Evaluate optional local PII masking before cloud inference

Overview

No local PII masking step exists in harness cloud launch; historical 300–400M model and millisecond claims are unvalidated research.

Priority: P2 / post-mvp. Impact: roadmap improvement. Initial planning estimate: Medium; refine after inventory. This issue does not add a release blocker.

Current evidence

No local PII masking step exists in harness cloud launch; historical 300–400M model and millisecond claims are unvalidated research.

• Source: src/harness/opencode.cpp#L230

Design and implementation plan

Run a bounded privacy feasibility design using existing local SDK models; define reversible placeholder handling and threat limits before implementation.

1. Reconcile the current implementation and any already completed work with the evidence above.
2. Record the owner, selected scope, dependencies and unresolved decisions before implementation.
3. Implement or execute the selected scope using existing components and artifacts.
4. Attach reproducible validation or outcome evidence and record any deferred work.

Acceptance criteria

• Measure false negatives/positives and latency on an explicit nonprivate corpus.
• Cover streaming, tool calls/results, Unicode, long prompts and placeholder collisions.
• Opt-in only; state limitations and do not claim guaranteed anonymization.

Related work and deduplication

No existing issue has this acceptance scope; existing release defects remain separate.

No exact existing issue found in the all-state inventory.

Requirement provenance

Reconciled September 13, 2026 against WALLY_CLOUD_PRODUCT_SOURCES.md (SHA-256 e601b7b154b750965fa8d25d4533d3542621bd00b3bb30038c1fae553a549e7b) and the consolidated requirements report. Historical proposals are not evidence of current delivery, customer agreement or approved pricing.

Start by reviewing src/harness/opencode.cpp around line 230 and inventorying the existing local SDK models and cloud-launch flow. Document the owner, scope, dependencies, and unresolved decisions before evaluating the selected opt-in scope. Done means reproducible measurements covering false positives/negatives, latency, streaming, tool calls, Unicode, long prompts, and placeholder collisions, with limitations recorded.