{
  "schemaVersion": 2,
  "date": "2026.07.24",
  "publishedAt": "2026-07-24T14:29:52-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Privacy-preserving geolocation triggers added to Hiro's plan",
  "publicationStatus": "Published",
  "executiveSummary": [
    "Added a phased geolocation-trigger workstream to Hiro's public product direction.",
    "The proposed design accepts discrete, user-configured zone transitions from an iPhone over Tailscale; it does not require continuous GPS transmission or storage.",
    "The plan is intentionally staged: secure event ingestion and observation precede any low-risk automation, while consequential actions remain confirmation-gated."
  ],
  "workstreams": [
    {
      "title": "Location-transition architecture",
      "status": "Planned",
      "details": [
        "The intended first integration is iPhone Shortcuts geofence automation posting an event containing a device label, approved zone name, enter or exit transition, timestamp, and event identifier to Hiro over Tailscale.",
        "The event contract is deliberately zone-based. Exact coordinates, continuous location history, and live tracking are outside the initial scope.",
        "A deterministic rules layer will decide whether an accepted event can cause a change. Models may enrich a rule-selected briefing or summary but will not choose whether a location rule fires."
      ]
    },
    {
      "title": "Ingress and reliability controls",
      "status": "Planned",
      "details": [
        "The planned endpoint will use a dedicated location credential and Tailscale-restricted reachability rather than reusing an existing general-purpose secret.",
        "Required checks are an approved-zone allowlist, timestamp freshness, event-ID deduplication, persisted presence state, and per-zone cooldowns.",
        "The first Home enter and exit automations will run in observation mode so actual iPhone delivery reliability can be verified before downstream behavior is enabled."
      ]
    },
    {
      "title": "Safe automation scope",
      "status": "Planned",
      "details": [
        "Early permitted effects are reversible and low-risk: setting a delivery or profile preference, and preparing a commute or unfinished-work summary for review or approved delivery.",
        "Potential later confirmation inputs include CarPlay and trusted Wi-Fi; Home Assistant is reserved as a possible broker only if the number of zones, devices, or presence sources makes the simpler route insufficient.",
        "Location alone will never authorize physical access, deletion, purchases, external email, or computer shutdown."
      ]
    }
  ],
  "decisions": [
    "Use transition events rather than continuous GPS collection to minimize data exposure and battery use.",
    "Begin with Home enter and exit logging before enabling automation.",
    "Require deterministic rules, explicit configuration, and idempotent handling ahead of any model-generated content.",
    "Keep sensitive and consequential actions behind explicit confirmation regardless of the event source."
  ],
  "validation": [
    {
      "check": "Roadmap documentation update",
      "status": "passed",
      "result": "The Hiro README now records the event-only architecture, phased rollout, reliability controls, and action-safety limits. The timestamped-journal test and frontend production build both passed after generating and validating 38 journal entries."
    },
    {
      "check": "Location endpoint and iPhone automation",
      "status": "not run",
      "result": "This session planned the capability only; no endpoint, token, firewall rule, iPhone automation, or location data handling was implemented or tested."
    },
    {
      "check": "Hiro application test suite",
      "status": "not run",
      "result": "The change is documentation-only and did not alter Hiro runtime code."
    }
  ],
  "currentState": [
    "Hiro has a documented plan for privacy-preserving geolocation triggers but no implemented location-event endpoint or active location automation.",
    "No location coordinates, zones, device identifiers, credentials, or live transition records were collected or published during this session.",
    "Existing approval boundaries continue to govern consequential external actions."
  ],
  "limitations": [
    "iOS geofence timing and boundary accuracy must be evaluated on-device; a transition should not be treated as a precise physical-position guarantee.",
    "Observation data and user feedback are required before choosing practical zone radii and cooldown settings.",
    "The planned delivery path depends on a correctly configured private Tailscale connection and a user-created Shortcut automation."
  ],
  "nextSteps": [
    "Define the versioned location-event schema and implement a dedicated authenticated endpoint with allowlisting, freshness, deduplication, state, and cooldown controls.",
    "Add focused tests for authentication, stale and duplicate rejection, invalid-zone handling, state transitions, and idempotent rule execution.",
    "Configure and manually test Home enter and exit iPhone Shortcuts over Tailscale in logging-only mode.",
    "Review observation evidence before enabling a narrowly scoped, reversible rule such as a delivery-profile switch or a commute-briefing draft."
  ],
  "disclosureNote": "This public entry intentionally omits locations, addresses, coordinates, device identifiers, tokens, network addresses, firewall details, and other private operational data."
}