Your data, your contribution

What this is

Sophia can retain a local activity record for its owner: aggregates, outcomes, or scrubbed mining trajectories, at an owner-chosen path, retention period, and size limit. That archive is useful in its own right for understanding how your agents work or preparing your own training data; it does not require sharing it with Sophia.

Anonymous diagnostics and training contribution are independent settings and both default to off. Training contribution is a second, more deliberate choice: it is enabled per project after a rights attestation, terms version, representative scrubbed-sample preview, and acknowledgement that de-identification reduces—but cannot eliminate—the chance of reconstruction.

Why it exists

Useful operational traces should belong to the person who produced them first. An owner may want to inspect a miner’s verifier failures, repairs, accepted claims, or later corrections without ever transmitting content. Equally, a project owner who has the rights may decide that a carefully minimized contribution can improve document mining for everyone. Those are different intents and cannot share one ambiguous checkbox.

The system therefore describes contribution as pseudonymous and unlinked, not as mathematically anonymous. The point is to reduce exposure and make the exact export auditable, not to promise that unusual facts can never be recognized.

How it works

One completed document-mining run can become a local episode containing only the redacted source window, structural tool actions, accepted and rejected claim attempts, an intentionally authored short rationale summary, and immediate or delayed outcome signals. Local IDs are remapped to episode-local references. Raw prompts, model responses, conversations, coordination posts, scratchpads, hidden reasoning, raw tool arguments/results, paths, URLs, exact timestamps, and connection or queue identifiers are forbidden from serialization.

Before an eligible project can queue a training sample, the collector applies path, content, and predicate exclusions; rejects secrets, credentials, high-entropy tokens, and protected-content classes; redacts typed identifiers consistently across the whole episode; rechecks evidence grounding after redaction; and runs a final payload scan. Broken grounding or excessive redaction rejects the episode rather than sending a weakened approximation. The upload outbox stores only encrypted, already-scrubbed payloads; it is retried while idle and never affects mining or daemon health.

What your agent does with it

// A real read-only identity check before an agent assumes any authority:
const permissions = await sophia.getPermissions({});
// → { permission_profile, entity_scope, write_approval_mode, ... }
// Contribution settings and history remain owner-controlled UI/API state;
// an agent does not receive a hidden right to export project content.

An agent can help an owner inspect local results, but it cannot turn a project into a training contributor by inference. The consent boundary is enforced before collection: nothing is even gathered until the owner has attested rights on that specific project — terms version, sample preview, and risk acknowledgement recorded — and switching the setting off is honored at the collector, not at the upload queue.