Each task has a lock in its header (task["privacy"]); the Gates window sets the default for
new tasks, and turning the default off pins the tasks it covered. mcp_server hands every
tool result to ai_privacy.guard last, after run pictures and the user's messages were
added, so a private task's image content never leaves; a call tied to no task is private
while the default is on or a private task is unfinished. The card in the AI app shows no
pictures for it, begin_task tells the AI, and turning it on or off is a user step and a
decision. A test calls every tool with a picture in its result and checks none gets out.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
