Public Trust Boundary
WaitSpin measures wait-state ad visibility, not developer work. The public client surfaces only fetch a sponsored line for a registered install, display it in the supported wait-state surface, and report an impression after the visible interval.
Public user surfaces: VS Code (status-bar-fallback), Claude Code (claude-code), MiMo Code (mimocode), OpenCode (opencode), Grok Code CLI (grok).
Never Sent By The Public Clients
- workspace files
- source code
- open editor text
- prompts
- model responses
- integrated terminal output
- shell history
- repository URLs
- screenshots
- clipboard contents
- raw keystrokes
Operational Payloads
- user install registration: {install_id,target}
- serve polling: {install_id}
- impression event: {serve_id,serve_receipt,install_id,visible_ms}
- standard network metadata used for rate limits, fraud controls, abuse response, and audit logs
WaitSpin has no separate analytics telemetry stream in the public clients. Serve, impression, wallet, and accounting events are operational telemetry needed to run the marketplace.
VS Code Extension Provenance
The VS Code extension is installed from the Visual Studio Marketplace. WaitSpin publishes the client source at github.com/citedy/waitspin and publishes a machine-readable provenance manifest at /provenance/waitspin-vscode.json. The repository does not track VSIX binaries; release automation packages them and records the SHA256 in the manifest.
Published version: v0.1.12. Provenance version: v0.1.12. State: published. Live Marketplace status is published at /status/waitspin-vscode-marketplace.json.
Client Privacy Boundary
The VS Code extension connects a user install inside VS Code, stores the extension API key in VS Code SecretStorage, stores the install ID in user-scoped extension state, polls the WaitSpin API for a sponsored line, opens advertiser links only after user action, and reports a billable impression after the required visible interval. It does not read workspace files, open editor text, prompts, model responses, integrated terminal output, shell history, repository URLs, or source code.
Supported Public Surfaces
- VS Code:
status-bar-fallback. Uses VS Code SecretStorage for the extension API key and user-scoped extension state for the install ID. The Marketplace extension provides an Activity Bar user view, status-bar mini state, wallet balance, pending balance, recent ledger entries, current sponsor card, no-inventory state, connect/polling/refresh/open commands, and a five-second visible impression hold. - :
claude-code. Inspects user/scoped Claude settings, manages statusLine.command with --compose-existing support, and stores WaitSpin state/cache under ~/.waitspin. - :
mimocode. Installs a managed runtime under ~/.local/bin, adds a bash hook in ~/.bashrc, and stores WaitSpin state/cache under ~/.waitspin. - :
opencode. Installs a plugin under ~/.config/opencode/plugins, manages the tui.json plugin entry, and stores WaitSpin state/cache under ~/.waitspin. - :
grok. Uses a managed text-asset footer patch with hash-backed backup/restore plus managed runtime/cache/state; it does not patch native binaries.
The current public user earning surfaces are the VS Code Marketplace Activity Bar/status-bar extension, Claude Code statusline command, MiMo Code shell hook, OpenCode TUI plugin slot, and Grok Code CLI footer. Native spinner patching beyond these supported status surfaces remains outside the public contract until separately shipped and documented.
What Stays Private
The public trust repository is scoped to client code, public docs, public contracts, provenance, and trust-boundary tests. These systems stay private:
- hosted backend implementation
- receipt signing internals
- fraud thresholds and risk scoring
- campaign ranking and allocation logic
- billing/accounting internals
- payout execution controls
- database schema and migrations
- deployment, monitoring, and operator scripts