log), so least_privilege scores 2; however enforce_tool_confirmation is explicitly documented as accepted but not enforced, so user_confirmation is only 1. Data-flow transparency gets 2 via host scan, data-boundary scan and an analytics consent prompt. Sensitive-data handling has SecretScanner/PIIScanner/file policy but defaults to WARN (alert only) and cannot block streamed output, so 2. Dependency security shows only lower-bound pins with no lockfile or audit evidence, so 1. External effects are notable: the installer installs Ollama, pulls models and edits PATH, so 1. Rollback exists via jarvis-uninstall and fast-forward self-update, so 2. Source attribution is solid (arXiv, institutions, citation, Apache header), so 2.

Internal inconsistencies: install page says Python 3.10–3.13, README badge says >=3.10, pyproject says <3.14; desktop download tag 1.0.2 vs filenames 1.0.1; qwen3.5 vs qwen3 model names mixed, so self_consistency is 1. Dependency availability relies on lower bounds, a Rust toolchain and Node, and pyproject is truncated, so 1. Failure messages are decent (jarvis doctor, ModuleNotFoundError guidance, troubleshooting), so 2.

Audience and scenarios cover CLI, SDK, browser, desktop and multiple presets, so 3. Capability boundaries are documented via agent/tool tables and capability policies but confirmation and streaming limits are fuzzy, so 2. Trigger precision is thin: scheduler and agent trigger details are sparse and skill catalogs are imported broadly without curation guidance, so 1. Environment fit has hardware detection and engine selection tables but platform and Python-version constraints add friction, so 2.

Information architecture has README plus layered docs, so 2. Install notes are thorough (one-liners, manual, platform guides, uninstall, update), so 3. Naming stability is weak (qwen3/qwen3.5, duplicate and conflicting install pages), so 1. Examples and FAQ are rich, so 3. Known limitations are stated (streaming block limits, unenforced confirmation, no Python 3.14), so 2. License is full Apache-2.0 text, so 3. Versioning/changelog is absent beyond a version string, so 1. Maintenance responsibility points to Stanford labs and a contributing guide but publisher is unverified and no governance is given, so 1.

Output usability includes structured results, JSON output and telemetry export, so 2. Marginal value comes from local-first design and energy-aware evaluation, so 2. Cost-benefit is heavy: multi-GB model downloads, Rust extension build and Ollama install raise the barrier, so 1.

Claim traceability has an arXiv paper and citation, but most security and capability claims lack corresponding code or test evidence, so 1. Cross-source corroboration is undermined by conflicts between README, install pages and security docs, so 1. Fact/inference separation is mixed, with recommendations phrased as guarantees, so 1.