feat(popup): inline 'local only' trust signal on credential-bearing rows

The privacy data-flow panel (v4.12.0) explained the storage-locality
guarantee, but it ships off-by-default — a user pasting a BYO API
key into the schema-overview editor had no visible reassurance
about where the key lives.

A small green .so-key-trust-local chip now surfaces on the
aiSummaryApiKey + aiSummaryEndpoint rows (the AI endpoint URL can
embed a key as a query param, so it gets the same treatment).
Tooltip enumerates the guarantees:

- chrome.storage.local is origin-scoped and never synced to a
  Google account
- never sent to Astra Deck servers
- redacted from the bug-report bundle (Diagnostics -> Save) via
  BUG_REPORT_REDACTED_KEYS

New TRUST_SIGNAL_LOCAL_ONLY_KEYS is a strict subset of
BUG_REPORT_REDACTED_KEYS so the chip's 'redacted from bundle'
claim stays true; pinned at test time so adding a key to one
set without the other fails CI.

Public default URLs (Cobalt instance, alternative frontend,
custom CSS) are redacted from bundles but don't get the chip —
the 'local only' reassurance is specifically about secrets.

CSS adds the green-tone variant to the existing
.so-key-profile-badge pattern (matches the v4.16.0 risk-badge
palette: amber for gated, red for unavailable, green for trusted).

Pinned by a new 'v4.47.0 schema-overview rows for credential-
bearing keys carry an inline local only trust signal' hardening
test asserting the set declaration, the subset relationship
with BUG_REPORT_REDACTED_KEYS, the well-known BYO-key entries,
the row-builder hook, and the CSS variant.

Existing NEW-1 test anchor hardened from
indexOf('BUG_REPORT_REDACTED_KEYS') to a regex search so future
comments referencing the symbol can't fool the slice window.

Backlog item retired from RESEARCH_FEATURE_PLAN.md.

570/570 JS tests pass (+1 new); npm run check clean.

Author: SysAdminDoc

CHANGELOG.md

@@ -6,6 +6,35 @@ All notable changes to Astra Deck are documented here. Versions are listed newes
 
 ## [Unreleased]
 
+- **Inline "local only" trust signal on credential-bearing schema-overview
+  rows.** The privacy data-flow panel (v4.12.0) explained the
+  storage-locality guarantee, but it ships off-by-default — a user
+  pasting a BYO API key into the schema-overview editor had no visible
+  reassurance about where the key lives. A small green `.so-key-trust-local`
+  chip now surfaces on the `aiSummaryApiKey` + `aiSummaryEndpoint` rows
+  (the AI endpoint URL can embed a key as a query param, so it gets the
+  same treatment). Tooltip enumerates the guarantees:
+  `chrome.storage.local` is origin-scoped and never synced to a Google
+  account, never sent to Astra Deck servers, and the value is redacted
+  from the bug-report bundle (Diagnostics → Save) via
+  `BUG_REPORT_REDACTED_KEYS`. New `TRUST_SIGNAL_LOCAL_ONLY_KEYS` is a
+  strict subset of `BUG_REPORT_REDACTED_KEYS` so the chip's "redacted
+  from bundle" claim stays true; pinned at test time so adding a key
+  to one set without the other fails CI. Public default URLs (Cobalt
+  instance, alternative frontend, custom CSS) are redacted from
+  bundles but don't get the chip — the "local only" reassurance is
+  specifically about secrets. CSS adds the green-tone variant to the
+  existing `.so-key-profile-badge` pattern (matches the v4.16.0 risk-
+  badge palette: amber for gated, red for unavailable, green for
+  trusted). Pinned by a new `v4.47.0 — schema-overview rows for
+  credential-bearing keys carry an inline "local only" trust signal`
+  hardening test asserting the set declaration, the subset relationship
+  with BUG_REPORT_REDACTED_KEYS, the well-known BYO-key entries, the
+  row-builder hook, and the CSS variant. Existing NEW-1 test anchor
+  hardened from `indexOf('BUG_REPORT_REDACTED_KEYS')` to a regex
+  search so future comments referencing the symbol can't fool the
+  slice window. 570/570 JS tests pass (+1 new).
+
 - **Audit pass: three real bugs fixed in the just-shipped Pass-3 batch.**
   Deep audit of the autonomous-loop's recent ships caught two real
   defects + one polish gap before they reached users:

RESEARCH_FEATURE_PLAN.md

@@ -148,8 +148,6 @@ Each item carries: priority, complexity, why, evidence, touches, acceptance, ver
 
 ### Polish and competitive parity
 
-- **P2 / S — Inline trust signal on AI provider rows**
-  - "Key stored locally only" inline on the `aiSummaryApiKey` row (currently only in privacy-data-flow panel which is off by default).
 
 - **P3 / S — Wheel-seek (NF9)**
   - Touches: `ytkit.js` near `volumeWheelMode`; new `wheelSeek` schema entry.

extension/popup.css

@@ -1132,6 +1132,17 @@ body {
   border-color: rgba(245, 87, 87, 0.36);
 }
 
+/* v4.47.0: inline trust signal on credential-bearing rows. Same
+   compact-pill geometry as the gated + unavailable chips, but a
+   reassuring green tone — this is positive trust info, not a
+   warning. Tooltip enumerates the local-storage + redaction
+   guarantees. WCAG AA contrast against the row background. */
+.schema-overview-list .so-key-profile-badge.so-key-trust-local {
+  background: rgba(78, 200, 165, 0.14);
+  color: #6fe0bc;
+  border-color: rgba(78, 200, 165, 0.36);
+}
+
 /* v4.47.0 NEW-6: per-key reset affordance. Only rendered when the
    schema entry has a defaultValue AND the current setting value
    differs from it. Compact circular button with the ↺ glyph — wraps

extension/popup.js

@@ -1895,6 +1895,26 @@ function buildSchemaOverviewKeyRow(entry, settings) {
         }
     }
 
+    // v4.47.0: inline trust signal on credential-bearing rows. The
+    // privacy data-flow panel (v4.12.0) already explains the "stored
+    // locally only" guarantee, but that panel is off by default — a
+    // user pasting an API key into the schema-overview editor has no
+    // visible reassurance about where the key lives. A small green
+    // "local only" chip on the row makes the trust boundary visible
+    // at the pasting moment, not buried in an opt-in panel. Tooltip
+    // expands: bug-report bundles redact the value via NEW-1's
+    // BUG_REPORT_REDACTED_KEYS list, and chrome.storage.local is
+    // origin-scoped (never synced to a Google account).
+    if (TRUST_SIGNAL_LOCAL_ONLY_KEYS.has(entry.key)) {
+        const trustChip = document.createElement('span');
+        trustChip.className = 'so-key-profile-badge so-key-trust-local';
+        trustChip.textContent = 'local only';
+        trustChip.title = 'This value is stored in chrome.storage.local on this device. '
+            + 'It is never synced to a Google account, never sent to Astra Deck servers, '
+            + 'and is redacted from the bug-report bundle (Diagnostics → Save).';
+        row.appendChild(trustChip);
+    }
+
     if (entry.type === 'boolean') {
         const on = settings[entry.key] === true;
         const btn = document.createElement('button');
@@ -2319,6 +2339,19 @@ const BUG_REPORT_REDACTED_KEYS = Object.freeze([
     'alternativeFrontendInstance',
 ]);
 
+// v4.47.0: schema-overview rows for these keys carry an inline
+// "local only" trust signal chip. The set is a strict subset of
+// BUG_REPORT_REDACTED_KEYS — only the truly credential-bearing
+// keys (BYO API keys + the AI endpoint URL, which can embed a
+// key as a query param). Public default URLs (Cobalt instance,
+// alternative frontend, custom CSS) are redacted from bundles
+// but don't need a trust chip on the editor row because the
+// "local only" reassurance is specifically about secrets.
+const TRUST_SIGNAL_LOCAL_ONLY_KEYS = new Set([
+    'aiSummaryApiKey',
+    'aiSummaryEndpoint',
+]);
+
 // v4.47.0 NEW-1: redact in place so the bug-report bundle never ships
 // a user's BYO API key, a self-hosted endpoint, or pasted custom CSS.
 // Returns a NEW object — callers must NOT use the input afterwards.

tests/hardening.test.js

@@ -8146,6 +8146,61 @@ test('v4.47.0 NEW-7 — SW lifecycle ring records sw-start into chrome.storage.s
         'bug-report bundle payload must include swLifecycle (shorthand property)');
 });
 
+test('v4.47.0 — schema-overview rows for credential-bearing keys carry an inline "local only" trust signal', () => {
+    // The privacy data-flow panel (v4.12.0) explains the "stored
+    // locally only" guarantee, but that panel is off by default —
+    // a user pasting an API key into the schema-overview editor
+    // had no visible reassurance about where the key lives. A
+    // small green chip on the row makes the trust boundary visible
+    // at the pasting moment. Implementation invariants pinned here:
+    //
+    // 1. TRUST_SIGNAL_LOCAL_ONLY_KEYS is a strict subset of
+    //    BUG_REPORT_REDACTED_KEYS — every key with a trust chip
+    //    must also be redacted from the bug-report bundle, otherwise
+    //    the chip's "redacted from bundle" claim is a lie.
+    // 2. The chip uses the existing profile-badge geometry +
+    //    so-key-trust-local class variant.
+    // 3. CSS declares the variant.
+
+    assert.match(popupSource, /const\s+TRUST_SIGNAL_LOCAL_ONLY_KEYS\s*=\s*new Set\(/,
+        'popup.js must declare TRUST_SIGNAL_LOCAL_ONLY_KEYS');
+
+    // Extract both sets and assert the subset relationship at
+    // source-level so future additions to one are caught against
+    // the other.
+    const trustListMatch = popupSource.match(/TRUST_SIGNAL_LOCAL_ONLY_KEYS\s*=\s*new Set\(\[([^\]]+)\]/);
+    assert.ok(trustListMatch, 'TRUST_SIGNAL_LOCAL_ONLY_KEYS must initialize from an array literal');
+    const trustKeys = trustListMatch[1].match(/'[^']+'/g) || [];
+    const redactListMatch = popupSource.match(/BUG_REPORT_REDACTED_KEYS\s*=\s*Object\.freeze\(\[([^\]]+)\]/);
+    assert.ok(redactListMatch, 'BUG_REPORT_REDACTED_KEYS must initialize from a frozen array literal');
+    const redactKeys = new Set((redactListMatch[1].match(/'[^']+'/g) || []));
+    for (const trustKey of trustKeys) {
+        assert.ok(redactKeys.has(trustKey),
+            `${trustKey} must also be in BUG_REPORT_REDACTED_KEYS so the chip's "redacted from bundle" claim is true`);
+    }
+    // Each of the well-known BYO-key fields must carry the trust chip.
+    for (const required of ["'aiSummaryApiKey'", "'aiSummaryEndpoint'"]) {
+        assert.ok(trustKeys.includes(required),
+            `${required} must be in TRUST_SIGNAL_LOCAL_ONLY_KEYS so the trust chip surfaces on its row`);
+    }
+
+    // Row builder consults the set and applies the chip.
+    const rowStart = popupSource.indexOf('function buildSchemaOverviewKeyRow');
+    const rowEnd = popupSource.indexOf('return row;', rowStart);
+    const rowBlock = popupSource.slice(rowStart, rowEnd);
+    assert.match(rowBlock, /TRUST_SIGNAL_LOCAL_ONLY_KEYS\.has\(entry\.key\)/,
+        'row builder must check TRUST_SIGNAL_LOCAL_ONLY_KEYS.has(entry.key) before rendering the chip');
+    assert.match(rowBlock, /so-key-trust-local/,
+        'row builder must apply the .so-key-trust-local class on the chip');
+
+    // CSS variant exists.
+    const popupCss = fs.readFileSync(
+        path.join(__dirname, '..', 'extension', 'popup.css'), 'utf8'
+    );
+    assert.match(popupCss, /\.so-key-profile-badge\.so-key-trust-local\s*\{/,
+        'popup.css must declare the .so-key-trust-local variant');
+});
+
 test('v4.47.0 NEW-6 — per-key Reset button on schema-overview rows whose value differs from default', () => {
     // NEW-6: a user who has changed one setting to a breaking value
     // currently has to either remember the default or hit global
@@ -8347,7 +8402,11 @@ test('v4.47.0 NEW-1 — bug-report bundle redacts BYO keys/endpoints/CSS and inc
     // 1. BUG_REPORT_REDACTED_KEYS exists and lists every sensitive key.
     assert.match(popupSource, /const\s+BUG_REPORT_REDACTED_KEYS\s*=\s*Object\.freeze\(\[/,
         'popup.js must declare BUG_REPORT_REDACTED_KEYS as a frozen array');
-    const listStart = popupSource.indexOf('BUG_REPORT_REDACTED_KEYS');
+    // Anchor on the declaration itself (not a passing mention in a
+    // comment elsewhere) — a later comment referenced the symbol
+    // name and a bare indexOf would otherwise slice from the wrong
+    // spot.
+    const listStart = popupSource.search(/const\s+BUG_REPORT_REDACTED_KEYS\s*=/);
     const listBlock = popupSource.slice(listStart, listStart + 600);
     for (const key of ['aiSummaryApiKey', 'aiSummaryEndpoint', 'customCssCode',
                        'downloadCobaltInstance', 'alternativeFrontendInstance']) {