goldwav · goldwav · Aug 5, 2026 · Aug 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -14,10 +14,16 @@ public releases begin.
 - Separate Notes and Stickies views.
 - Desktop sticky windows with movement, resizing, hiding, and keep-on-top.
 - Shared live note model between the full editor and sticky windows.
+- Optional bring-your-own-key AI assistant for selections or full notes.
+- OpenAI Responses, Anthropic Messages, and OpenRouter Chat Completions support.
+- Quick actions for task priority, clear rewriting, code improvement, and review.
+- Preview, copy, discard, stale-text protection, and explicit replacement controls.
+- Windows-user-protected API-key storage outside note recovery.
 - Local session recovery with corrupt-file fallback.
 - Multi-monitor placement recovery.
-- Automated checks for core note, category, migration, recovery, and placement
-  behavior.
+- 49 automated checks for document safety, categories, migration, recovery,
+  provider contracts, protected settings, cancellation, prompt boundaries, and
+  stale-edit rejection.
 
 ### Changed
 
@@ -29,3 +35,6 @@ public releases begin.
 - Development builds are unsigned.
 - There is no installer, uninstaller, or automatic update channel yet.
 - No tagged public release has been published.
+- AI requires a user-supplied provider account and API key; availability,
+  pricing, routing, and provider-side retention are outside The Notepad.
+- Automated tests use provider contract doubles, not live billable requests.
diff --git a/PRIVACY.md b/PRIVACY.md
@@ -1,11 +1,12 @@
 # Privacy
 
-Last updated: July 30, 2026
+Last updated: August 5, 2026
 
-The Notepad is designed as a local Windows editor. The current native
-application has no account system, advertising, analytics, telemetry, crash
-reporting, or cloud synchronization. Normal editing does not intentionally make
-network requests.
+The Notepad is a local-first Windows editor. It has no account system,
+advertising, analytics, telemetry, crash reporting, or cloud synchronization.
+Normal editing makes no network requests. An optional bring-your-own-key AI
+assistant can send text to a provider only after you press **Send**, as
+described below.
 
 ## What stays on your computer
 
@@ -15,11 +16,17 @@ The Notepad stores application data under your Windows user profile:
 |---|---|---|
 | `%LOCALAPPDATA%\TheNotepad\recovery\session.json` | Note and sticky text, titles, colors, pin and visibility state, desktop position and size, open-tab state, selected item, navigator state, file paths, encoding and line-ending metadata, dirty state, and a source-file fingerprint | Restores work and detects files changed outside the app |
 | `%LOCALAPPDATA%\TheNotepad\recent-files.json` | Up to 12 full file paths and the time each file was last opened | Displays the local Recent list |
+| `%LOCALAPPDATA%\TheNotepad\settings\ai.json` | Active provider, model IDs, and API keys encrypted for the current Windows user | Restores optional AI configuration without placing raw keys in note recovery |
 | `%LOCALAPPDATA%\TheNotepad\recovery\session.json.corrupt-*` and `%LOCALAPPDATA%\TheNotepad\recent-files.json.corrupt-*` | A preserved copy of unreadable local state | Allows troubleshooting without blocking startup |
 
-There is currently no separate `settings.json` file. Editor layout preferences
-that persist are part of `session.json`. The optional Windows-startup setting is
-stored in the per-user registry as described below.
+Editor layout preferences that persist remain part of `session.json`. AI
+provider and model preferences are stored in `settings\ai.json`. API keys in
+that file are encrypted with Windows Data Protection and can be decrypted only
+under the same Windows user account. Raw keys are not written to note recovery,
+recent-file history, logs, or the project folder.
+
+The optional Windows-startup setting is stored in the per-user registry as
+described below.
 
 These files are not uploaded by The Notepad. Full paths can reveal folder and
 file names to anyone who already has access to your Windows account, so protect
@@ -43,7 +50,9 @@ to:
 .<document-name>.bak-<identifier>
 ```
 
-The app does not scan unrelated folders or upload document contents.
+The app does not scan unrelated folders. Normal editing does not upload
+document contents. Text is sent externally only through the optional AI flow
+described below.
 
 ## Start with Windows
 
@@ -64,19 +73,48 @@ Turning the option off removes the app's value. Do not delete the entire Windows
 
 ## Network behavior
 
-The current native editing path contains no networking, account, advertising,
-analytics, or telemetry integration. The local release-packaging scripts also
-do not upload or publish artifacts.
+Normal editing remains offline. The AI assistant makes an outbound HTTPS request
+only when you press **Send**. Opening the panel, changing a selection, typing,
+saving, recovering notes, and applying a preview do not contact a provider.
+
+The selected provider receives:
+
+- your instruction;
+- the current selected text, or the full current note when nothing is selected;
+- the configured model ID and an output-length limit; and
+- the provider's API key as an authentication header.
+
+The Notepad does not intentionally send the note's file path, recovery data,
+other notes, recent-file history, or the on-screen conversation history. The
+provider response stays in memory unless you copy it or approve a replacement;
+AI conversations are not written to recovery.
+
+Requests use fixed endpoints:
+
+- OpenAI: `https://api.openai.com/v1/responses`
+- Anthropic: `https://api.anthropic.com/v1/messages`
+- OpenRouter: `https://openrouter.ai/api/v1/chat/completions`
+
+OpenAI Responses requests explicitly set `store: false`. This limits optional
+response storage but does not override any provider security, abuse-monitoring,
+or legal-retention obligations.
+
+OpenRouter may route a request to another model provider. Each provider controls
+its own billing, processing, retention, and abuse-monitoring practices. Review
+the provider's current terms and privacy documentation before sending sensitive
+or regulated text. The Notepad cannot inspect or delete provider-side records.
+
+The app does not send analytics, telemetry, crash reports, or background AI
+requests. Its local release-packaging scripts also do not upload or publish
+artifacts.
 
 Windows itself may perform operating-system services such as SmartScreen,
 certificate-revocation, or Microsoft Store checks when an application is
-downloaded, installed, or launched. Those Windows services are outside The
-Notepad's editing behavior and are governed by Microsoft and your Windows
-settings.
+downloaded, installed, or launched. Those services are outside The Notepad's
+editing behavior and are governed by Microsoft and your Windows settings.
 
-If a future version adds optional updates, synchronization, crash reporting, or
-another network feature, this document must be updated before that feature is
-released.
+If a future version adds updates, synchronization, crash reporting, or another
+network feature, this document must be updated before that feature is released.
 
 ## How to clear local application data
 
@@ -87,11 +125,13 @@ released.
    only the The Notepad value whose command points to `TheNotepad.exe` from the
    per-user registry key shown above.
 3. In File Explorer, enter `%LOCALAPPDATA%\TheNotepad` in the address bar.
-4. Delete that folder to remove recovery state, the Recent list, and stored
-   editor layout preferences.
+4. Delete that folder to remove recovery state, the Recent list, editor layout
+   preferences, AI provider/model choices, and locally protected API keys.
 
 Deleting the application-data folder does **not** delete ordinary text files
 that you saved elsewhere. Delete those documents separately only if that is
 your intention.
 
-The Notepad has no remote account or server-side data to delete.
+The Notepad has no remote account or its own server-side data to delete.
+Clearing local data does not delete records held by an AI provider; manage
+those records through the provider account and policies you chose.
diff --git a/PRODUCT_PLAN.md b/PRODUCT_PLAN.md
@@ -11,7 +11,9 @@ The native Windows alpha lives in `native/` and uses C# with WPF on .NET 10. It
 includes file-backed editing and safe saves, keyboard-accessible tabs, recent
 files, local recovery, desktop sticky windows sharing one live note model,
 monitor-layout recovery, single-instance activation, a notification-area
-lifecycle, optional per-user startup, and automated document/session tests.
+lifecycle, optional per-user startup, an optional bring-your-own-key assistant
+for OpenAI, Anthropic, and OpenRouter, and automated document/session tests.
+Normal editing remains offline; AI text is sent only after explicit **Send**.
 The native application is the implementation baseline.
 
 This describes source implementation, not public-release readiness. Signing,
@@ -209,9 +211,13 @@ Add features that make the app meaningfully easier to navigate:
 - tail/follow mode for live logs;
 - side-by-side text comparison;
 - a small, permissioned extension model;
-- optional local writing assistance provided as a separate extension.
+- optional local-model support, kept separate from the current remote
+  bring-your-own-key providers.
 
-AI is not a core dependency. If it is ever added, it must be optional, clearly indicate whether processing is local or remote, require an explicit provider choice, and never train on or upload text silently.
+AI is not a core dependency. The optional bring-your-own-key assistant keeps
+normal editing offline, names the selected remote provider and model, sends text
+only after an explicit **Send** action, and previews every proposed edit before
+replacement. Provider-side processing and retention remain the user's choice.
 
 ## 6. Explicit non-goals
 

diff --git a/README.md b/README.md
@@ -26,6 +26,10 @@ A sticky window and its full-editor tab share the same note model. Changes stay
 synchronized, and double-clicking the sticky header returns that note to the
 editor without creating a copy.
 
+The optional AI assistant can work with a selection or the full note using
+your own OpenAI, Anthropic, or OpenRouter API key. It always previews proposed
+edits and waits for you to approve a replacement.
+
 ## Highlights
 
 - **Plain-text fidelity** — opens and preserves UTF-8, UTF-8 BOM, UTF-16 LE/BE,
@@ -38,8 +42,11 @@ editor without creating a copy.
   in the full editor.
 - **Native Windows behavior** — single-instance activation, notification-area
   controls, close-to-tray behavior, printing, and optional per-user startup.
-- **Private by design** — no account, ads, analytics, telemetry, cloud service,
-  or network-client integration in the native editing path.
+- **Optional AI, under your control** — selection-aware rewriting, task
+  prioritization, code improvement, and quality checks with bring-your-own-key
+  providers and explicit preview/apply controls.
+- **Local by default** — no account, ads, analytics, telemetry, or required
+  cloud service; normal editing makes no network requests.
 
 ## Sticky to editor
 
@@ -77,6 +84,7 @@ Useful shortcuts:
 | Reopen closed tab | `Ctrl+Shift+T` |
 | Find / Replace / Go to line | `Ctrl+F` / `Ctrl+H` / `Ctrl+G` |
 | Move between major UI regions | `F6` |
+| Open AI assistant | `Ctrl+Shift+A` |
 
 ## Engineering highlights
 
@@ -86,7 +94,8 @@ Useful shortcuts:
 | Recovery | Local session snapshots for open tabs, unsaved content, sticky state, and window placement |
 | Shared note model | Editor tabs and sticky windows observe the same document state |
 | Desktop lifecycle | Single-instance handoff, tray lifecycle, startup registration, and visible-monitor placement recovery |
-| Verification | 21 document and recovery tests exercised through both the .NET 10 and compatibility build paths |
+| AI boundary | Fixed HTTPS provider contracts, protected local credentials, explicit send, stale-text checks, and preview-before-replace |
+| Verification | 49 document, recovery, provider-contract, privacy, cancellation, and stale-edit tests pass locally; public Windows CI exercises both .NET 10 and compatibility paths |
 | Release integrity | Portable packaging creates a ZIP, SHA-256 checksums, and a machine-verifiable release manifest |
 
 ## Architecture
@@ -96,8 +105,8 @@ most important behavior can be tested without constructing the WPF interface.
 
 | Component | Responsibility |
 |---|---|
-| [`native/src/Core`](native/src/Core) | Documents, encoding, atomic writes, recovery, recent files, and placement correction |
-| [`native/src/App`](native/src/App) | WPF editor shell, tabs, sticky windows, tray behavior, activation, and startup option |
+| [`native/src/Core`](native/src/Core) | Documents, recovery, provider contracts, prompt boundaries, protected-settings persistence, and safe writes |
+| [`native/src/App`](native/src/App) | WPF editor shell, sticky windows, AI settings/drawer, Windows credential protection, tray behavior, and activation |
 | [`native/tests`](native/tests) | Dependency-free document and recovery test harness |
 | [`native/benchmarks`](native/benchmarks) | Isolated 1 MiB, 10 MiB, and 100 MiB file-open measurements |
 | [`scripts`](scripts) | Portable/MSIX staging and release-integrity verification |
@@ -110,10 +119,10 @@ reconsidering WinUI 3, is recorded in
 
 | Surface | Verified now | Still pending |
 |---|---|---|
-| Build and tests | Windows CI builds the .NET 10 solution and compatibility path; 21 tests pass | Broader App/UI automation and coverage reporting |
+| Build and tests | Public Windows CI passes both build paths; the current compatibility build passes 49 document, recovery, provider-contract, privacy, cancellation, and stale-edit tests locally | Broader App/UI automation and coverage reporting |
 | Packaged workflows | Notes/Stickies separation, sticky-to-editor reopening, Save As, tray lifecycle, and single-instance reopening were manually smoke-tested in packaged builds | Full editor, multi-monitor, DPI, IME, and failure-injection matrix |
 | Artifact integrity | Portable ZIP, manifest, checksum generation, and independent verification are implemented | Signed executable, final installer identity, and durable public release |
-| Privacy | Source inspection found no account, advertising, analytics, telemetry, or native networking integration | Recorded runtime network-capture evidence |
+| Privacy | Normal editing remains offline; AI sends note text only after explicit Send, and API keys are protected for the Windows user | Provider-side retention/billing review and recorded runtime network-capture evidence |
 | Accessibility | Keyboard shortcuts and region navigation are implemented | Narrator, high contrast, focus, and 200% scaling certification |
 
 The complete, deliberately candid gate list is in

diff --git a/SECURITY.md b/SECURITY.md
@@ -36,10 +36,16 @@ Reports are especially useful when they involve:
 - loss, corruption, or unintended disclosure of note contents;
 - unsafe handling of files, paths, links, or imported content;
 - recovery data being exposed to another Windows user;
+- AI API keys being stored, logged, displayed, or disclosed without protection;
+- note text being sent to an AI provider without an explicit **Send** action;
+- provider errors or generated output exposing credentials or hidden app data;
 - command or code execution from untrusted note content;
 - persistence or startup behavior that occurs without clear consent;
 - update, packaging, or signature problems once those features exist.
 
-Normal editing is intended to work locally without an account or required
-network connection. A change that introduces network access must document its
-purpose and user control.
+Normal editing works locally without an account or required network connection.
+The optional AI assistant is a separate, explicit network boundary: provider
+endpoints are fixed, keys are protected for the Windows user, editor text is
+treated as untrusted prompt data, and no request is made until the user presses
+**Send**. Generated edits must remain previews until the user approves a
+replacement; they must never be executed as code by The Notepad.