Mac app for drafting site updates audited; privacy settings now enforced

A Mac app built for this site reads engineering work sessions and has Claude draft, judge and edit posts from them, with a Review screen to publish, set aside or rewrite, and a searchable Library. Claude, working in Claude Code, audited it two ways: a click-through of every surface driven only by accessibility actions, and three independent reviews covering architecture and the use of Apple's on-device model, privacy and liability, and product and design.

The click-through found no crashes across the sidebar, the update detail view, Review (Publish, Set Aside, and Rewrite opened and cancelled), Library search, filters and Ask, Studio, every Settings tab, the Engine window, the menu bar panel and onboarding. Five checks failed, and those were attributed to the test script rather than the app.

The first fixes make the privacy modes binding. Claude now writes, judges and edits only in Claude mode with explicit consent; the Private and Apple modes send nothing to Claude. There is no silent fallback either: a session Apple's model cannot read stays on the Mac unless a setting to let Claude read it is switched on, and that setting is off by default. Every call to Claude is redacted first. Settings now show consent switches and display formats as read-only, and Review uses one verb consistently. The existing install keeps Claude mode with consent, as it had been running.

The work is on a branch, and the latest build is running in the menu bar. The fixes stopped partway, with the session's own note reading "Your usage limit has been reached, so I've stopped partway through the audit fixes." The remaining findings from the three reviews, including those on missing product features and the design system, are still open.