Hiro development journal

Privacy-preserving geolocation triggers added to Hiro's plan

2026.07.24 at 14:29:52 America/Los_Angeles Published Machine-readable JSON

Executive summary

Added a phased geolocation-trigger workstream to Hiro's public product direction.

The proposed design accepts discrete, user-configured zone transitions from an iPhone over Tailscale; it does not require continuous GPS transmission or storage.

The plan is intentionally staged: secure event ingestion and observation precede any low-risk automation, while consequential actions remain confirmation-gated.

Work completed

Location-transition architecture

Planned

The intended first integration is iPhone Shortcuts geofence automation posting an event containing a device label, approved zone name, enter or exit transition, timestamp, and event identifier to Hiro over Tailscale.
The event contract is deliberately zone-based. Exact coordinates, continuous location history, and live tracking are outside the initial scope.
A deterministic rules layer will decide whether an accepted event can cause a change. Models may enrich a rule-selected briefing or summary but will not choose whether a location rule fires.

Ingress and reliability controls

Planned

The planned endpoint will use a dedicated location credential and Tailscale-restricted reachability rather than reusing an existing general-purpose secret.
Required checks are an approved-zone allowlist, timestamp freshness, event-ID deduplication, persisted presence state, and per-zone cooldowns.
The first Home enter and exit automations will run in observation mode so actual iPhone delivery reliability can be verified before downstream behavior is enabled.

Safe automation scope

Planned

Early permitted effects are reversible and low-risk: setting a delivery or profile preference, and preparing a commute or unfinished-work summary for review or approved delivery.
Potential later confirmation inputs include CarPlay and trusted Wi-Fi; Home Assistant is reserved as a possible broker only if the number of zones, devices, or presence sources makes the simpler route insufficient.
Location alone will never authorize physical access, deletion, purchases, external email, or computer shutdown.

Decisions and reasoning

Use transition events rather than continuous GPS collection to minimize data exposure and battery use.
Begin with Home enter and exit logging before enabling automation.
Require deterministic rules, explicit configuration, and idempotent handling ahead of any model-generated content.
Keep sensitive and consequential actions behind explicit confirmation regardless of the event source.

Validation and evidence

Check	Status	Result
Roadmap documentation update	passed	The Hiro README now records the event-only architecture, phased rollout, reliability controls, and action-safety limits. The timestamped-journal test and frontend production build both passed after generating and validating 38 journal entries.
Location endpoint and iPhone automation	not run	This session planned the capability only; no endpoint, token, firewall rule, iPhone automation, or location data handling was implemented or tested.
Hiro application test suite	not run	The change is documentation-only and did not alter Hiro runtime code.

Current state

Hiro has a documented plan for privacy-preserving geolocation triggers but no implemented location-event endpoint or active location automation.
No location coordinates, zones, device identifiers, credentials, or live transition records were collected or published during this session.
Existing approval boundaries continue to govern consequential external actions.

Next steps

Define the versioned location-event schema and implement a dedicated authenticated endpoint with allowlisting, freshness, deduplication, state, and cooldown controls.
Add focused tests for authentication, stale and duplicate rejection, invalid-zone handling, state transitions, and idempotent rule execution.
Configure and manually test Home enter and exit iPhone Shortcuts over Tailscale in logging-only mode.
Review observation evidence before enabling a narrowly scoped, reversible rule such as a delivery-profile switch or a commute-briefing draft.