A technical audit of trajectory harvesting and zero-data-retention boundaries.
How agentic coding vendors legally decouple the protected "Customer Data" from the human reasoning trace that produced it — and harvest the latter at industrial scale.
Our lane
We are technologists, not attorneys. We report two things only: what these systems capture, and what the vendors’ own terms literally say — both verifiable right here. What a court would make of any of it is a question for your counsel, not us. Nothing here is legal advice or creates an attorney-client relationship. Verify every claim in the Evidence Library →
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Cross-Vendor Convergence Matrix
Every major vendor converged on the same legal architecture in under 14 months.
Industry-wide standardization of trajectory harvesting. Even in “protected” environments, vendors systematically capture behavioral reasoning traces.
Vendor
Protected Customer Data
VENDOR-OWNED "USAGE DATA"
ZDR?
Key Trace Elements Captured
Windsurf
Cognition
Prompts + source code (excludes Usage Data §1.2)
Anonymized interaction manner; absolute title §3.3.2
No
Full multi-step planning timelines + every human accept/reject decision + post-suggestion edits and corrections
Cursor
Anysphere
Plaintext — only if Privacy Mode ON
Editor actions, embeddings, indexing metrics
No
How developers edit or reject AI suggestions + the semantic structure and relationships of their entire codebase (Levenshtein distance, semantic embeddings, repo maps)
Claude Code
Anthropic
Prompts, source code, outputs returned
Operational metrics + all /feedback & survey transcripts
No
Complete session transcripts + explicit human feedback/ratings + full Slack channel history and decision context
GitHub Copilot
Microsoft
Repo code + explicit chat prompts
Server-side metrics, LoC arrays, agent-mode logs
No
Detailed patterns of how developers modify suggestions + multi-file iterative reasoning flows across the repository
Replit
Private / Enterprise Repl code
OT timelines, diagnostic traces, execution patterns
No
Keystroke-by-keystroke repair behavior + error diagnosis paths + sequences that lead to passing tests
OpenAI
Enterprise / API
Protected endpoint payloads
De-identified & disassociated content
No
All "de-identified" interaction patterns + human corrections and verification loops
The core point: ZDR protects code, PII, etc. It does not protect the reasoning trace.
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
BROADER RECOGNITION · NOT JUST THE GROVE FOUNDATION OR ALEX KARP
The industry's own leaders name the same asymmetry.
"In the AI age, the buyer risks giving away knowledge, just in order to use what they bought… Models learn from ‘exhaust,’ the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong. Every correction is distilled into institutional know-how."
Satya Nadella · Microsoft CEO · "The Reverse Information Paradox" · July 12, 2026
Same asymmetry
Enterprises pay for intelligence while simultaneously feeding vendors the proprietary reasoning traces that make the models more powerful.
The prescription
A "real trust boundary" so organizations retain ownership of their traces, evals, memory, and institutional context.
Echoing Karp
Control over "compute, models, data stack, and alpha" — owning the means of production so learning isn't transferred to the vendor.
The Grove Foundationsnscratchpad.com/posts/reverse-information-paradox
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
WHAT CHANGED? THE DATA WALL & THE PIVOT TO TRAJECTORIES
From training on verified text to training Process Reward Models.
The Exhausted Substrate
High-quality training text is depleted. Training on unverified synthetic data — feeding the system its own output — triggers Model Autophagy Disorder (MAD): exponential perplexity degradation, erosion of minority distributions, and systemic homogenization within successive generations.
The New Premium Fuel
Process Reward Models (PRMs) require execution-feedback-enhanced trajectories: the step-by-step record of plan → execute → error → diagnose stack trace → adapt → pass test. This authentic "semantic resonance" cannot be synthesized in a vacuum without triggering autophagy — it must be harvested from real human operators.
Why This Matters for Custody
Traditional Outcome Reward Models evaluate the final output only. PRMs assign dense, stepwise mathematical rewards to every intermediate step. To train them, vendors need the full granular trajectory — not just the code, but the exact sequence of human corrections, error diagnostics, and verification loops. This is the cognitive trace now being extracted at industrial scale through agentic IDE telemetry pipelines.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Agentic IDEs as Cognitive Keyloggers
The agent harness / IDE has been re-engineered as a high-fidelity telemetry array.
Autonomous coding harnesses no longer function merely as productivity accelerators. They are structurally integrated arrays that capture the operational graphs and cognitive trajectories of enterprise knowledge workers — the exact reasoning paths needed to train next-generation PRMs.
Tab-accept and reject signals, post-accept edits, the Levenshtein distance between suggestion and shipped code, and developer_modified_ratio.
Diagnostic & execution loops
Terminal stack traces, LSP diagnostics, error-resolution timelines, and multi-step agent planning graphs captured via Operational Transformation.
Semantic & structural maps
Codebase embeddings, repository hierarchies, cryptographic file hashes, and in-situ context feeding the CSAP models.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Legal Bifurcation Architecture
How vendors redrew the data-custody boundary.
Legacy cloud terms treated "telemetry" as server uptime, crash reports, and infrastructure metrics; the interaction payload — code, plans, files — was protected user content. Agentic vendors surgically decoupled the two.
Customer Data
The protected bucket
→Literal prompts and source code
→Generated outputs returned to the user
→ZDR applies — "not saved to disk… deleted upon generation of Output"
→Vendor claims absolute title — "all right, title, and interest"
ZDR does NOT apply.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Cognition · Windsurf & Devin
The explicit custody ratchet — executed in plain view.
Platform Terms of Service · evolutionary audit April 2025 → June 30, 2026
"Cognition reserves the right to collect, analyze, and utilize Usage Data… Cognition owns all right, title, and interest in and to the Usage Data."
— Section 3.3.2, Cognition Platform ToS (June 30, 2026)
The legal triad that nullifies ZDR
§3.1User retains rights to Customer Data (prompts + generated source code).
§1.8ZDR defined — data "not saved to disk… deleted upon generation of the relevant Output."
§1.2Customer Data "expressly excludes Usage Data."
§1.7Usage Data = "anonymized and aggregated data regarding the manner… you interact with the Services."
§3.3.2Absolute ownership asserted over Usage Data.
Result: ZDR is legally valid — but applies only to the depreciating asset (raw text). The premium asset (the reasoning trace) is vendor property by contract.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
OpenAI · Enterprise & API
"De-identification" as an ownership-transfer mechanism.
A standing exemption removes any content already "de-identified and disassociated from your account" from the scope of deletion requests. Once a trajectory is stripped of regulated identifiers and reduced to an abstract interaction graph, it is relabeled as de-identified telemetry — and the enterprise's right to delete ceases.
"De-identified" is a database label — not a legal firewall. Once applied, the reasoning trace becomes vendor analytical property, outside deletion rights and ZDR scope.
NYT v. OpenAI · November 2025
A federal court ordered the preservation and production of approximately twenty million consumer ChatGPT logs — explicitly including conversations users believed they had permanently deleted.
Proven in open court: de-identified data retained on a vendor server is structurally preserved and legally reachable by subpoena — regardless of any UI deletion assurance.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Claude Code & GitHub Copilot
Operational logging that captures cognitive flow.
Anthropic · Claude Code
→Logs operational metrics from the local machine to Anthropic servers.
→Tracks "latency, reliability, and general usage patterns."
→In multi-step loops, patterns reveal how tasks are mapped, delegated, resolved.
→/feedback & Session Quality Surveys trigger full transcript upload — including proprietary code — to Google Cloud Storage.
→Feedback data retained up to 5 years; de-linked from user ID.
→Claude Tag in Slack passively absorbs channel history and decision context.
→Anthropic makes no ZDR gesture for Claude Tag at all: it "retains channel memory and session transcripts," so it "isn't available to organizations with Zero Data Retention (ZDR) enabled."
GitHub Copilot
→Server-side telemetry identifies users for engagement totals even when client-side telemetry is disabled by corporate policy.
→Captures detailed LoC metrics: loc_suggested_to_add_sum, loc_added_sum, loc_deleted_sum.
→Explicitly ties metrics to agentic features: chat_panel_agent_mode, agent_edit.
→In agentic modes, systematically tracks multi-file edits iteratively across the entire repository.
→Captures the full flow of logic across the repo ecosystem.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Cursor · Anysphere
The plaintext perishes, but a high-value, structural blueprint remains.
Data Use & Privacy Policy · last updated June 9, 2026
The bifurcation of physical custody
With Privacy Mode manually on, plaintext inputs get ZDR — chunks are uploaded to compute multi-dimensional embeddings, then deleted "as soon as the lifecycle of that indexing request is completed."
However: the resulting embeddings, exact file names, repository hierarchies and cryptographic hashes are permanently retained in Cursor's backend clusters. The enterprise shreds the paper copy; the vendor keeps the blueprints.
Why embeddings beat raw text
Embeddings preserve the mathematical topography of the architecture — semantic relationships, naming conventions, module dependencies, decision patterns — without literal syntax. This is the perfect PRM substrate: dense, contextual, and already de-identified.
By classifying the embedding as an "operational product of the service" rather than protected Customer Data, Cursor legally retains a perfect topological map — outside ZDR and deletion rights.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Receipts · A 14-Month Custody Ratchet
“We won’t train on your data” became “we own the map of how your company thinks.”
Apr 2025
Cognition
Training on customer data was opt-in only. Usage Data carried no ownership claim.
Prior terms — vendor archive
Oct 2025
Cursor
A “de-identify and keep” regime begins. Accounts after this cutoff fall under broader data-sharing terms.
cursor.com/data-use
May 2026
Cursor
Deletion stops at the plaintext. The delete button no longer reaches de-identified content.
cursor.com/data-use
Jun 9 2026
Cursor
Privacy Mode still retains embeddings — a permanent semantic map of your code’s structure and logic.
cursor.com/data-use
Jun 30 2026
Cognition
“Cognition owns all right, title, and interest” in Usage Data — including the reasoning trace itself. Not retained. Owned.
§ 3.3.2 — the endpoint
Five documented beats in fourteen months. Each one transferred more custody of how your company thinks from the enterprise to the vendor.
Every step is timestamped on the vendor’s own site — the April 2025 terms are still linked from the current page. Legal teams do not move this fast, in this direction, by accident.
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Trace Extractor Mechanics
Cognitive keyloggers: CSAP, Levenshtein & OT logging.
Code Suggestion Acceptance Prediction
Lightweight binary classifiers predict the likelihood of acceptance before ghost-text even renders. Trained on three dimensions:
·In-Situ Context — IDE version, preceding code semantic density.
~70% of suggestions are rejected → imbalanced data → a class-balanced weighted cross-entropy loss achieves 0.973 accuracy at labeling developer preferences. Post-accept, the harness computes the developer_modified_chars and developer_modified_ratio — mapping the enterprise's style without owning the files.
Intermediate Planning & LSP / OT Logging
Advanced tools (Windsurf Cascade, Replit agents, Copilot agent_edit) run multi-step reasoning loops. Vendors log the complete execution graph via OT timelines:
plan multi-file → execute bash → compiler error → read stack trace → adjust params → query LSP →rewrite function
PRMs require dense stepwise evaluation — so terminal stack traces, execution latency and raw LSP diagnostic logs route to the vendor backend under "diagnostic / analytical" clauses, classified as Usage Data, bypassing Customer-Data ZDR and capturing the exact cognitive path to resolution.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Logical Enforcement & Loopholes
Privacy modes, feedback overrides & poison pills.
Privacy-Mode Overrides
Cursor's Privacy Mode claims ZDR with inference providers. However:
→Unilateral right to run "Abuse & Violation Classifiers" on all data. If triggered, ZDR is silently suspended.
→Local / server caching routes all prompts through backend infrastructure (unless a legacy grandfathered account).
→Opaque, vendor-set algorithmic threshold for abuse triggers.
Feedback Override · "Thumbs-Up"
The most pervasive ZDR circumvention in the industry:
→/feedback or a UI rating uploads full conversation history — including proprietary code — to vendor GCS, bypassing standard retention.
→Retained 5 years (Anthropic) or 6 months (surveys); de-linked from user ID → Usage-Data bucket.
→A single thumbs-up from one junior dev voids org-level ZDR.
→Claude Tag in Slack amplifies: entire channel history becomes a 5-year training asset.
Poison Pills & Safety Mandates
→Windsurf: opting out of training on Free/Pro disables Chat & Cascade — reducing the tool to a legacy editor. Privacy requires an expensive Enterprise tier + months of DPA negotiation.
→No BAAs offered → incompatible with HIPAA / strict compliance.
→Q2 2026: Anthropic Fable 5 / Mythos 5 mandated 30-day minimum retention even on AWS Bedrock — voiding prior ZDR.
→June 12, 2026: a Commerce Dept. export control forced a global API shutdown — enterprises paralyzed without warning.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Actionable Defenses for Enterprise Compliance
Four structural, non-negotiable architectural defenses.
01
Redline "Usage Data" in DPAs
Expand Protected Customer Data to explicitly include CSAP metrics, Levenshtein edit distances, codebase embeddings, LSP diagnostics, OT timelines, and all multi-step agent interaction logs. Do not let them default to ambiguous telemetry carve-outs.
02
Nullify Feedback Overrides
Contractually bar individual actions (thumbs-up, /feedback) from overriding org-level ZDR — then enforce it technically with fleet-wide env vars:
For Bedrock / third-party inference, route all invocation logging — full request/response, terminal errors, token metrics — exclusively to customer-owned S3 / CloudWatch. The vendor inference environment must be structurally blind to execution logs.
04
Transition to Sovereign Architectures
Move from black-box APIs to open declarative standards (Linux Foundation AGENTS.md, Grove Autonomaton / GRV-001). Enforce "Digital Jidoka": agent memory, tools and telemetry live in Git-tracked, enterprise-owned repositories. Bits move; meaning stays put.
The Grove FoundationStructural Custody · Agentic AI Audit
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Version A · Narrative
The Convergence · GRV-001 · The Autonomaton Pattern
The industry is converging on the fix.
It stops one file short.
TODAY · VENDOR-RESIDENT TELEMETRY
Proprietary black box
Rules and everything the system learns live inside the vendor. You can't read them, can't move them, can't prove what happened.
→
The industry converges
AGENTS.md · .agents
Rules in version-controlled files. Portable, readable, yours. But a file is still an instruction — the model can ignore it, and the file learns nothing from being followed.
→
THE OPEN STANDARD · GRV-001
Structural sovereignty
The same declarative principle, but made architectural. Instructions become walls the model cannot reach around — and every turn deposits a labeled record you own.
Pipeline
Every action traces to a decision a human made. The audit trail isn't a report you run. It's a byproduct of the run — complete by construction, because no path through the system leaves without one.
Zone ModelThe agent can ask for more authority, but it cannot take it. A self-expanding write isn't a rule the system promises to follow. It's a sentence the system cannot form.
RouterThe cost curve bends down. Proven patterns ratchet from frontier spend to local deterministic compute. Usage rises; the bill falls. Model independent by design.
SubstrateEvery approval is a label. Every correction is a label. Owned by you, on your disk, untouchable by an update.
The Compounding AssetThe Autonomaton's telemetric spine means your API bill generates training assets and capabilities that you own instead of the vendor.
The hardest asset in enterprise AI isn't compute or model access. It's labeled, domain-specific data with a quality signal attached — the thing companies stand up annotation teams to manufacture.
In the Autonomaton it’s exhaust. Every approval is a label. Every correction is a label. Each one is attached to the reasoning trace that produced it, provenance-stamped, and written to a directory on your machine that a software update cannot reach.
Today that corpus drives routing and pattern promotion. Compiling it into local models that replace the metered calls is the next turn of the same crank — and the data is already in the right shape, because the architecture was designed for it from inception.
the-grove.ai/standards/001 · GRV-001 v2.0 · CC BY 4.0
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Version B · Ledger
The Convergence · GRV-001 · The Autonomaton Pattern
The industry is converging on the fix.
It stops one file short.
Today · Claude Tag
Proprietary black box
Rules and memory live inside the vendor. You can’t read them, can’t move them, can’t prove what happened.
→
The industry converges
AGENTS.md · .agents
Rules and memory in version-controlled files. Portable, readable, yours — but still just an instruction.
→
The standard · GRV-001
Structural sovereignty
The same principle, made architectural — behavior the architecture guarantees, plus a record you own.
AGENTS.md
The Autonomaton
Portability
✓ Your file, your repo
✓ Same file, plus your telemetry and skills
Enforcement
— The model may ignore it
✓ The dispatcher owns the run; the model cannot reach state
Cost trajectory
— Flat — every turn is a frontier call
✓ Ratchets down: T3 → T0 as patterns confirm
Accumulation
— A file learns nothing
✓ Every approval is a labeled training example you own
A file you own is table stakes. A system that cannot exceed it — and a record that grows more valuable every time you use it — that’s the standard.
the-grove.ai/standards/001 · GRV-001 v2.0 · CC BY 4.0
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Trace, Made Legible · Grove Autonomaton — Operator Portal
What a reasoning trace looks like when you own the telemetry.
The same signal the vendors bank as Usage Data, running inside operator-owned software. The model-independent agentic system (autonomaton harness) clustered ten memory records around an emergent theme, checked them against its tracked goals, found none, and proposed a precise amendment to its own goal file — in this case, evidence-linked and staged for human review and approval by design.
The chain, made auditable
01
Raw memory
Ten records accrue in the substrate — each timestamped and addressable by ID.
02
Pattern detection
The system names an emergent cluster: Platform Independence.
03
Gap analysis
It checks its tracked goals and reports the finding: “No Dock goal tracks this.”
04
Structured proposal
It emits a machine-readable diff to its own goal file — staged, not self-applied, pending operator approval.
Four such clusters surfaced from overlapping memory on a single day — the system reasoning about its own strategic focus, in the open.
The vendor keeps this as opaque telemetry. The autonomaton hands the operator the whole chain — evidence, reasoning, and a veto.
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Core Finding
Vendors are legally harvesting the cognitive trace — while you pay them to do it.
By classifying the outcome-verified reasoning trace — every accepted completion, every manually edited variable, every terminal-error correction — as "de-identified telemetry" or "usage metrics," vendors legally sidestep ZDR pledges. ZDR stays valid for raw text, which is now a depreciating asset. The premium resource for PRMs is the interactive logic path itself.
Enterprises are paying premium subscriptions to fund the automation of their own proprietary judgment.
The Polarity Hypothesis
Raw data (bits) is unipolar — it moves frictionlessly. Meaning, context and intent are multipolar — they depend on localized context and human agency. Harvesting interaction telemetry is the systematic capture of that agency.
Deployment concentration · HHI
4,100→1,705
A single-quarter collapse from monopolistic to competitive — a volume-driven migration toward sovereign, multi-model, open-weight architectures.
Read the fine print. Then change your architecture.
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
State of the Architecture · OpenRouter
The open surge — a volume takeover.
Chinese Open-Weight Share of U.S.-Company Tokens · Weekly
DeepSeek, Qwen, Z.ai & peers
A rounding error two years ago; roughly half of some weeks’ volume now. Enterprises are voting with volume for a sovereign, multi-model stack — where the trace never leaves the building.
Source: CNBC / OpenRouter · July 7, 2026
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
The Telemetry Trap · Output API Pricing
The price floor drops.
Cost per 1M Output Tokens · June 2026
The Dependency Profile
GPT-5.6 Sol
$30.00
Claude Opus 4.8
$25.00
Gemini 3.1 Pro
$12.00
The Sovereignty Profile
GLM-5.2
$4.40
Qwen 3.7 Max
$3.75
DeepSeek V4 Flash
$0.28
Independently confirmed: open Chinese models run 60–90% cheaper than leading US models, and GLM-5.2 landed within one point of Claude Opus 4.8 on a watched agentic benchmark — at roughly a fifth of the cost. The frontier premium buys months, not moats.
~107× spread
Our lane — technologists, not attorneys. Nothing here is legal advice or creates an attorney-client relationship.
Sources & Verification · July 13, 2026
Every claim traces to a primary source.
01Custody Inversion 2 — foundational legal / technical analysis of trajectory harvesting and ZDR boundaries.
02Agentic AI Trajectory Data Research.
03The Polarity Hypothesis: Why Bits Move and Meaning Doesn't.
04receipts-dossier-press.md — Cognition ToS evolution.
05Cursor · Data Use & Privacy Overview — cursor.com/data-use (Jul 13, 2026).