Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Docs: security page has no data-residency information, and states Entire does not receive transcripts

Aperta
  • Qualcosa non va?
#2,271 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Documentazione
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
git
Ambito
api, documentation, security

Direzione di ricerca

Inizia da docs.entire.io/security e confronta le relative dichiarazioni sulla residenza dei dati e sulle trascrizioni con /api/v1/clusters, /api/v1/me, la guida della CLI e la guida What is indexed. Documenta le giurisdizioni disponibili, le posizioni indipendenti del repository e dell’account e i casi in cui i dati sono solo locali rispetto a quelli sottoposti a mirroring/indicizzati; chiarisci il comportamento non risolto di homeJurisdiction oppure annota che richiede una conferma da parte del team di prodotto.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

docs.entire.io/security is subtitled "Where your data lives, which redaction layers run before each write, when data leaves your machine…" but contains no data-residency information, and one sentence in it reads as ruling out the hosted side of the product entirely.

I spent a while establishing the actual picture from the API, and I think a short section on that page would save others the same trip.

1. No residency information on the page that promises it

The page never mentions jurisdictions, regions, clusters, or homeJurisdiction. But all of these are real and user-visible:

$ entire api /api/v1/clusters
# four clusters, each with a jurisdiction: au, eu, in, us

$ entire api /api/v1/me
# "homeJurisdiction": "us"

entire api --help documents --to core vs --to cell and a --jurisdiction flag; entire auth token --help describes minting "a jurisdictional identity token for that jurisdiction's entire-api cells". So the CLI is explicit that jurisdictional cells exist. The security page is silent.

2. "Entire does not operate a service that receives your transcripts"

From the Threat Model and Boundaries accordion:

Entire does not operate a service that receives your transcripts. Checkpoints travel to the Git remotes you push to.

And the top of Where Your Data Lives:

Checkpoints live in your Git repository, not in a service Entire controls.

Both are hard to square with:

  • Mirrors. A repository can be mirrored to an Entire-operated cluster (entire repo mirror create), and the web console presents this as a hosting/data-residency feature.
  • Server-side search. What is indexed says semantic search covers "user prompts and assistant prose from sessions". That index is server-side and queried through the control plane, so transcript content is received and indexed by an Entire service.

The same accordion's Who can read what table already concedes this three paragraphs further down, listing entire.io as reading "The repositories you authorize, and the checkpoints in them". The flat sentence above contradicts the table below it.

3. Account jurisdiction is invisible in every surface

An account's homeJurisdiction is fixed at creation and determines which cell holds account-level aggregates. It is independent of where a repository is mirrored, so the two can differ, and I think most people would not expect that.

In my case the repository mirror is eu and the account is us. The web console's repository Settings → General shows a green "European Union / Frankfurt / Synced" hosting panel, which is accurate for the repository and reasonably reads as your data is in the EU. Nothing in the console or the docs indicates the account is elsewhere. I only found it via /api/v1/me.

Content does appear to stay with the repository's cluster, and the account cell holds metadata only (commit SHAs and dates, diff line counts, repo names, session/checkpoint/token counts, tool mix). That is a reasonable design. It just is not written down anywhere.

Suggested fix

  1. Add a Data residency section to the security page: the jurisdictions available, what lives in a repository's cluster versus the account's home cell, and that the two are set independently.
  2. Reword or qualify "Entire does not operate a service that receives your transcripts" so it is scoped to the local-only configuration, and note what changes once a repository is mirrored and indexed.
  3. Document whether homeJurisdiction can be changed after account creation, and whether it can be chosen at signup. I could not find a CLI or console route, and GET https://eu.auth.entire.io/api/v1/me returns foreign_jurisdiction for a us account.
  4. Consider surfacing the account's jurisdiction in the console next to the repository hosting panel, since that panel is where people go to answer the residency question.

Happy to test any wording against what the API actually returns.

CLI version 0.10.3.

Lingua principale
Go
Stelle
5.1k
Fork
475
Merge medio
1g 17h
PR unite (30g)
212

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di entireio/cli

Tutte le issue di entireio/cli

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.