Understand the system

Work here happens in stable work blocks: stretches that survive interruption and can be picked up cold. The agent's half of that promise is mechanical - a resume pointer written to disk before anything risky, an append-only journal as the source of truth, task checkpoints that name their evidence, and one ritual that seals each block. Your half is a single page called the console, which watches without interrupting.

The modules, and exactly what each one touches

Privacy, data sharing and telemetry - the honest version

Three truths, stated plainly - then the risk map below turns them into exact file locations and what each one is safe to share.

1. This system phones home to no one. There is no telemetry, no analytics, no update check, no CDN. The hooks and tools make exactly zero network calls. The one exception is obsctl analyze, which is off by default and only ever talks to the endpoint you configure - and with a local Ollama endpoint, even that never leaves your machine. API keys live in your environment or a gitignored .env, never in a committed file, and the tests prove a key placed in config is ignored.
2. Claude Code itself talks to Anthropic. Your conversation, and files the agent reads, go to the Claude API - that is how Claude Code works, with or without this system, under your account's data settings. This system neither adds to that traffic nor reduces it. What it adds is a local copy: the record captures events so you can inspect and analyze what happened on your own disk.
3. The record is radioactive, and treated that way. Raw captured events contain prompts, file contents and tool output verbatim (measured at ~70% of capture volume). So the raw record lives in a sibling folder outside the repo, where git structurally cannot reach it; only allowlisted metadata (event names, timestamps, token counts, an integrity anchor) is ever committed. A git push can therefore never publish a prompt, a file body, or a secret from the record - and a CHECK-phase gate fails the ritual if any committed file so much as names your home directory.

# the only network call site in the whole system (analyze, opt-in):
grep -rn "urllib.request" .claude/tools/ .claude/hooks/
# what the hooks are wired to do:
cat .claude/settings.json
# the redaction allowlist that gates what can ever be committed:
python3 -c "import json; print(json.load(open('.claude/config/observe.json'))['seal_allowlist'])"
# the test suite, including the secrets-never-reach-segments proofs:
python3 .claude/tools/tests/run_tests.py

The risk map: where files live, and what each is safe to share

Three places hold your data, with three very different sensitivities. Read the colors: safe to push is committed by design, contains your words is committed but carries text you wrote, and never share holds verbatim history that no push can reach - but a zip, a screen share, or a copied folder can.

your-repo/                                safe to push
├─ .claude/                    the system: tools, hooks, skills, config
│  ├─ state/journal.jsonl      contains your words pointers and notes you typed
│  ├─ state/needs-human.jsonl  contains your words questions, context, your answers
│  ├─ Project-log.jsonl        contains your words decisions and summaries
│  └─ everything else          safe to push code, config, protocols, map cards
├─ .claude-iff/                safe to push allowlisted totals + integrity anchor only
└─ .env                        never share gitignored; machine paths, keys

your-repo_claude_iff/  (sibling folder - git cannot reach it)
├─ spool/ · sealed-raw/        never share VERBATIM: prompts, file contents, tool output
├─ raw/transcripts/            never share full conversation copies
├─ vault/                      never share whole-repo + chat snapshots
├─ analysis/                   contains your words model-written summaries of raw events
└─ segments/                   metadata only allowlisted: names, times, counts

~/.claude/  (Claude Code's own home - not this system's, but part of your history)
└─ projects/<your-repos>/      never share every conversation, verbatim, per project

What this means in practice:

• A git push is structurally safe. The record and the chat history sit outside the repo, so no push can carry them - and a CHECK gate fails the build if a committed file even names your home directory. The residual risk in a push is the contains your words tier: whatever you typed into pointers, notes, questions and answers IS committed and travels with the repo. Keep secrets out of free text; the system cannot redact what you chose to write there.
• Sharing a folder is not a push. Zipping the project's parent directory, screen sharing a file manager, or backing up to a shared drive can carry your-repo_claude_iff/ - which holds everything verbatim, forever, on purpose. Treat that folder like a private diary that happens to sit next to your repo.
• The history outlives the session. ~/.claude/projects/ keeps full conversations for every repo you have worked in. Anyone with this machine's user account can read them; cloud-sync of your home directory uploads them. That is Claude Code's normal behavior - this system just makes it visible instead of leaving it forgotten.
• Check before you publish anything beyond git: python3 .claude/tools/obsctl.py size shows what the record holds, and the ritual's CHECK phase reports it every run.