jawnscope

Context for LLMs

jawnscope is a privacy-first ambient-capture system built on two design commitments: 'exaptation over acquisition' (a dedicated retired phone serves as the capture node, an existing MacBook as the compute node, cloud only as opt-in burst) and 'extract attributes, discard pixels.' A chest-mounted phone records 4K30 HEVC video, forked audio, and continuous GPX/IMU telemetry during trail runs and city walks; a tiered stage scheduler routes each processing stage — never the whole session — across four capability tiers (device_realtime → device_deferred via BackgroundTasks while docked/charging → personal_node over Tailscale → cloud_burst). Capture never blocks on processing: raw footage is quarantined encrypted in the app sandbox and aggressively reclaimed only once every routed stage confirms its derived outputs (raw runs ~18 GB/hr, so storage pressure is real; under pressure the system does frame-selective capture, then pauses with an indicator, and never force-deletes unconfirmed raw). Each session yields four sinks: a blurred archive (all faces and plates redacted), optional human-free 'ecology plates' (people removed via inpainting, for procgen/worldsim seeds), jawndex garment records (structured per-garment metadata + embeddings, no pixels), and bird-audio detections packaged for assisted eBird submission — the audio fork running a BirdNET-Lite Core ML model in real time during video capture is why it exists as one app. The iOS app (Swift/SwiftUI, AVFoundation, Vision, Core ML, SoundAnalysis, CoreMotion, CoreLocation, BackgroundTasks) does realtime audio classification and low-cadence face-presence indication, deferred face/person detection + blur, and MobileCLIP garment embeddings when thermals allow; the Python node (YOLOv8 person detection biased to recall, SCRFD/RetinaFace face detection within person crops, a head-region blur fallback when a person is detected but no face is found, ByteTrack temporal smoothing, inpainting, a full BirdNET pass, and corpus writes) does the heavy redaction on Apple Silicon via MPS or in cloud burst. The two sides share a language-neutral pipeline contract: every stage declares (inputs, outputs, minimum_tier, privacy_class), artifacts are content-addressed files plus a per-session JSON manifest. Eight non-negotiable, structurally-enforced privacy invariants govern the design: raw footage never crosses the trust boundary unprocessed (quarantined raw may move device→personal-node encrypted, under a specified mutual-auth/transfer-key/deletion-receipt protocol, never to cloud or corpus); only derived artifacts persist; garment-segment embeddings only, never full-person crops; location coarsened to geohash-5 and time to hour buckets downstream of capture; redaction recall tested to zero unredacted faces/plates as a release gate; contributor footage runs the identical pipeline with no trusted-uploader shortcut; k-anonymity that composes across queries and sessions via an embedding-linkage guard; and no protected-class-correlated joins, so neighborhood-level style signals can never become redlining-adjacent instruments. As of mid-2026 the monorepo is scaffolded and actively in build — the §8.5 redaction-recall gate is implemented, has already caught a real defect (a head-fallback that covered only the forehead), and passes on a realistic substrate. It sits in the Jawnverse family alongside jawncloud (catalog/wardrobe substrate), jawndex (which its garment records feed), jawnbase, and jawnfit.