Always-On Companion Mode dogfood gate

This preserves the live/hardware acceptance protocol for Always-On Companion Mode. On 2026-07-13 the owner explicitly directed “push through,” accepting the remaining unmeasured live/hardware and manual Xcode Cmd+R risk for milestone closeout. No signed live build, threshold row, or manual checklist item is represented as performed or passed. Complete and record this evidence before a release claim that relies on these thresholds.

Current executable surface

Camera: the production AVFoundation client samples at no more than 1 fps, computes a 32×24 luma motion delta, and runs Vision human-rectangle detection. It emits only non-identifying, session-local person tracks in the coarse room zone. Full camera frames do not cross the capture client and are not persisted.
Screen and Mac context: existing Watch Mode and ambient-context loops feed the world model without duplicate polling.
Wake conversation: Settings → Companion → Talk to Pace now explicitly invokes the existing push-to-talk conversation path. Ambient voice uses a production local Core ML gate before STT, requiring consecutive high-confidence hey_pace classifications from PaceWakeWordClassifier and validating that both exact labels, hey_pace and background, exist. Missing permission, model, labels, or audio input fails closed. An accepted wake releases the analysis microphone before a bounded post-wake conversation; pre-wake audio is not transcribed or persisted. The bundled model’s synthetic metrics and limitations are recorded in pace-wake-word-classifier.md.
Objects: Settings → Companion lets the user hold an object centered in view and capture a local Vision feature print. No photo is persisted. The low-rate camera compares overlapping coarse left/center/right regions, accepts only matches inside a conservative distance threshold, and emits expiring user-taught object evidence into the existing last-seen pipeline. Accuracy and continuity still require the hardware runs below.
Output: silent cards and spoken interventions are independently default off. When explicitly enabled, typed observations flow through the intervention policy, provenance-safe presenter, deduplication/queueing, and existing live restraint path for speech. Routine promotion requires three unique supporting observations; a single observation cannot become a routine.

Observe-only thresholds

Use one representative 16 GB Apple Silicon Mac and one higher-memory Mac when available. Keep Pace otherwise idle, enable only the source under test, and retain the raw measurement output with the PR or release evidence.

Gate	Required evidence	Pass threshold
CPU	`ps` samples every 10 seconds for 30 idle minutes and 30 active-room minutes	idle p95 ≤ 8%; active p95 ≤ 15%
Resident memory	RSS before enable and after 60 minutes	delta ≤ 250 MB and no monotonic growth over the final 30 minutes
Analysis rate	accepted/dropped candidate and analysis counters over 60 minutes	camera analysis ≤ 60/min; screen analysis obeys Watch Mode cadence; one in flight/source
Journal growth	structured observation file bytes at start and after 8 hours	projected growth ≤ 5 MB/day and total remains below the 20 MB budget
Person entry	30 scripted entries/exits across room lighting conditions	precision ≥ 90%, recall ≥ 90%, no identity-like persisted field
Object continuity	20 scripted moves of each taught object between named zones	last-seen zone accuracy ≥ 90%; stale/unknown wording after expiry
Wake quality	40 addressed phrases plus 8 hours ordinary room audio	false negatives ≤ 10%; false positives ≤ 1 per 8 hours; zero pre-wake STT calls/persisted audio
Pause	ten active-capture pauses measured from click to camera/mic indicator off	p95 ≤ 500 ms; no observations after pause timestamp
Sleep/wake	ten sleep/wake cycles with camera enabled	capture stops before sleep and resumes once after wake; no duplicate session
Permission loss	revoke camera/mic while observing, then restore intentionally	affected source stops and reports blocked/degraded; other sources continue
Local model unavailable	stop loopback models while screen interpretation is enabled	no off-device request; visible local-model degradation; cheap sources continue

These rows remain release follow-ups. If a threshold fails, keep the affected source/output out of release claims and attach the measurements to the next iteration. The 2026-07-13 owner waiver closes the milestone risk; it does not alter a threshold or manufacture a pass.

Manual Xcode checklist

Run from Xcode, never terminal xcodebuild:

Build and run with Cmd+R; confirm companion mode and every source are off on a fresh defaults domain.
Enable Camera in Settings → Companion. Confirm the native permission prompt appears once, camera activity is visible in Settings and the menu bar, and denial removes camera from active sources while Mac context can continue.
Walk into and out of frame. Confirm stored observations contain only personPresence, an ephemeral-track-* identifier, time, confidence, and room; inspect the JSON to prove no pixels or identity are present.
Press Pause while capture is active. Confirm the indicator clears within the threshold and no later camera observation appears.
Sleep and wake the Mac. Confirm one capture session resumes and status does not remain stuck at starting.
Click Talk to Pace now and complete a turn through push-to-talk. Then, with a valid bundled wake model, enable Ambient voice, address hey pace, and verify that pre-wake audio never reaches STT or persistence.
Teach a centered object, move it through the three coarse camera zones, and inspect the structured evidence. Confirm the store contains a feature-print archive and label but no source pixels; verify stale/unknown wording after expiry.
Confirm Silent cards and Spoken interventions are separately off on fresh defaults. Enable each independently: cards must retain provenance and avoid identity claims; speech must stay silent during active-call, Focus, recent-input, and cooldown conditions.
Confirm routine promotion requires three unique supporting observations.
Complete every row in the threshold table with dated measurements before making a release claim based on those thresholds.

Release follow-up order

Measure person, object, wake, resource, privacy, and lifecycle rows on target hardware; retain dated evidence.
Rerun silent-card repetition/accuracy and provenance checks with cards as a separate opt-in. Cards must never imply identity or excess certainty.
Run active-call, Focus, recent-input, cooldown, repetition, and interruption live checks with speech as a separate opt-in.
Observe routine quality over at least seven days while preserving the minimum of three unique supporting observations.