What
Inductive mode and Draft with Director (app/js/screens/constructs.js) silently operate on the project's first corpus — they read project.corpora[0] with no picker, and the inductive route defaults body.corpusId ?? project.corpora[0].id.
Impact
If the first corpus is an unmasked (scan) import — which you can't delete (see related issue) — these buttons send unmasked text to the model with no way to choose a pseudonymized corpus instead. A real PII hazard on sensitive data.
Fix
Add a corpus picker to inductive/draft (the Corpus Brief already takes an explicit corpus); don't silently default to [0].
What
Inductive mode and Draft with Director (
app/js/screens/constructs.js) silently operate on the project's first corpus — they readproject.corpora[0]with no picker, and the inductive route defaultsbody.corpusId ?? project.corpora[0].id.Impact
If the first corpus is an unmasked (
scan) import — which you can't delete (see related issue) — these buttons send unmasked text to the model with no way to choose a pseudonymized corpus instead. A real PII hazard on sensitive data.Fix
Add a corpus picker to inductive/draft (the Corpus Brief already takes an explicit corpus); don't silently default to
[0].