From 5a1f665ded92f7634b18cc7baccad20937d221fe Mon Sep 17 00:00:00 2001
From: ghost <49853598+JSONbored@users.noreply.github.com>
Date: Mon, 1 Jun 2026 20:35:24 -0700
Subject: [PATCH] fix(docs): clarify MCP metadata upload boundary

---
 apps/gittensory-ui/src/routes/docs.beta-onboarding.tsx |  6 ++++--
 test/unit/docs-beta-onboarding.test.ts                 | 10 ++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/apps/gittensory-ui/src/routes/docs.beta-onboarding.tsx b/apps/gittensory-ui/src/routes/docs.beta-onboarding.tsx
index 0c57f545d0..e635f7ecd3 100644
--- a/apps/gittensory-ui/src/routes/docs.beta-onboarding.tsx
+++ b/apps/gittensory-ui/src/routes/docs.beta-onboarding.tsx
@@ -48,8 +48,10 @@ function BetaOnboarding() {
 
       <h2>Miner journey</h2>
       <p>
-        Miners and contributors use the local MCP package. Metadata stays on your machine; private
-        scoreability and blockers appear only in authenticated MCP/API responses.
+        Miners and contributors use the local MCP package. Source contents stay on your machine but
+        branch metadata (such as branch names, SHAs, changed file paths, commit messages, validation
+        details, labels, body text, linked issues, and scenario notes) is sent to authenticated
+        Gittensory MCP/API responses for analysis and packet preparation.
       </p>
       <ol>
         <li>
diff --git a/test/unit/docs-beta-onboarding.test.ts b/test/unit/docs-beta-onboarding.test.ts
index 3d84f7f40b..08b23e7a1d 100644
--- a/test/unit/docs-beta-onboarding.test.ts
+++ b/test/unit/docs-beta-onboarding.test.ts
@@ -9,6 +9,7 @@ const BETA_ONBOARDING_PATH = resolve(
 
 describe("docs beta onboarding page", () => {
   const source = readFileSync(BETA_ONBOARDING_PATH, "utf8");
+  const normalizedSource = source.replace(/\s+/g, " ");
 
   it("documents miner MCP flow through packet", () => {
     expect(source).toMatch(/gittensory-mcp login/);
@@ -18,6 +19,15 @@ describe("docs beta onboarding page", () => {
     expect(source).toMatch(/agent packet/);
   });
 
+  it("states the local MCP privacy boundary for source contents and uploaded branch metadata", () => {
+    expect(source).toMatch(/Source contents stay on your machine/);
+    expect(source).toMatch(/branch metadata/);
+    expect(source).toMatch(/changed file paths/);
+    expect(source).toMatch(/commit messages/);
+    expect(normalizedSource).toMatch(/authenticated Gittensory MCP\/API responses/);
+    expect(source).not.toMatch(/Metadata stays on your machine/);
+  });
+
   it("documents maintainer GitHub App setup, preview, and commands", () => {
     expect(source).toMatch(/GitHub App/);
     expect(source).toMatch(/settings-preview/);