Reviewing developer text before it leaves the Mac.

THE WORK

The project.

Omitto is a macOS utility for reviewing developer text before sharing it. Its redaction engine replaces selected sensitive spans while leaving the surrounding document intact, so logs and configuration snippets can retain the structure that makes them useful. The app shows findings for review, supports explicit Keep decisions and manual phrases, and copies the result only when requested.

That review depends on the screen showing the result of the current text. The app sends a captured input and policy to RedactionCore in a detached task, then checks the generation, input and cancellation state before accepting the result back into SwiftUI. Editing clears the old analysis, and copying is unavailable during a scan.

RedactionCore is the linked Foundation-only package that selects spans and allocates replacements. Omitto owns the surrounding work: task lifetime, review state and clipboard export. Optional delayed clipboard clearing checks that the pasteboard has not changed since the copy, so a later item is left alone.

ATTEMPTS & CORRECTIONS

What changed along the way.

1. 01Moving the scan without losing track of its result18 June 2026

   At first

   The view model originally built the line map and ran redaction synchronously in its main-actor method, then assigned the result straight to observable UI state.

   What needed to change

   Document scanning occupied the actor responsible for the interface. Moving it into a background task introduced another responsibility: a scan could finish after the input changed or a newer request began.

   The change

   The June 18 pass captured text and policy, used a detached task and added a generation check before publishing on the main actor. Copying was disabled during processing. The current implementation additionally checks that the captured input still matches.

   The result

   The UI method no longer performs the scan synchronously, and obsolete completions are rejected before display. The development record withholds a speed multiplier without profiling; cancellation still does not interrupt the synchronous detector immediately.

2. 02Checking the history a source release would expose14 July 2026

   At first

   The first publication preflight checked current files and the branch and tag history known locally. Rewriting those branches changed the metadata visible through them.

   What needed to change

   The July audit found older personal metadata behind a GitHub-managed pull-request reference. The rewritten branches did not cover everything that could still be reached, so a clean checkout could not settle the publication decision.

   The change

   The preflight was expanded to discover advertised remote branches, tags and pull-request heads and walk their commits. It checks author and committer metadata, commit text, annotated tags, secret patterns and sensitive filenames. A follow-up requires a clean checkout matching its remote branch and suppresses sensitive values in failure output.

   The result

   The July record kept publication on hold while that history remained. The script examines the wider history without changing repository visibility. The commits and script were inspected for this account, but the remote audit was not rerun and today's publication state was not established.

IMPLEMENTATION

Design choices.

1. RedactionCore stays synchronous and independent of SwiftUI; Omitto supplies background scheduling. This keeps text-processing behavior testable on its own while leaving task lifetime with the interface that started the work.
2. The app checks generation and input identity as well as cancellation before publishing. Cancelling a task cannot immediately stop this synchronous detector, so acceptance of a completed result needs its own checks.
3. Editing clears the previous review instead of leaving old output ready to copy. That requires another scan, but makes the relationship between source and result visible rather than relying on someone to notice stale content.
4. Optional clipboard clearing is limited to the copied item identified by its change count. It avoids removing later clipboard content without claiming to erase clipboard history, process memory or copies made elsewhere.

HOW IT FITS TOGETHER

Architecture.

• The main-actor session view model owns input, findings, output and review state. Starting a scan captures the current text and policy under a new generation number, giving its eventual result an identity the interface can check.
• A detached task builds the source line map and calls RedactionCore's synchronous value API. The package works on UTF-16 spans without importing the app's UI, persistence or clipboard services.
• Completion returns to the main actor and publishes only when the generation and captured input still match and the task is not cancelled. Work from an older scan can finish without replacing a newer result.
• An input edit invalidates output, findings, report, line map and Keep selections. Copy is disabled while redaction is running, so an earlier analysis is not presented as an export of the new text.
• ClipboardService handles explicit copying and an optional delayed clear. The delayed action compares the pasteboard change count with the copy it owns before removing anything.

SELECTED DEVELOPMENT RECORD

Engineering changes.

Implementation dates come from project records. “Recorded” is the date this portfolio entry was written.

1. Separating the scan from the interfacechangedRecorded 11 September 2026

   The June change moved redaction into a detached task and checked its generation before display. The synchronous detector can continue after cancellation; no measured speed improvement is claimed.

   Source observedChanged 18 June 2026

CHECKS & RESULTS

What was checked.

A source review shows what the code does. It is not a fresh test of the running app.

1. Code and development records reviewedReviewed11 September 2026

   The code, tests and available development records were checked. Reported test results keep their original scope. No fresh app or live deployment check was run for this write-up.

   Scope of this check

   Code review, not a fresh run of the app