ROADMAP.mdOpenIntelligence 5.1 shipped, 5.2 staged (iOS and macOS)View source

Docs/ROADMAP.md — OpenIntelligence 5.1 shipped, 5.2 staged (iOS and macOS)

Documentation status: Header reconciled 2026-09-02: 5.1 shipped on both platforms; 5.2 (Private Cloud Compute, first Xcode 27 build) staged with two rows in Notion. This file is a mirror and has been the stale side before; the Notion database is authoritative (37f49a74-d54f-81b7-9424-dae1288c0043, reachable via the notion-roadmap skill). Current release state, read from App Store Connect on 2026-08-28: iOS 5.0 is live (approved 2026-08-27) and macOS 5.0.2 is live (approved 2026-08-28). Nothing is in review. v5.1 records exist for both platforms in PREPARE_FOR_SUBMISSION and have not shipped. Per-platform truth lives in Docs/SHIPPED_VERSION.json; the platforms have diverged, so macOS carries 5.0.1 and 5.0.2 fixes that iOS has not yet received. Both platforms share one MARKETING_VERSION, stamped from the first numbered CHANGELOG.md heading, so the split iOS-4.x / macOS-3.x numbering below is historical. Releases are produced by Xcode Cloud, pinned to Xcode 26.6. GitHub Actions ran them for one stretch in August 2026 as a fallback after the free Xcode Cloud allowance ran out, and was retired on 2026-08-28. The sections beneath this line predate v5.0 and are kept as record; do not read them as current plan. [evidence_level: release_state_verified, confidence: exact, evidence_source: App Store Connect read per platform 2026-08-28, recorded in Docs/SHIPPED_VERSION.json; header re-reconciled 2026-08-28] Source of truth: Codebase audit in Docs/AUDIT/. Latest reconciliation: Docs/AUDIT/ROADMAP_RECONCILIATION_2026-07-28.md (predates 4.8 and 4.9; treat its version statements as historical). Scope: Describes future technical directions for the prototype. It is not a product commitment.

0. Shipped: the v4.7 / v3.0 submission gate is closed

  • Remove 3B/20B capability-card claims from the Settings UI (Resolved 2026-07-28): the capability-card tagline, 3B / 20B chip, context stat, and footer no longer assert a parameter count, and three further user-facing claims were corrected in ModelInfoCard, UnifiedMetricsBar, and the container settings sheet. Re-verified against the current SDK first: SystemLanguageModel has no member advanced, the public surface exposes only availability, isAvailable, and UseCase{.general, .contentTagging}, .onDeviceAdvanced executes SystemLanguageModel.default on every device, and the physicalMemory >= 11.5GB gate has no call sites. [evidence_level: sdk_verified+code_verified+build_verified, confidence: exact]
  • Shield the git object store from iCloud (Resolved 2026-07-28; residual accepted): .git is now a gitdir: .git.nosync pointer, taking the object store out of iCloud sync scope while keeping the repository path unchanged. Four conflict copies and five in-gitdir .DS_Store files were removed; git fsck is clean. The working tree remains synced by owner choice, so builds still require -derivedDataPath outside ~/Documents, and scripts/check_icloud_conflicts.sh guards against conflict copies of source files (which the project’s synchronized file groups would otherwise compile). [evidence_level: build_verified+code_verified, confidence: exact]
  • Native PCC execution on device (Owner-confirmed 2026-07-28): the owner reports Private Cloud Compute working on a physical device running v4.6. This clears the central open question — that PCC executes rather than silently falling back — and supersedes the prior blanket “unverified for device” status for the core execution path. [evidence_level: user_confirmed, confidence: high_for_execution_path, evidence_source: owner device testing on v4.6, 2026-07-28]
  • Remaining PCC edge-scenario validation (Open): owner confirmation covered PCC execution. It did not state coverage for quota exhaustion, mid-stream network transition, background/App Intent consent behavior, or Archive/TestFlight distribution signatures specifically. Those scenarios remain unconfirmed. See the Validate: items in the Notion engineering roadmap and the 35 scenarios in Docs/AUDIT/PCC_DYNAMIC_ROUTING_TEST_MATRIX.csv; RouteEvalMetrics now makes their receipts machine-checkable.
  • Submit iOS 4.7 / macOS 3.0 (Resolved — superseded by 4.9): the hold ran past 4.7. iOS 4.8 was developer-rejected and never shipped, so its contents rolled into the iOS 4.9 binary; macOS 4.8 was approved and shipped. 4.9 then cut both platforms together. Current state: iOS 4.9 live, macOS 4.9 in review. [evidence_level: user_confirmed+code_verified, confidence: exact, evidence_source: CHANGELOG.md 4.9 preamble, owner report 2026-08-05]

0.5 Instrumentation & Benchmarking (planned; tracked in the Notion engineering roadmap)

The owner-directed next arc: make the app’s central claim — that Standard, Deep Think, and Maximum buy measurably different quality — observable. Four phases, each a Notion row targeted v4.7 (iOS) / v3.0 (macOS):

  1. Pipeline signposts (DONE 2026-07-29): PipelineSignposts now instruments twelve stage seams across ingestion, retrieval, planning, generation, verification, and every agentic synthesis strategy. Ships in release builds; ready for xcrun xctrace. [evidence_level: build_verified+test_verified, confidence: exact_for_simulator]

  2. Quality-mode matrix: run all 20 Benchmarks/rag_eval_v1.jsonl cases under each quality mode, capturing RAGEvalMetrics, RouteEvalMetrics, and per-stage timing. Mac for iteration, iPhone for ground truth. Post-WWDC26 significance: the OS may transparently serve AFM 3 Core Advanced on capable silicon with no API to observe it — per-device measurement is the only visible instrument.

  3. On-device Instruments tracing: xcrun xctrace against the physical iPhone (verified visible 2026-07-28); requires a development-signed build and the signposts from (1).

  4. Measured baselines replace unbacked figures (FIRST NUMBERS IN, 2026-07-30): physical-device runs produced 27 tok/s on-device and 86 tok/s on PCC, with no TTFT under 2.2 s. That made the Settings capability card’s ≈65 tok/s roughly 2.4× optimistic for the local path, and < 0.8 s TTFT unsupported on A18 Pro.

    Both figures are now corrected in source (2026-08-05), along with four more claims found while closing them. The capability card reads 2-3 s TTFT and 27-86 tok/s, each labelled A18 Pro so the number carries the hardware it was measured on rather than implying a fleet-wide figure. The container sheet’s PT-MoE 32K is gone: the public SDK exposes neither the server model’s architecture nor its context window, and 32768 is a hardcoded sync fallback whose own code comment directs routing callers to the live capability provider instead. That badge now reads Native PCC (Apple Intelligence).

    The chrome was the smaller half. SampleDocumentManager ships the documents new users are told to import first, so the engine retrieves them and cites them back as sourced fact — it described the on-device path as “zero-latency” against a measured 2.2–3.2 s TTFT, and asserted a 32K PCC window in five places. All corrected. Two further 32K assertions in SettingsView are gone. Beyond the figures: LLMModelType.displayName returned "AFM 3 Core Advanced" in pickers and diagnostics, naming a tier the SDK exposes no selector for (the 3B/20B removal above changed the card and missed this string); the Settings capability list advertised Dynamic Profiles and Model Judges, neither of which exists in any mode, FoundationModelDynamicProfileRegistry having zero call sites and no judge implementation existing at all; and the QA suite’s pcc_token_window case graded the engine on answering “32K tokens” sourced from the very sample document being corrected. All fixed or removed. See Docs/Engineering/HARD_LIMITS.md and the [Unreleased] CHANGELOG section. [evidence_level: measured+code_verified+build_verified, confidence: high_for_this_device, evidence_source: LLMModelType.swift, ContainerSettingsSheet+Sections.swift, SampleDocumentManager.swift, SettingsView.swift, QualityAssuranceService.swift]

    Also blocking phase 2: the matrix cannot yet answer its own question. Until 2026-07-30 the Deep Think and Maximum reasoning chain abstained on every session and contributed nothing, so every prior mode comparison measured Standard against a broken path. Fixed in 665da0a; no dataset score for either mode exists yet. The 4.9 planner fix in acfbfbd is a second correction to the same measurement path: until it landed, the planner read slot zero’s score rather than the best chunk’s, so abstentions were triggered by a number that never described the evidence. Any mode comparison run before both fixes measured a broken planner, not a mode.

0.6 Next arc: retrieval and ingestion upgrade (planned, post-4.9)

Two planning documents written 2026-08-03 define the work after 4.9.

Re-verified 2026-08-06: four of the twelve items were stale, three of them because the work was already done. The plan documents below are unchanged from 2026-08-03 and are not a current status report. Read the ordering here, which has been corrected, rather than the ordering in them. Full evidence is on the Notion row for each item.

  • Docs/Research/EMBEDDING_AND_INGESTION_UPGRADE_2026-08.md — the research survey behind the plan.
  • Docs/Engineering/RETRIEVAL_UPGRADE_PLAN_2026-08.md — the sequenced engineering plan.

The plan’s own ordering, which this roadmap adopts:

  1. 2A — retrieval benchmark harness (do first). Extend the Benchmarks/rag_eval_v1.jsonl runs to report recall@k, MRR, and nDCG per retrieval stage, not just end-answer quality, and add query cases covering part numbers and table lookups. Every other item below is unfalsifiable without it, which is why it precedes even the correctness fix.
  2. 1A — exact token counting (closed 2026-08-06). The plan describes this as unbuilt. It is not, and the residual gap it should have described is now fixed too. FoundationModelTokenBudget.snapshot(...) already calls model.tokenCount(for:) for instructions, tools, evidence, and history behind @available(iOS 26.4, macOS 26.4, *), tags results .sdkExact versus .conservativeFallback so an estimate is never presented as exact, and is wired into the planner at RAGService.swift:14752, which defaults on. What remained was narrower and is now fixed: FoundationModelRoutePolicy.determineRoute short-circuits to the execution plan when one exists, but the planless path fell through to a hardcoded onDeviceLimit = 4096 compared against estimateTokens(..., isAppleFMOnDevice: !config.allowPrivateCloudCompute). That flag selects the chars/token ratio, so allowing PCC picked the cloud 2.5 ratio, underestimated by roughly 44% against an on-device limit, and was least likely to escalate exactly when escalation was available. The estimate is now unconditionally on-device, since the question is whether the prompt fits locally rather than where it will run, and the limit reads the real contextSize instead of assuming 4096 (same 4096 fallback, so no change on a device reporting the old window). Consistent with the 4521-against-4096 device log but never confirmed against it, so the mechanism is likely rather than proven. This path has no test coverage; build- and suite-verified, unverified on device. [evidence_level: code_verified+build_verified+test_verified, confidence: exact_for_the_defect, unverified_on_device, evidence_source: FoundationModelTokenBudget.swift:28-40/96-129, FoundationModelRoutePolicy.swift:28/60, LLMService.swift:577/919]
  3. 1B — BM25 column weights (done 2026-08-06), 1C — trigram index for identifiers, 1D — Spotlight search tool. 1B was already implemented and misaligned rather than missing: the chunks FTS5 table has nine columns and all four call sites passed eight weights, so every weight landed one column early. section_path inherited a 0 and contributed nothing to ranking, and section_title got 5x rather than the documented 10x. Reproduced in sqlite3 against the real schema: a chunk matching on section path scored 0.0 and sorted below one that merely mentioned the term in body text. Fixed, with the column list pinned beside the vector. 1C remains genuinely absent (tokenize='porter unicode61' only) and needs migration plus deleted_documents cleanup wiring. 1D should be evaluated as a fallback to the measured hybrid path, not a silent replacement for it. [evidence_level: code_verified+build_verified+reproduced_in_sqlite3, confidence: exact, evidence_source: SQLiteFullTextService.swift:242-254, :1458-1471]
  4. 2B — three-way embedder comparison (all-MiniLM-L6-v2 / NLContextualEmbedding / EmbeddingGemma-300M), which gates 3A — embedding migration. 3A is a full re-embed of every library and must be additive-then-swap, never destructive-then-rebuild.
  5. 3B — DynamicProfile: adopt or delete. FoundationModelDynamicProfileRegistry.swift has zero call sites today. An unused registry that looks implemented is worse than neither.

Phases 3C (modality-aware indexing), 3D (late chunking), and 4 (visual document retrieval, v5.0) follow. 3D note, 2026-08-06: late chunking is correctly listed as unbuilt, but until this date the app claimed it. The container settings sheet and six SemanticChunker comments labelled the shipped algorithm “Late Chunking”, which is a different technique: late chunking embeds the whole document and mean-pools token vectors per chunk, whereas detectEmbeddingBoundaries embeds individual sentences to locate cut points and returns positions, after which chunks are embedded independently. The label is removed and the distinction is now stated in the file header. 3C note: ChunkSemanticType is already assigned at ingestion and reaches FTS5 as structure_type, but that column is UNINDEXED, so the modality survives ingestion and is then unsearchable. That is the concrete form 3C has to address. [evidence_level: code_verified+build_verified, confidence: exact, evidence_source: SemanticChunker.swift, ContainerSettingsSheet+Sections.swift:44, SQLiteFullTextService.swift:242-254, DocumentChunk.swift:106-112] [evidence_level: plan_only, confidence: sequencing_is_owner_endorsed_content_unmeasured, evidence_source: the two plan documents above, owner direction 2026-08-05]

1. Near Term

  • Dark-mode app icon appearance (Implemented 2026-08-23; v5.0. macOS slots corrected 2026-09-01 — see below): The existing AppIcon remains the light default and the universal iOS asset slot now provides a matching dark luminosity rendition selected by device appearance. [evidence_level: build_verified, confidence: high_pending_device_validation, evidence_source: AppIcon.appiconset/Contents.json; xcrun actool; assetutil UIAppearanceDark rendition] Correction, 2026-09-01: the slots existed and compiled, which is what “build_verified” covered, but the macOS renditions were wrong in two measurable ways. Every mac slot was a full-bleed opaque square (margins 0 on all sides, corner alpha 255) where macOS requires the artwork inset to 824 of 1024 behind the system superellipse, and the dark variant carried the light icon’s blue on its antialiased edges because it had been made by repainting the background rather than recompositing (dark ground (10,18,36), boundary pixels (79,172,255)). All 20 mac slots were regenerated; iOS slots were correct and are untouched. This is exactly what build_verified cannot catch, and the entry is left standing rather than rewritten so the limit of that evidence level stays visible.

  • Phase 9 Route-Evidence Gates (Implemented 2026-07-28): RouteEvalMetrics scores ModelExecutionReceipt chains against six invariants covering route attestation, fallback attribution, fail-closed quota handling, and attempt-chain integrity, alongside per-route latency and fallback accounting. This closes the route half of Phase 9; the answer-quality half was already implemented in RAGEvalMetrics. Scoring is receipt-only, so it applies unchanged to simulator, device, and TestFlight data. [evidence_level: code_verified+test_verified, confidence: high, evidence_source: RouteEvalMetrics.swift, RouteEvalMetricsTests.swift]

  • Execution-receipt fidelity F-06 / F-07 (Resolved 2026-07-29, shipped in 4.8): two receipt-construction gaps found during the Phase 9 work, both closed after the owner delegated the semantics call. F-06 was real and is fixed: partial-stream receipts recorded a .failed attempt while naming that route as completedTarget, so a consumer reading completedTarget alone concluded the route cleanly completed. Partial streams now record a .partial attempt result, which attests completedTarget in RouteEvalMetrics the way .succeeded does while staying distinguishable from a clean completion; metrics count partialCompletions, where a rising count means streams are dying mid-answer. F-07 was closed with no code change: actualRoute is fixed at session construction in ensureSession, before any generation attempt, so the single-element attempt chains at both LLMService.swift sites describe construction-time fallbacks where the intended route was never attempted. A one-element chain plus fallbackReason was already the truth there, and runtime PCC failures merge the correct two-element chain at the RAGService site. The original finding conflated the two paths. Suite 149/149. [evidence_level: code_verified+test_verified, confidence: high, evidence_source: Notion roadmap row, LLMService.swift, RouteEvalMetrics.swift]

  • Authoritative Ingestion Stop & Self-Heal Control (Implemented 2026-07-15; validation pending): Queue Stop/X and discard now write bounded deletion-wins tombstones through iCloud Drive reconciliation, while empty-vector self-healing is serialized and persistently suppressible per library on the current device. Explicit import/manual rebuild clears local suppression. Focused tombstone tests are added; full-suite, multi-device, large-PDF, and physical-device behavior remain promotion checks for this uncommitted v4.6 change. [evidence_level: build_verified, confidence: high_pending_runtime_validation, evidence_source: RAGService.swift, WorkspaceSyncService.swift, IngestionQueueOverlay.swift, IngestionQueueTombstoneTests.swift]

  • PCC Dynamic Routing Phases 0–8 (Implemented 2026-07-15; validation pending): Added the signed-entitlement source configuration, live capability/quota provider, exact token/context budgets, retrieval-informed execution plans, minimized cloud evidence, foreground-safe consent, local-before-stream fallback, agentic final-synthesis routing, durable receipts, and focused policy tests. Swift 6 unknown quota cases map to a fail-closed state. Promotion remains gated on the full Xcode build plus signed iOS 27 device, archive/TestFlight, App Intent/background, network-transition, and quota-exhaustion validation. Apple Dynamic Profiles are not integrated and remain a separate privacy/concurrency-evaluation backlog item. [evidence_level: code_verified, confidence: high_for_source_unverified_for_device, evidence_source: PCC dynamic routing implementation files, FoundationModelDynamicProfileRegistry.swift, and test matrix]

  • Deterministic Chat Model Policy + Per-Answer Route Badges (Implemented 2026-07-16; validation pending): Split persistent picker policy from actual execution state. Hybrid remains Hybrid, On-Device is locally constrained, PCC is requested deterministically with planner/runtime local fallback, and each Apple-model response exposes the completed route with green/blue/amber receipt-backed badges. Focused planner, receipt, and badge regressions are included; physical iOS 27 quota/consent/network fallback and UI interaction remain promotion checks. [evidence_level: code_verified, confidence: high_pending_build_and_device_validation, evidence_source: ChatScreen.swift, ModelStatusIndicator.swift, ModelExecutionPlannerTests.swift, MessageBubbleV2.swift]

  • iOS Silicon HUD Scene Geometry (Implemented 2026-07-16; build verified): Replaced the deprecated UIScreen.main fallback with the floating HUD window’s required UIWindowScene.screen, preserving scene-correct frame restoration and drag bounds. [evidence_level: build_verified+code_verified, confidence: exact_for_build, evidence_source: MotherboardHUDView.swift and generic iOS 27 simulator build 2026-07-16]

  • GPU Policy + PCC Consent Persistence (Implemented 2026-07-15; device validation pending): Replaced the non-literal GPU percentage with four persisted execution profiles that gate the actual PDF, Core ML preference, large Metal vector/MMR, and background-eligibility paths. Canonical PCC consent now wins over stale legacy settings, and launch-time consent prewarming was removed so permission is bound only to a real post-retrieval envelope. Seven focused migration/profile tests pass. This is separate from Apple’s deferred Foundation Model Dynamic Profiles. [evidence_level: code_verified+test_verified, confidence: high_pending_physical_device_validation, evidence_source: DeviceCapabilityService.swift, SettingsStore.swift, RAGService.swift, RAGEngine.swift, BNNSVectorDatabase.swift]

  • RepoOS Workspace-Native Codex Routing (Completed 2026-07-15): Added a repository-local Codex skill, deterministic task/file preflight, binding workspace-automation route, documentation triggers, and Notion relevance decisions. The preflight derives the current working release on every task, routes durable implementation notes to CHANGELOG.md [Unreleased] and the matching Docs/RELEASE_NOTES.md section, and applies the same release to Notion. The layer reads the live RepoOS matrix rather than duplicating route policy and leaves all Apple app source untouched. [evidence: code_verified, exact, .codex/skills/route-openintelligence-work/scripts/repoos_router.py]

  • Core AI Model Compilation & Settings Save (v4.5.0 Completed): Compiled the native all-MiniLM-L6-v2 transformer model weights into an optimized Core AI .aimodel structure using coreai-torch extensions. Bypassed Xcode’s build-time mlassetc version checks (which block deployment targets below 27.0) by renaming the directory to EmbeddingModel.bundle and copying it as a raw resource folder, loading it dynamically at runtime. Fixed settings sheet blocker to allow saving of embedding configuration options when a provider is temporarily unavailable. Fixed Core AI tensor name mapping by explicitly binding the exported PyTorch graph output to “embeddings”. Fixed global embedding provider toggling bug during document ingestion that bypassed container settings.

  • Rust-Backed Tokenizer Migration (Completed): Migrated the local on-device tokenizer from legacy pure-Swift BertTokenizer to high-performance Rust-backed swift-tokenizers (DePasqualeOrg) package loaded asynchronously from the local resource bundle, yielding a 100x speedup and exact byte-level character offsets. Excluded tokenizer.json files from Xcode’s synchronized root group via project.pbxproj exception sets to prevent app-level copy conflicts.

  • Ingestion Performance & Checkpointing (Completed): Bypassed PNG encoding by feeding GPU-rendered CGImage buffers directly to Vision OCR/Structure requests. Introduced a local page-level JSON checkpointing cache to protect long document ingestions from OOM and app-restart data loss. Resolved parallel PDF ingestion concurrency race conditions and CoreImage deadlocks on Apple Silicon by introducing thread-safe NSRecursiveLock serialization around CGImage generation. Fixed FTS5 index truncation and page offset mapping errors during streaming batch ingestion, ensuring fully searchable large documents. Resolved a race condition where WorkspaceSyncService deleted active streaming ingest documents before metadata registration. Exposed and stabilized the Core AI sentence embedding provider option on iOS 27 through shared-instance caching, an awaitable readiness gate, and clean compile-time/runtime picker alerts.

  • Predictive Self-Tuning Ingestion (Completed): Integrated a pre-scan system using LibraryIntelligenceCenter to extract document snippets and dynamically adjust chunking strategies (e.g., density, bounds) prior to ingestion. This completely eliminates the need for post-ingestion database rebuilds for non-destructive chunking parameter shifts, avoiding prolonged UI stall-outs on massive PDFs.

  • watchOS Live Activities Layout (Completed): Customized the lock screen widget view with conditional rendering for watchOS Smart Stack .small widget family, detailing a circular gauge and compact status labels.

  • PCC Fallbacks & UI Diagnostics (v4.5.0 Completed): Restored and fixed the iCloud/PCC settings sheet views on iOS 27, ensuring robust self.settings scope lookup within SwiftUI sheet extensions to prevent routing crashes. Integrated an AI Subsystem Diagnostics card to the Library Deep Dive settings, giving full ‘x-ray vision’ over the active embedding model framework, ANE hardware target, readiness gate state, Rust-backed tokenizer parser, vocabulary details, byte-level citation offsets, and latency profiles. Fixed a rare sync-sweep race condition where background cleanups deleted recently uploaded files by touching their modification dates upon copy. Removed the Private Cloud Compute entitlement from the .entitlements file to resolve Xcode Cloud export validation errors while waiting for App Store Small Business Program entitlement approval, routing queries transparently to local on-device models.

  • Dynamic Candidate Cutoff Fix: Modify the candidate pool formula in RAGEngine.swift to dynamically scale chunk pool sizes for small libraries rather than hardcoding a floor of 100 chunks.

  • App Store Small Business Program - PCC Entitlement (Approved 2026-07-15; artifact verification pending): Apple approval was confirmed and com.apple.developer.private-cloud-compute is enabled in the source entitlement. Entitlement evidence is platform-specific: native macOS uses Security.framework, iOS/Catalyst development and ad-hoc builds parse the embedded signed provisioning profile, and profile-less distribution builds rely on Apple’s PCC availability/quota APIs. Generic arm64 iPhoneOS compilation passes. Verify the entitlement in an installed physical-device app and Archive/TestFlight signatures before marking distribution activation complete. [evidence_level: user_confirmed+build_verified+sdk_verified, confidence: high_for_source_unverified_for_distribution, evidence_source: user confirmation, OpenIntelligence.entitlements, EngineSDKCompatibility.swift]

  • Negation and Contradiction Sweeps: Explore upgrading negation checks to include numeric fact comparisons and direct citation checks.

2. Retrieval & Answer Quality

  • OCR Post-processing: Improve Vision OCR layout-aware text normalization and error correction.
  • Sibling Chunk Expansion: Tune parent-chunk expansion ranges to optimize context packing.
  • MMR Diversity Tuning: Experiment with different diversity thresholds ($\lambda$) to evaluate retrieval recall versus answer precision.

2.5 Third-Party Local Models on macOS (Proposed, v5.0)

  • Bring-your-own local model on Mac (Proposed; not started): run synthesis against a user-supplied local model on macOS instead of SystemLanguageModel.default, so a Mac with headroom can use a larger model than the on-device Apple Foundation Model. Requested by a Reddit user (u/<handle>) on 2026-08-02, who asked whether the app “can work with other, bigger local models (on mac).”

    Open design questions, none answered yet:

    • Host. MLX (Apple-native, Silicon-only) versus a llama.cpp/GGUF bridge versus an HTTP client for a model the user already runs locally (Ollama, LM Studio). The HTTP-client route is the cheapest to build and the weakest privacy claim, because “local” then depends on a process the app does not control.
    • Privacy claim boundary. The current App Store copy asserts every answer is produced on-device or on PCC. A third-party model host is neither, and the routing badge, ModelExecutionReceipt, and PRIVACY_AND_ROUTING.md would all need a fourth route with its own attestation, or the claim narrows.
    • Structured output. The agentic loop depends on Foundation Models’ guided generation for plan and fact extraction. An arbitrary GGUF model has no equivalent, so either the loop degrades to prompt-and-parse on that route or the route is synthesis-only with Apple models still owning planning.
    • Scope. macOS only. iOS has neither the memory headroom nor a sanctioned way to load third-party weights.

    [evidence_level: none, confidence: proposal_only, evidence_source: user request 2026-08-02]

3. Platform Integration & Monetization (v4.4 Completed)

  • Pro Annual Subscription Pricing: Calibrated Pro Annual pricing to $29.99/year (a 58% savings vs monthly) and integrated a 7-day free trial introductory offer.
  • Discontinued Document Pack: Removed the consumable Document Pack add-on UI views, quick-refill cards, and local StoreKit configuration.
  • Frictionless App Store Review Prompts: Integrated direct native requestReview() prompt calls during successful RAG sessions and Thumbs-Up events to maximize rating conversions in compliance with App Store Guideline 5.6.
  • Core AI Integration (Completed): Fully integrated and enabled Silicon-native sentence embeddings under Apple’s Core AI framework (CoreAISentenceEmbeddingProvider.swift) on iOS 27+ / macOS 27+, with Core ML fallback support.
  • Private Cloud Compute (PCC) (Source integration completed; validation pending): Native PCC is an iOS/macOS 27+ synthesis target selected only after local retrieval. Older OS releases remain genuinely local—there is no PCC simulation. Runtime signed-entitlement, availability, quota, consent, minimized-payload, fallback, and execution-receipt paths are implemented; device and distribution evidence is still required. [evidence_level: code_verified, confidence: high_for_source_unverified_for_device, evidence_source: ModelExecutionPlanner.swift, FoundationModelSessionFactory.swift, RAGService.swift]
  • Siri & AppIntents (Completed): Registered shortcuts and app intents for libraries, documents, and conversation history (ListEvidenceThreadsIntent and CreateNewEvidenceThreadIntent).