timmy ef22ea8970 feat(training): separate opt-in contribution receipts with withdrawable tombstones ...

A journal save now records no training contribution. A contribution is a second
consent: the privacy page states consent version training-consent-v1 and the
receipt (contribution id, included fields, never-included fields) before the
confirm control is enabled, the receipt is queued on this device only and copies
no photo bytes, note text, or symptom answers, and withdrawal keeps a tombstone
naming every derived artifact by contribution id. Delete-all clears the receipts
with the ledger.

Closes #24

2026-10-21 10:58:50 +00:00

..

PHOTO-DATAFLOW-THREAT-MODEL.md

docs: add end-to-end photo data-flow threat model (#20)

2026-10-10 08:03:31 +00:00

PRODUCT-DECISIONS.md

feat(training): separate opt-in contribution receipts with withdrawable tombstones

2026-10-21 10:58:50 +00:00

STAGING-RUNBOOK.md

feat: add hardened atomic staging deployment

2026-08-21 14:49:28 +00:00

TIMMY-AGENT-POLICY.md

feat: simplify Timmy and add secure Hermes chat

2026-08-20 16:21:00 +00:00