Key points
- The daemons knowledgeconstructiond and intelligenceplatformd maintain a local knowledge graph about the Mac owner and their social circle.
- The IntelligencePlatform directory contains 51 SQLite databases, while graph.db uses a vocabulary of 181 classes and 278 predicates.
- Two XGBoost classifiers evaluate 144 features, including message recipients and photo co-occurrence by day and hour; 15 additional relationship fields are populated by an unidentified mechanism.
Context
This reverse-engineering case demonstrates how an undocumented platform subsystem can accumulate detailed relationship metadata without its internal mechanism being clearly explained. For those working on mature systems, it underscores why hidden databases and background services should be considered in legacy and architecture reviews.
What this means for you
Already in effect
For you, the findings provide a concrete example of how opaque local services can turn routine interaction data into detailed relationship profiles.
Who benefits: Developers and technical decision-makers benefit when auditing hidden data flows and unexplained behavior in long-lived desktop systems.
Share article: