# Apple Intelligence／オンデバイスAI編 — Apple Intelligence、Foundation Models、Private Cloud Compute、App Intents、Core ML/Vision、MLXを「AppleのAI」という一枚岩ではなく、実行場所・開発者API・privacy boundary・action integration・古典ML/研究基盤に分解する運用地図

CURRENT_STATUS: CURRENT
OBSERVATION: SPEC_ONLY
FRESHNESS: CURRENT
PAGE_TYPE: reference
CANONICAL_URL: /tools/ea-003-apple-intelligence-ai-apple-intelligence-foundation-models-priva
CLAIM_IDS: none
EVIDENCE_IDS: EVD-EA-003-URL-3CDACFF5B0A4, EVD-EA-003-URL-38224A43ADDB, EVD-EA-003-URL-A9040D77A1A5, EVD-EA-003-URL-8E776CE68660, EVD-EA-003-URL-10331F7D0502, EVD-EA-003-URL-382FCE686EA4, EVD-EA-003-URL-E5F9F1A2D68E, EVD-EA-003-URL-C67550158947, EVD-EA-003-URL-A2367F06CC3F, EVD-EA-003-URL-9339E68604E6, EVD-EA-003-URL-E828CA2FC351, EVD-EA-003-URL-64E32B08CA20, EVD-EA-003-URL-3304AC5B21FD, EVD-EA-003-URL-B18A6FB55337, EVD-EA-003-URL-CFE278A17EB9, EVD-EA-003-URL-6CA0832C5363, EVD-EA-003-URL-ED47E39F6B56, EVD-EA-003-URL-8C07BEF96A57, EVD-EA-003-URL-7F293D180425, EVD-EA-003-URL-1F776F7D5ADD, EVD-EA-003-URL-3FA5DC0BE21E, EVD-EA-003-URL-4C2D3EBD05A5, EVD-EA-003-URL-CAB17908F3F5, EVD-EA-003-URL-1807935EFBF0, EVD-EA-003-URL-729CC5783133, EA-003-CURRENT-APPROVAL, EA-003-CURRENT-BODY-READBACK
UNKNOWN_IDS: EA-003-UNKNOWN-01, EA-003-UNKNOWN-02, EA-003-UNKNOWN-03
OPS_IDS: none

## Summary
「AppleのAI運用は『オンデバイスかクラウドか』の二択では捉えにくい。Apple Intelligenceには端末上で動くFoundation Modelと、より大きな処理をPrivate Cloud Computeへ送る経路があり、2026年のFoundation Models frameworkはさらに他のモデル提供者を共通APIへ接続できる。Private Cloud Computeは通常のクラウド推論とは異なるstateless処理・attestation・software transparencyを設計しているが、これはすべてのApple AI機能や外部モデルに自動適用される保証ではない。Core ML、Vision、MLX、App Intentsも同じApple系統に見えるが、それぞれmodel実行、画像等のdomain ML、研究用ML基盤、app action統合という別の役割と信頼境界を持つ。法人運用では、実行場所、モデル提供者、device/OS/region、管理制限、network/quota、action権限を分けて確認する。」

## Current judgment
EA-003は高い採用価値がある。ただし章名の「オンデバイスAI」は全体の同義語ではなく、一つの実行planeとして扱うべきである。2026年時点の安全な系統は少なくとも次の七面に分かれる。
A. Apple Intelligence experience plane: OS統合されたuser-facing intelligence。実処理が常にdevice内に閉じるとは限らず、on-device/PCC/external integrationのroutingを別途見る。
B. On-device Foundation Model plane: SystemLanguageModel。Foundation Models APIから利用し、offline可能、device/region/model-ready gateを持つ。OS updateでmodel versionが変わるため、prompt/evaluationはOS/model世代を記録する。
C. Private Cloud Compute plane: PrivateCloudComputeLanguageModelおよびApple Intelligenceのserver inference。network、device/region、managed entitlement、daily quota等のgateがあり、on-deviceより大きなcontext/reasoningを提供する。privacy/securityはstateless processing、no privileged runtime access、attestation、public software transparencyを組み合わせた別trust boundary。
D. App action/context plane: App Intents/App Entity/App Schema。modelそのものではなく、AI/Siriがappのaction/contentへ到達するためのtyped integration boundary。
E. Classical on-device ML plane: Core ML + Vision/Natural Language/Speech/Sound Analysis等。custom modelをdevice上で扱う独立基盤。
F. ML research/local model plane: MLX。Apple ML research由来のOSS frameworkで、研究・training・local inference用。Apple Intelligence/PCCのmanaged privacy boundaryを自動的には持たない。
G. External/provider interoperability plane: Foundation ModelsのLanguageModel protocol、external intelligence integrations等。2026年のApple AI developer surfaceはApple純正modelだけの閉鎖系ではない。

## Scope
Enterprise AI Core: local-first inference、cloud escalation、privacy boundary、availability/fallback、model/version drift、tool/action boundary、evaluation。
Provider mapping: Apple Intelligence / Apple Foundation Models / Private Cloud Compute / App Intents / Core ML / Vision。
Implementation/non-LLM component: Core ML、Vision、MLX。
Interoperability: Foundation Models LanguageModel protocol、App Intents、外部intelligence integrations。
Organization overlay: MDM restrictions、supported device/OS/language/region、PCC managed entitlement、external intelligence integration policy。

## Confirmed
- EA-003は高い採用価値がある。ただし章名の「オンデバイスAI」は全体の同義語ではなく、一つの実行planeとして扱うべきである。2026年時点の安全な系統は少なくとも次の七面に分かれる。
A. Apple Intelligence experience plane: OS統合されたuser-facing intelligence。実処理が常にdevice内に閉じるとは限らず、on-device/PCC/external integrationのroutingを別途見る。
B. On-device Foundation Model plane: SystemLanguageModel。Foundation Models APIから利用し、offline可能、device/region/model-ready gateを持つ。OS updateでmodel versionが変わるため、prompt/evaluationはOS/model世代を記録する。
C. Private Cloud Compute plane: PrivateCloudComputeLanguageModelおよびApple Intelligenceのserver inference。network、device/region、managed entitlement、daily quota等のgateがあり、on-deviceより大きなcontext/reasoningを提供する。privacy/securityはstateless processing、no privileged runtime access、attestation、public software transparencyを組み合わせた別trust boundary。
D. App action/context plane: App Intents/App Entity/App Schema。modelそのものではなく、AI/Siriがappのaction/contentへ到達するためのtyped integration boundary。
E. Classical on-device ML plane: Core ML + Vision/Natural Language/Speech/Sound Analysis等。custom modelをdevice上で扱う独立基盤。
F. ML research/local model plane: MLX。Apple ML research由来のOSS frameworkで、研究・training・local inference用。Apple Intelligence/PCCのmanaged privacy boundaryを自動的には持たない。
G. External/provider interoperability plane: Foundation ModelsのLanguageModel protocol、external intelligence integrations等。2026年のApple AI developer surfaceはApple純正modelだけの閉鎖系ではない。


最重要の修正点は「on-device vs cloud」の二値では不足することである。同じFoundation Models framework内でもon-device Apple model、PCC Apple server model、任意provider modelが同じsession abstractionへ接続可能になっている。API surfaceの共通性とtrust/data boundaryの共通性を混同してはならない。
- ESTABLISHED: “Apple Intelligence = on-device only” remains unsafe wording. Current Apple documentation explicitly distinguishes on-device SystemLanguageModel and server-side PrivateCloudComputeLanguageModel.
- ESTABLISHED: A common Foundation Models session/API surface does not collapse trust/data/runtime boundaries. LanguageModel can bridge different local or server models.
- ESTABLISHED: The on-device system model is OS-generation dependent. Current Apple documentation explicitly tells developers to retest prompts after the iOS/iPadOS/macOS/visionOS 27 model change.
- ESTABLISHED: PCC has availability/eligibility/network/usage-limit gates and is not interchangeable with offline SystemLanguageModel merely because both fit LanguageModelSession.
- ESTABLISHED: Enterprise/managed-device controls for external intelligence are a separate organization overlay. Supervision, enrollment, integration sign-in and workspace restrictions can change effective availability.
- LIMIT: Apple’s PCC privacy/security claims and developer API description do not by themselves prove a tenant-specific enterprise audit trail, independent reproducibility of every production image, or equivalent privacy properties for third-party model providers.

## UNKNOWN
- EA-003-UNKNOWN-01: / STOP_CONDITION
- EA-003-UNKNOWN-02: - 2026-09-11時点のPrivateCloudComputeLanguageModel managed entitlement eligibilityの具体審査条件とorganization distribution条件。
- PCC daily quotaの具体値、iCloud+ tierごとの差、enterprise/managed accountでの扱い。
- Foundation Models LanguageModel protocolのthird-party package別data path、provider terms、enterprise administration。
- Apple Intelligence各featureがon-device/PCC/external modelのどれへrouteされるかの完全matrix。
- Apple Platform Deploymentにおける各Apple Intelligence restrictionの最新supervision requirementとOS 27での変更。
- Dittmar et al.が各PCC security claimをどこまで実測確認できたかの本文レベルmapping。
- production PCC transparency log/imageの継続availabilityと、researcher toolchainのcurrent version。
- SystemLanguageModel/PCCの企業アプリ内利用に関するtelemetry/audit/retention設計の全仕様。
- 2026年Apple Foundation ModelsとGoogle/Gemini collaborationのmodel supply/training/runtime境界。
- MLXのcurrent backend/platform roadmapとApple Intelligence内部利用の有無。公開根拠なしに内部利用を推測しない。
- EA-003-UNKNOWN-03: - tenant/organizationごとのPCC managed entitlement条件と実効quota
- third-party LanguageModel packageごとのdata path, terms, auth, billing, admin controls
- Apple Intelligence各featureの完全な runtime-routing matrix
- enterprise tenant audit/retention semantics across SystemLanguageModel/PCC/external providers
- independent verification coverage of current PCC production generations

RESEARCH_GATE:
PASS_FOR_BOUNDED_BASE_REVISION — canonical packet already contains exact topic/questions, claim-level evidence, independent/official counterevidence, scope boundaries, failure envelope, availability gates, security/privacy/audit/cost/operability, SAFE_WORDING, OPEN_UNKNOWN and STOP_CONDITION. Currentness was rechecked on 2026-10-11 with current Apple primary documentation. No claim is made that an independent content audit has passed.

CANDIDATE_IMPLEMENTATION_OVERLAY:

## Evidence
- EVD-EA-003-URL-3CDACFF5B0A4 (RESEARCH): author/org: Apple — https://developer.apple.com/apple-intelligence/
- EVD-EA-003-URL-38224A43ADDB (RESEARCH): author/org: Apple — https://developer.apple.com/documentation/updates/foundationmodels
- EVD-EA-003-URL-A9040D77A1A5 (RESEARCH): author/org: Apple — https://developer.apple.com/documentation/foundationmodels/systemlanguagemodel
- EVD-EA-003-URL-8E776CE68660 (RESEARCH): author/org: Apple — https://developer.apple.com/documentation/FoundationModels/adding-server-side-intelligence-with-private-cloud-compute/
- EVD-EA-003-URL-10331F7D0502 (RESEARCH): author/org: Apple — https://developer.apple.com/documentation/FoundationModels/PrivateCloudComputeLanguageModel
- EVD-EA-003-URL-382FCE686EA4 (RESEARCH): https://security.apple.com/documentation/private-cloud-compute/ — https://security.apple.com/documentation/private-cloud-compute/
- EVD-EA-003-URL-E5F9F1A2D68E (RESEARCH): https://security.apple.com/documentation/private-cloud-compute/corerequirements — https://security.apple.com/documentation/private-cloud-compute/corerequirements
- EVD-EA-003-URL-C67550158947 (RESEARCH): https://security.apple.com/documentation/private-cloud-compute/noprivilegedaccess — https://security.apple.com/documentation/private-cloud-compute/noprivilegedaccess
- EVD-EA-003-URL-A2367F06CC3F (RESEARCH): https://security.apple.com/documentation/private-cloud-compute/hardwarerootoftrust — https://security.apple.com/documentation/private-cloud-compute/hardwarerootoftrust
- EVD-EA-003-URL-9339E68604E6 (RESEARCH): https://security.apple.com/documentation/private-cloud-compute/verifiabletransparency — https://security.apple.com/documentation/private-cloud-compute/verifiabletransparency
- EVD-EA-003-URL-E828CA2FC351 (RESEARCH): author/org: Apple Security Engineering and Architecture / User Privacy / Core OS / Services Engineering / AIML — https://security.apple.com/blog/private-cloud-compute/
- EVD-EA-003-URL-64E32B08CA20 (RESEARCH): author: Yannik Dittmar, Marvin Jerome Stephan, Thomas Völkl, Matthias Hollick, Jiska Classen — https://arxiv.org/abs/2605.24239
- EVD-EA-003-URL-3304AC5B21FD (RESEARCH): https://support.apple.com/guide/deployment/review-device-management-restrictions-dep739685973/web — https://support.apple.com/guide/deployment/review-device-management-restrictions-dep739685973/web
- EVD-EA-003-URL-B18A6FB55337 (RESEARCH): https://support.apple.com/en-euro/guide/deployment/dep6b5ae23e9/web — https://support.apple.com/en-euro/guide/deployment/dep6b5ae23e9/web
- EVD-EA-003-URL-CFE278A17EB9 (RESEARCH): author/org: Apple Support — https://support.apple.com/121115
- EVD-EA-003-URL-6CA0832C5363 (RESEARCH): https://developer.apple.com/documentation/appintents/appintent — https://developer.apple.com/documentation/appintents/appintent
- EVD-EA-003-URL-ED47E39F6B56 (RESEARCH): https://developer.apple.com/documentation/updates/appintents — https://developer.apple.com/documentation/updates/appintents
- EVD-EA-003-URL-8C07BEF96A57 (RESEARCH): https://developer.apple.com/documentation/appintents/providing-contextual-cues-to-apple-intelligence-and-siri — https://developer.apple.com/documentation/appintents/providing-contextual-cues-to-apple-intelligence-and-siri
- EVD-EA-003-URL-7F293D180425 (RESEARCH): author/org: Apple — https://developer.apple.com/documentation/coreml
- EVD-EA-003-URL-1F776F7D5ADD (RESEARCH): author/org: Apple Machine Learning Research / ml-explore — https://github.com/ml-explore/mlx
- EVD-EA-003-URL-3FA5DC0BE21E (RESEARCH): author/org: Apple — https://www.apple.com/newsroom/2026/06/apple-intelligence-brings-powerful-ai-capabilities-into-everyday-experiences/
- EVD-EA-003-URL-4C2D3EBD05A5 (RESEARCH): - Apple Developer, “Foundation Models updates”, current June 2026 update, accessed 2026-10-11: iOS/iPadOS/macOS/visionOS 27 changes the on-device SystemLanguageModel and Apple expl — https://developer.apple.com/documentation/Updates/FoundationModels
- EVD-EA-003-URL-CAB17908F3F5 (RESEARCH): - Apple Developer, “Adding server-side intelligence with Private Cloud Compute”, accessed 2026-10-11: SystemLanguageModel and PCC share a session API but differ materially in offli — https://developer.apple.com/documentation/foundationmodels/adding-server-side-intelligence-with-private-cloud-compute
- EVD-EA-003-URL-1807935EFBF0 (RESEARCH): - Apple Developer WWDC26, “What’s new in the Foundation Models framework”, accessed 2026-10-11: Apple documents PCC, LanguageModel abstraction, Core AI/MLX local paths and partner- — https://developer.apple.com/videos/play/wwdc2026/241/
- EVD-EA-003-URL-729CC5783133 (RESEARCH): - Apple Support, “External intelligence declarative configuration for Apple devices”, accessed 2026-10-11: supervised managed devices can restrict external intelligence integration — https://support.apple.com/en-euro/guide/deployment/depedd7d23ef/1/web/1.0
- EA-003-CURRENT-APPROVAL (RESEARCH): 現行本文の監査・revision対応
- EA-003-CURRENT-BODY-READBACK (IMPL): 現行本文の収録照合

## Failure / limits
「Apple Intelligence＝すべてオンデバイス」は誤り。PCCへのcloud escalationがあり、2026年はdeveloperもPCC modelへ公式アクセスできる。
## Failure / limits
「PCC＝通常cloud APIと同じ」も誤り。Apple設計上はstatelessness、no privileged runtime access、attestation、transparency log等の追加security architectureを持つ。
## Failure / limits
ただし「PCC＝完全にopen/reproducible」は言えない。独立研究はreproducible builds/symbols/model interface opennessに限界を指摘する。Appleのarchitecture claimと独立検証可能性を分離する。
## Failure / limits
「Foundation Models＝Apple model専用」は2026年には誤り。LanguageModel protocolでserver/on-deviceの他provider packageを扱える。
## Failure / limits
「Core ML/MLX＝Apple Intelligence」ではない。前者はmodel integration/runtime、後者はML research frameworkで、Apple IntelligenceのOS-level privacy/governanceを自動継承しない。
## Failure / limits
App Intentsはmodel capabilityそのものではない。action/semantic schemaのintegration layer。
## Failure / limits
On-device modelはOS updateでversionが変わる。prompt/testを一度通したから将来OSでも同じbehaviorとは保証できない。
## Failure / limits
PCCはnetwork/availability/quota/entitlement failureを持つ。公式にon-device fallbackが案内されるため、production appではcloud availabilityを前提条件にしない。
## Failure / limits
Apple Intelligence feature availabilityはdevice、OS、language、regionで差があり、MDMが一部機能/外部integrationを無効化できる。
## Failure / limits
2026年発表にはGoogle/Gemini collaborationが明記されるため、「Apple stackは全モデルをApple単独開発」と固定しない。
## Failure / limits
EA-003の更新章に必要なtopology、on-device/PCC/external-provider境界、PCC security claimと独立検証限界、App Intents/Core ML/MLXの別役割、hardware/OS/region/MDM/quota/model-version gateまで一次資料と独立研究で確立した。PCC developer APIとOS 27世代は変動が速く、具体quota/entitlement/feature routingを今固定するとPRODUCT_VOLATILE化が早い。今回はEA-003をbounded closeし、次の未調査最小番号EA-004「非LLM AI総合編」へ送る。
## Failure / limits
The canonical packet’s existing counterevidence and independent-research limits remain controlling. This supplement does not promote Apple architecture claims into proof of universal third-party-provider behavior, enterprise tenant audit completeness, or deployment conformance. Current Apple documentation strengthens rather than removes the packet’s model-version, region, network, managed-entitlement, MDM and external-provider gates.
## Practice
Apple Intelligence user plane: compatible hardware、OS version、device/Siri language、model download/storage、region、feature-specific rollout、user enablement。
SystemLanguageModel: Apple Intelligence capable device、region、model ready/download状態、OS/model generation、supported locale。
PCC developer model: iOS/macOS/watchOS/visionOS 27+、Apple Intelligence capable device/region、network、managed entitlement、service readiness、daily quota、iCloud+ quota path。
App Intents: OS/API availability、app schema/domain support、developer implementation、authentication/ownership/confirmation policy、app/entity discoverability。
Organization/MDM: supervision requirement、configuration profile restriction、external intelligence integration allowed/sign-in allowed、Writing Tools/Image Playground/Genmoji等feature controls。
Core ML: app-bundled/downloaded model、device compute/memory、CPU/GPU/Neural Engine support、model format/operator compatibility。
MLX: platform/backend/version/package requirements。Apple Intelligence entitlementとは別。
## Practice
Apple Intelligence: production OS-integrated product surface。ただしindividual feature/model routingはPRODUCT_VOLATILE。
SystemLanguageModel: maintained developer API; current docs include multiple OS-aligned model generations。
PrivateCloudComputeLanguageModel: official 2026 developer APIだがBeta表記。公開後辞典ではBeta/GA stateを公開直前確認する。
PCC security architecture: production security architecture + public research/transparency mechanisms。claimはApple specとindependent researchを分離。
App Intents: maintained system integration framework。2026にAI schema/ownership等が拡張。
Core ML/Vision: mature maintained on-device ML frameworks。
MLX: active author-maintained OSS; v0.31.2 evidence取得。Apple Intelligence runtimeとは独立。
LanguageModel provider abstraction: current Foundation Models architectureに存在。provider packageの具体対応/termsは別provider evidenceが必要。
## Practice
EA-003では「Apple AI全体の性能ランキング」を作らない。適切な評価単位はruntimeごとに異なる。
## Practice
SystemLanguageModel: task success、structured output validity、tool-call accuracy、latency、memory/energy、context overflow、guardrail refusal、OS/model-version regression。
## Practice
PCC model: task success、32K-context utilization、reasoning level別quality/latency、network fallback、quota exhaustion、service availability。
## Practice
App Intents: intent/entity resolution、confirmation correctness、authentication/ownership boundary、side-effect success/failure。
## Practice
Core ML/Vision: task-specific accuracy、latency、energy/memory、hardware compatibility。
## Practice
MLX: workload/model/backendごとのthroughput/memory/correctness。Apple Intelligence benchmarkへ外挿しない。
## Practice
PCC security: model qualityとprivacy/security verificationを別評価軸にする。独立研究のbenchmark結果を「PCC全世代のmodel quality保証」には使わない。
## Practice
Security/Privacy: on-device処理、PCC、external providerのdata boundaryを明示し、単に「Apple Intelligenceだからprivate」と一括しない。PCCはAppleのstateless/no-admin-access/attestation/transparency設計を記載できるが、独立研究の検証限界も併記する。App Intentsではaction permission/ownership/confirmationを別管理する。
Audit: PCCのpublic software transparencyはenterprise tenant audit logとは別物である。researcher-verifiable production image/measurementと、organizationが自社user activityを監査できることを混同しない。MDM configuration state、app telemetry、Foundation Models session logging等は別途設計が必要。
Cost: on-device SystemLanguageModelは公式比較でusage unlimited、PCCはdaily quotaを持ち、iCloud+ upgrade pathがある。これはAPI token billingとは異なるmeterである。企業向け費用評価ではdevice hardware refresh、MDM、developer effort、local compute/energy、PCC quota/consumer subscription依存を分離する。具体価格は公開時再確認。
Operability: local-first + PCC fallbackはnetwork failure耐性を設計できる一方、model update driftとdevice fragmentationを持つ。availability APIを実装し、deviceNotEligible/modelNotReady/systemNotReady/quotaLimitReached等を運用状態として扱う。OS更新時にprompt regression testを再実行する。
## Practice
公開後版ではEA-003を七面図（Apple Intelligence experience / on-device Foundation Model / PCC / App Intents / Core ML-family / MLX / external-provider interoperability）として構成する。
## Practice
Foundation Modelsのcurrent canonical API名、SystemLanguageModel model generations、PrivateCloudComputeLanguageModelのBeta/GA、32K/4K context、reasoning level、quota/iCloud+ pathを公開直前に再採集する。
## Practice
Apple Intelligence supported device/OS/language/region matrixは本文固定せずas-of表にする。特にmainland China、EU、watchOS/visionOS差を再確認する。
## Practice
MDM restrictionsを管理表にする。Writing Tools/Image Playground/Genmoji/external intelligence integration/external-provider sign-in等についてsupervision requirementとOS minimumを公開時に再確認する。
## Practice
PCC節はApple Security Guide + production transparency materials + independent researchの三段証拠にする。「Apple claim」「technically enforceable design」「independent evidence/remaining opacity」を別欄にする。
## Practice
Dittmar et al. 2605.24239の本文/公開artifactを追加採集し、どのprivacy claimを実測/逆解析で支持・限定したかをclaim-levelで整理する。abstractだけで詳細を過剰解釈しない。
## Practice
LanguageModel protocolで利用可能なthird-party model packageの公式provider implementation/termsを別途採集し、Apple PCC privacyを第三者providerへ外挿しない。
## Practice
App IntentsのauthenticationPolicy、OwnershipProvidingEntity、confirmation、execution targetをEA-054/055等のagent identity/governanceとcross-referenceする。
## Practice
Core ML/Vision/Speech/Sound AnalysisとEA-004非LLM AI総合編を接続する。EA-004ではOCR/image recognition/STT/TTS/translation/embedding等をprovider-neutralに再整理し、Apple固有実装はmappingとして置く。
## Practice
MLXについては公開時current release/tag/backend matrixを再確認する。Apple silicon起源だがcurrent repoのLinux CPU/CUDA pathを確認し、platform scopeを固定観念で書かない。
## Practice
TEST_PROFILE（未実施）: 同一taskのSystemLanguageModel/PCC比較、network遮断時PCC→on-device fallback、OS update前後の固定prompt regression、MDM external intelligence restriction、quotaLimitReached時のstate handling。認証・課金・MDM変更を伴うため、このRUNでは実施しない。
## Practice
接続候補: EA-004非LLM AI総合編、EA-012公称能力vs実効能力、EA-018端末内AI/Edge AI、EA-030継続観測所、EA-046小型モデル/SLM、EA-054 agent identity、EA-062 AI操作権限モデル、EA-064 AI機能可用性モデル、EA-085 hardware-aware AI、EA-131 Apple Intelligence導入設計。
## Practice
The canonical EA-003 packet remains structurally valid under the current v2.1 Research Gate. Its central topology — Apple Intelligence experience plane, on-device Foundation Model, Private Cloud Compute, App Intents, classical on-device ML, MLX/local model plane, and external/provider interoperability — remains supported. The supplement below updates fast-moving API/availability/admin-control facts without rewriting the canonical packet.

CURRENT_PRIMARY_EVIDENCE:
## Practice
Apple Developer, “Apple Intelligence”, accessed 2026-10-11: Foundation Models exposes Apple Foundation Models on device and in Private Cloud Compute, and can use model providers whose Swift packages conform to the LanguageModel protocol. App Intents remains a separate app-content/action integration layer.
  URL: https://developer.apple.com/apple-intelligence/
## Practice
Apple Developer, “Foundation Models updates”, current June 2026 update, accessed 2026-10-11: iOS/iPadOS/macOS/visionOS 27 changes the on-device SystemLanguageModel and Apple explicitly instructs developers to retest prompts after OS/model changes; LanguageModel supports server or on-device LLMs.
  URL: https://developer.apple.com/documentation/Updates/FoundationModels
## Practice
Apple Developer, “PrivateCloudComputeLanguageModel”, accessed 2026-10-11: PCC is a distinct server-side Apple Foundation Model; availability depends on Apple Intelligence device/region support.
  URL: https://developer.apple.com/documentation/FoundationModels/PrivateCloudComputeLanguageModel
## Practice
Apple Developer, “Adding server-side intelligence with Private Cloud Compute”, accessed 2026-10-11: SystemLanguageModel and PCC share a session API but differ materially in offline availability, usage limit, reasoning and context size; PCC requires eligibility/managed entitlement and developers are instructed to fall back to on-device where appropriate.
  URL: https://developer.apple.com/documentation/foundationmodels/adding-server-side-intelligence-with-private-cloud-compute
## Practice
Apple Developer WWDC26, “What’s new in the Foundation Models framework”, accessed 2026-10-11: Apple documents PCC, LanguageModel abstraction, Core AI/MLX local paths and partner-model integrations as separate model/runtime options rather than one trust boundary.
  URL: https://developer.apple.com/videos/play/wwdc2026/241/
## Practice
Apple Support, “External intelligence declarative configuration for Apple devices”, accessed 2026-10-11: supervised managed devices can restrict external intelligence integration, sign-in and allowed workspace IDs; availability of settings also depends on the device-management service implementation.
  URL: https://support.apple.com/en-euro/guide/deployment/depedd7d23ef/1/web/1.0
## Practice
ESTABLISHED: “Apple Intelligence = on-device only” remains unsafe wording. Current Apple documentation explicitly distinguishes on-device SystemLanguageModel and server-side PrivateCloudComputeLanguageModel.
## Practice
ESTABLISHED: A common Foundation Models session/API surface does not collapse trust/data/runtime boundaries. LanguageModel can bridge different local or server models.
## Practice
ESTABLISHED: The on-device system model is OS-generation dependent. Current Apple documentation explicitly tells developers to retest prompts after the iOS/iPadOS/macOS/visionOS 27 model change.
## Practice
ESTABLISHED: PCC has availability/eligibility/network/usage-limit gates and is not interchangeable with offline SystemLanguageModel merely because both fit LanguageModelSession.
## Practice
ESTABLISHED: Enterprise/managed-device controls for external intelligence are a separate organization overlay. Supervision, enrollment, integration sign-in and workspace restrictions can change effective availability.
## Practice
LIMIT: Apple’s PCC privacy/security claims and developer API description do not by themselves prove a tenant-specific enterprise audit trail, independent reproducibility of every production image, or equivalent privacy properties for third-party model providers.
## WHY_THIS_MATTERS_TO_UPDATE
台帳EA-003はApple Intelligence、Foundation Models、Core ML/MLX、Vision、App Intents、Private Cloud Computeを横断する構想である。2026年にはFoundation Models framework自体が、従来のon-device SystemLanguageModelだけでなくPrivate Cloud Compute上のserver model、LanguageModel protocolによる他provider modelまで扱うよう拡張されている。したがって「Apple AI＝オンデバイス」という単純化は現行仕様に反する。一方、Core ML/VisionとMLXはApple Intelligenceそのものではなく、別のML実装面である。公開後版では、実行場所と信頼境界を主軸に系統を分ける必要がある。

## SCOPE_ROUTING
Enterprise AI Core: local-first inference、cloud escalation、privacy boundary、availability/fallback、model/version drift、tool/action boundary、evaluation。
Provider mapping: Apple Intelligence / Apple Foundation Models / Private Cloud Compute / App Intents / Core ML / Vision。
Implementation/non-LLM component: Core ML、Vision、MLX。
Interoperability: Foundation Models LanguageModel protocol、App Intents、外部intelligence integrations。
Organization overlay: MDM restrictions、supported device/OS/language/region、PCC managed entitlement、external intelligence integration policy。

## CLAIM_OR_RESEARCH_QUESTION
Q1. 「Apple IntelligenceはオンデバイスAI」と記述してよいか。それともon-device、PCC、external providerを分離すべきか。
Q2. Foundation Models frameworkはApple純正on-device model専用APIか、それとも2026年現在はPCCとthird-party/provider abstractionを含むか。
Q3. Private Cloud Computeの「private cloud」は、通常cloud inferenceと何が技術的に異なり、何を保証し、何を保証しないか。
Q4. App IntentsはAI model/runtimeか、それともsystemがapp action/contentへ到達するintegration/action schemaか。
Q5. Core ML/Vision/MLXはApple Intelligenceの一部として扱うべきか、それとも別のon-device/research ML planeとして分離すべきか。
Q6. 法人運用では、hardware/OS/region/language、MDM restriction、PCC entitlement/quota、network、model updateをどのavailability gateとして扱うべきか。

## EVIDENCE TABLE
1) source class: official developer product architecture
exact title: Apple Intelligence - Apple Developer
author/org: Apple
canonical URL: https://developer.apple.com/apple-intelligence/
publication/update/access: current page / accessed 2026-09-11
version/release: 2026 developer surface; Foundation Models + App Intents current architecture
supporting locator: “The Foundation Models framework”; “App Intents”
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / topology
established: Foundation ModelsはApple Foundation Modelsへon-deviceおよびPrivate Cloud Computeでアクセスでき、Language Model protocolへ適合するSwift package経由の他model providerも扱う。App Intentsはapp content/actionsをApple Intelligence/Siriへschemaで接続する別レイヤーである。


2) source class: official framework change log
exact title: Foundation Models updates
author/org: Apple
canonical URL: https://developer.apple.com/documentation/updates/foundationmodels
publication/update/access: June 2026 / accessed 2026-09-11
version/release: iOS/iPadOS/macOS/visionOS 27.0 generation; earlier 26.4 model update also listed
supporting locator: June 2026 General/Models; February 2026 Models
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / temporal limit
established: June 2026にDynamicProfile、multimodal/agentic拡張、LanguageModel protocolによる任意LLM利用が追加され、on-device SystemLanguageModelもOS更新でmodelが変わる。February 2026にも26.4更新でinstruction following/tool calling/guardrail等が変化しており、prompt behaviorはOS/model version依存である。


3) source class: official API documentation
exact title: SystemLanguageModel
author/org: Apple
canonical URL: https://developer.apple.com/documentation/foundationmodels/systemlanguagemodel
publication/update/access: accessed 2026-09-11
version/release: docs list model generations aligned to OS 26.0–26.3, 26.4, 27.0
supporting locator: Overview; Checking model availability; Inspecting model capabilities
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / availability / failure envelope
established: SystemLanguageModelはApple Intelligenceを支えるon-device text foundation model。availabilityはdevice/region、model readiness等に依存し、contextSize/tokenCount/supportedLanguagesがAPIで確認できる。Appleはroutine OS updateでmodelを更新するため、同じapp promptでもOS世代を固定しなければbehaviorが不変とは言えない。


4) source class: official server-model API documentation
exact title: Adding server-side intelligence with Private Cloud Compute
author/org: Apple
canonical URL: https://developer.apple.com/documentation/FoundationModels/adding-server-side-intelligence-with-private-cloud-compute/
publication/update/access: 2026 developer documentation / accessed 2026-09-11
version/release: PrivateCloudComputeLanguageModel; iOS/macOS/watchOS/visionOS 27+
supporting locator: comparison table; availability/fallback; quota; reasoning levels
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / counter / availability gate / cost-operability
established: PCC server modelはon-device modelと同じLanguageModelSession APIで利用できるが、offline不可、daily request limitあり、32K context、複数reasoning levelを持つ。on-deviceは同文書で4K context、offline可、usage unlimited、reasoning非対応と整理される。PCC利用には対応device/regionに加えdeveloper managed entitlementが必要で、network failure時のon-device fallbackが公式に示される。user quotaを超えた場合、iCloud+による追加アクセス提示経路もある。
limit: このAPIはBeta表記であり、quota値・eligibility・OS availabilityは固定本文に数値として焼き込まない。


5) source class: official API documentation
exact title: PrivateCloudComputeLanguageModel
author/org: Apple
canonical URL: https://developer.apple.com/documentation/FoundationModels/PrivateCloudComputeLanguageModel
publication/update/access: accessed 2026-09-11
version/release: Beta; current 2026 PCC developer API
supporting locator: Overview; availability; quotaUsage; contextSize
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / availability gate
established: PCCはApple Intelligenceのserver-based Foundation Modelをappから利用する公式runtimeとなっているが、managed entitlementとavailability checkを要求する。したがって「PCCはApple自身の内部機構でdeveloperから触れない」という旧理解も2026年版では不正確。


6) source class: official security architecture
exact title: Private Cloud Compute Security Guide / Core Security & Privacy Requirements / No Privileged Runtime Access / Hardware Root of Trust / Verifiable Transparency
author/org: Apple Security
canonical URLs:
- https://security.apple.com/documentation/private-cloud-compute/
- https://security.apple.com/documentation/private-cloud-compute/corerequirements
- https://security.apple.com/documentation/private-cloud-compute/noprivilegedaccess
- https://security.apple.com/documentation/private-cloud-compute/hardwarerootoftrust
- https://security.apple.com/documentation/private-cloud-compute/verifiabletransparency
publication/update/access: current documentation / accessed 2026-09-11
version/release: PCC production architecture
supporting locator: stateless computation; no privileged runtime access; attestation; transparency log
evidence label: VERIFIED_SPEC
relation: support / security / privacy
established: PCCは受領したpersonal user dataをrequest fulfillmentのためだけに使い、response後に保持しないことを設計要件とする。general-purpose remote shell/interactive debuggingを排除し、structured/audited metricsへ限定する。user deviceはPCC nodeのattestationをpublic append-only software-release ledgerと照合し、公開済みsoftware measurementに一致するnodeだけへrequest keyを渡す設計である。production software imageをresearcherが検証可能にするtransparency mechanismが組み込まれている。


7) source class: official security engineering publication
exact title: Private Cloud Compute: A new frontier for AI privacy in the cloud
author/org: Apple Security Engineering and Architecture / User Privacy / Core OS / Services Engineering / AIML
canonical URL: https://security.apple.com/blog/private-cloud-compute/
publication/update/access: 2024-06-10 / accessed 2026-09-11
version/release: PCC architecture launch design
supporting locator: core requirements; PCC nodes; no privileged runtime access; verifiable transparency
evidence label: VERIFIED_SPEC
relation: support / architecture context
established: AppleはPCCを単なる暗号化API endpointではなく、Apple silicon node、hardened OS、Secure Enclave、code signing/sandbox、request attestation、公開software log、research environmentから成るcloud trust architectureとして設計したと説明する。
limit: これは設計者自身のsecurity claimであり、独立検証済みという意味ではない。


8) source class: independent primary research / reverse engineering
exact title: Unlocking Apple's Private Cloud Compute: An Analysis of Privacy-Preserving Artificial Intelligence
author: Yannik Dittmar, Marvin Jerome Stephan, Thomas Völkl, Matthias Hollick, Jiska Classen
canonical URL: https://arxiv.org/abs/2605.24239
publication/update/access: 2026-05-22 / accessed 2026-09-11
version/release: arXiv 2605.24239
supporting locator: abstract; PCC transparency/reverse-engineering/evaluation claims
evidence label: RESEARCH
relation: independent support / counter / limit
established: 独立研究はPCC mobile implementationをreverse-engineerし、非公開interfaceをlocal device上で開いてPCC model benchmarkingを行うframeworkを提示した。
counter/limit: 同研究は、production binariesが公開されてもreproducible buildやsymbolsがなく、仕様とshipping binaryの一致を外部から完全に再構成することには限界があること、underlying model/interfaceが通常はopenでないためmodel accuracy等の学術評価が難しいことを指摘する。したがって「verifiable transparency＝fully open source / reproducible build / open model」と書いてはならない。


9) source class: official deployment/MDM documentation
exact title: Review device management restrictions for Apple devices / Device management restrictions for supervised Apple devices
author/org: Apple Platform Deployment
canonical URLs:
- https://support.apple.com/guide/deployment/review-device-management-restrictions-dep739685973/web
- https://support.apple.com/en-euro/guide/deployment/dep6b5ae23e9/web
publication/update/access: current deployment guide / accessed 2026-09-11
version/release: iOS/iPadOS 18+, macOS 15+ restriction families; current 2026 guide
supporting locator: Allow writing tools; Allow Image Playground; Allow Genmoji; Allow external intelligence integrations; Allow signing in to external intelligence integrations
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / organization overlay / availability gate
established: 管理端末ではWriting Tools、Image Playground、Genmoji、external cloud intelligence integration等をMDM restrictionで制御できる。external integration自体の禁止と、external providerへのsign-in禁止（anonymous mode強制）は別controlである。現在の例としてChatGPT/Google Lensが外部cloud intelligence integrationに含まれる。
limit: restriction availability/supervision requirementはOS revisionで変わるため公開直前再確認が必要。


10) source class: official availability/support documentation
exact title: How to get Apple Intelligence
author/org: Apple Support
canonical URL: https://support.apple.com/121115
publication/update/access: current 2026 support page / accessed 2026-09-11
version/release: current Apple Intelligence requirements; support page references iOS/iPadOS/macOS 26.1 generation and later
supporting locator: system requirements; supported languages and regions; mainland China restriction
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / availability gate
established: Apple Intelligenceの実効可用性は対応hardware、OS、device/Siri language、on-device model storage、regionに依存する。current support surfaceではdevice storage 7 GB、対応言語群、EU availability、mainland Chinaでの制限等が明記され、feature availabilityはplatform/language/regionで異なり得る。
limit: hardware/OS/language/region matrixは高頻度に更新されるため、本文ではgateの存在を固定し、具体表はas-of matrixにする。


11) source class: official App Intents API/update documentation
exact titles: AppIntent; App Intents updates; Providing contextual cues to Apple Intelligence and Siri
author/org: Apple
canonical URLs:
- https://developer.apple.com/documentation/appintents/appintent
- https://developer.apple.com/documentation/updates/appintents
- https://developer.apple.com/documentation/appintents/providing-contextual-cues-to-apple-intelligence-and-siri
publication/update/access: June 2026 update / accessed 2026-09-11
version/release: 2026 App schemas / SyncableEntity / OwnershipProvidingEntity generation
supporting locator: discoverability/actions; Apple Intelligence June 2026 updates; contextual cue privacy boundary
evidence label: VERIFIED_SPEC + PRODUCT_VOLATILE
relation: support / action boundary / security
established: App Intentsはapp-specific actionをsystemへ表現するprotocolで、Apple Intelligence/Siri等がdiscover/executeできる。2026更新ではschema conformance、cross-device stable entity、shared/public entityに対するdestructive/sensitive action confirmation等が追加される。app UI dataはsystemから直接読めるわけではなく、developerがAppEntity等でcontextを明示する。
limit: App Intents自体はfoundation modelでもagent runtimeでもない。AIがaction/contentへ安全に接続するintegration surfaceとして記述する。


12) source class: official classical ML framework documentation
exact title: Core ML
author/org: Apple
canonical URL: https://developer.apple.com/documentation/coreml
publication/update/access: accessed 2026-09-11
version/release: current Core ML
supporting locator: Overview
evidence label: VERIFIED_SPEC
relation: support / boundary / non-LLM component
established: Core MLはappへML modelを統合するframeworkで、CPU/GPU/Neural Engineを使ったon-device inference、on-device retraining/fine-tuningを支える。Vision、Natural Language、Speech、Sound Analysis等のdomain frameworkの基盤でもある。
limit: Core ML利用＝Apple Intelligence利用ではない。custom/local model deploymentの独立planeとして扱う。


13) source class: author-maintained OSS
exact title: MLX: An array framework for Apple silicon
author/org: Apple Machine Learning Research / ml-explore
canonical URL: https://github.com/ml-explore/mlx
publication/update/access: repository accessed 2026-09-11
version/release/tag/commit: releases surface shows v0.31.2, commit 68cf2fd, released 2026-04-22
supporting locator: README; releases
evidence label: OSS_PRACTICE + PRODUCT_VOLATILE
relation: support / implementation boundary
established: MLXはApple ML researchが公開するarray/ML frameworkで、NumPy/PyTorch/JAX的API、autodiff、lazy/dynamic graph、unified memory等を提供し、LLM training/text generation、Stable Diffusion、Whisper等のexamplesを持つ。研究・local model実験の実装基盤であり、Apple Intelligence end-user runtimeと同義ではない。
limit: current repositoryはApple silicon起源のframeworkでありつつLinux CPU/CUDA install pathも案内しており、「MLX=macOS専用」も固定表現にしない。Apple Intelligenceのprivacy/security保証をMLX workloadへ自動継承させない。


14) source class: official current product announcement / architecture context
exact title: Apple Intelligence brings powerful AI capabilities into everyday experiences
author/org: Apple
canonical URL: https://www.apple.com/newsroom/2026/06/apple-intelligence-brings-powerful-ai-capabilities-into-everyday-experiences/
publication/update/access: 2026-06 / accessed 2026-09-11
version/release: next-generation Apple Foundation Models / 2026 architecture
supporting locator: “A Bold New Architecture, Built Privacy-First”
evidence label: SOURCE_REPORT + PRODUCT_VOLATILE
relation: support / counter / provider boundary
established: 2026のApple Intelligenceはon-deviceとPCC serverの両方を使う。Appleは次世代Apple Foundation ModelsをGoogle/Gemini modelsとのcollaborationでcustom-builtと説明している。
counter: 「Apple Intelligenceの全model stackはApple単独開発・Apple modelだけで閉じる」と一般化しない。具体的provider/model routingはfeatureごとに再確認が必要。

## FINDINGS
EA-003は高い採用価値がある。ただし章名の「オンデバイスAI」は全体の同義語ではなく、一つの実行planeとして扱うべきである。2026年時点の安全な系統は少なくとも次の七面に分かれる。
A. Apple Intelligence experience plane: OS統合されたuser-facing intelligence。実処理が常にdevice内に閉じるとは限らず、on-device/PCC/external integrationのroutingを別途見る。
B. On-device Foundation Model plane: SystemLanguageModel。Foundation Models APIから利用し、offline可能、device/region/model-ready gateを持つ。OS updateでmodel versionが変わるため、prompt/evaluationはOS/model世代を記録する。
C. Private Cloud Compute plane: PrivateCloudComputeLanguageModelおよびApple Intelligenceのserver inference。network、device/region、managed entitlement、daily quota等のgateがあり、on-deviceより大きなcontext/reasoningを提供する。privacy/securityはstateless processing、no privileged runtime access、attestation、public software transparencyを組み合わせた別trust boundary。
D. App action/context plane: App Intents/App Entity/App Schema。modelそのものではなく、AI/Siriがappのaction/contentへ到達するためのtyped integration boundary。
E. Classical on-device ML plane: Core ML + Vision/Natural Language/Speech/Sound Analysis等。custom modelをdevice上で扱う独立基盤。
F. ML research/local model plane: MLX。Apple ML research由来のOSS frameworkで、研究・training・local inference用。Apple Intelligence/PCCのmanaged privacy boundaryを自動的には持たない。
G. External/provider interoperability plane: Foundation ModelsのLanguageModel protocol、external intelligence integrations等。2026年のApple AI developer surfaceはApple純正modelだけの閉鎖系ではない。


最重要の修正点は「on-device vs cloud」の二値では不足することである。同じFoundation Models framework内でもon-device Apple model、PCC Apple server model、任意provider modelが同じsession abstractionへ接続可能になっている。API surfaceの共通性とtrust/data boundaryの共通性を混同してはならない。

## LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE
- 「Apple Intelligence＝すべてオンデバイス」は誤り。PCCへのcloud escalationがあり、2026年はdeveloperもPCC modelへ公式アクセスできる。
- 「PCC＝通常cloud APIと同じ」も誤り。Apple設計上はstatelessness、no privileged runtime access、attestation、transparency log等の追加security architectureを持つ。
- ただし「PCC＝完全にopen/reproducible」は言えない。独立研究はreproducible builds/symbols/model interface opennessに限界を指摘する。Appleのarchitecture claimと独立検証可能性を分離する。
- 「Foundation Models＝Apple model専用」は2026年には誤り。LanguageModel protocolでserver/on-deviceの他provider packageを扱える。
- 「Core ML/MLX＝Apple Intelligence」ではない。前者はmodel integration/runtime、後者はML research frameworkで、Apple IntelligenceのOS-level privacy/governanceを自動継承しない。
- App Intentsはmodel capabilityそのものではない。action/semantic schemaのintegration layer。
- On-device modelはOS updateでversionが変わる。prompt/testを一度通したから将来OSでも同じbehaviorとは保証できない。
- PCCはnetwork/availability/quota/entitlement failureを持つ。公式にon-device fallbackが案内されるため、production appではcloud availabilityを前提条件にしない。
- Apple Intelligence feature availabilityはdevice、OS、language、regionで差があり、MDMが一部機能/外部integrationを無効化できる。
- 2026年発表にはGoogle/Gemini collaborationが明記されるため、「Apple stackは全モデルをApple単独開発」と固定しない。

## AVAILABILITY_GATES
Apple Intelligence user plane: compatible hardware、OS version、device/Siri language、model download/storage、region、feature-specific rollout、user enablement。
SystemLanguageModel: Apple Intelligence capable device、region、model ready/download状態、OS/model generation、supported locale。
PCC developer model: iOS/macOS/watchOS/visionOS 27+、Apple Intelligence capable device/region、network、managed entitlement、service readiness、daily quota、iCloud+ quota path。
App Intents: OS/API availability、app schema/domain support、developer implementation、authentication/ownership/confirmation policy、app/entity discoverability。
Organization/MDM: supervision requirement、configuration profile restriction、external intelligence integration allowed/sign-in allowed、Writing Tools/Image Playground/Genmoji等feature controls。
Core ML: app-bundled/downloaded model、device compute/memory、CPU/GPU/Neural Engine support、model format/operator compatibility。
MLX: platform/backend/version/package requirements。Apple Intelligence entitlementとは別。

## IMPLEMENTATION_STATE
Apple Intelligence: production OS-integrated product surface。ただしindividual feature/model routingはPRODUCT_VOLATILE。
SystemLanguageModel: maintained developer API; current docs include multiple OS-aligned model generations。
PrivateCloudComputeLanguageModel: official 2026 developer APIだがBeta表記。公開後辞典ではBeta/GA stateを公開直前確認する。
PCC security architecture: production security architecture + public research/transparency mechanisms。claimはApple specとindependent researchを分離。
App Intents: maintained system integration framework。2026にAI schema/ownership等が拡張。
Core ML/Vision: mature maintained on-device ML frameworks。
MLX: active author-maintained OSS; v0.31.2 evidence取得。Apple Intelligence runtimeとは独立。
LanguageModel provider abstraction: current Foundation Models architectureに存在。provider packageの具体対応/termsは別provider evidenceが必要。

## BENCHMARK_OR_EVAL
EA-003では「Apple AI全体の性能ランキング」を作らない。適切な評価単位はruntimeごとに異なる。
- SystemLanguageModel: task success、structured output validity、tool-call accuracy、latency、memory/energy、context overflow、guardrail refusal、OS/model-version regression。
- PCC model: task success、32K-context utilization、reasoning level別quality/latency、network fallback、quota exhaustion、service availability。
- App Intents: intent/entity resolution、confirmation correctness、authentication/ownership boundary、side-effect success/failure。
- Core ML/Vision: task-specific accuracy、latency、energy/memory、hardware compatibility。
- MLX: workload/model/backendごとのthroughput/memory/correctness。Apple Intelligence benchmarkへ外挿しない。
- PCC security: model qualityとprivacy/security verificationを別評価軸にする。独立研究のbenchmark結果を「PCC全世代のmodel quality保証」には使わない。

## SECURITY / PRIVACY / AUDIT / COST / OPERABILITY
Security/Privacy: on-device処理、PCC、external providerのdata boundaryを明示し、単に「Apple Intelligenceだからprivate」と一括しない。PCCはAppleのstateless/no-admin-access/attestation/transparency設計を記載できるが、独立研究の検証限界も併記する。App Intentsではaction permission/ownership/confirmationを別管理する。
Audit: PCCのpublic software transparencyはenterprise tenant audit logとは別物である。researcher-verifiable production image/measurementと、organizationが自社user activityを監査できることを混同しない。MDM configuration state、app telemetry、Foundation Models session logging等は別途設計が必要。
Cost: on-device SystemLanguageModelは公式比較でusage unlimited、PCCはdaily quotaを持ち、iCloud+ upgrade pathがある。これはAPI token billingとは異なるmeterである。企業向け費用評価ではdevice hardware refresh、MDM、developer effort、local compute/energy、PCC quota/consumer subscription依存を分離する。具体価格は公開時再確認。
Operability: local-first + PCC fallbackはnetwork failure耐性を設計できる一方、model update driftとdevice fragmentationを持つ。availability APIを実装し、deviceNotEligible/modelNotReady/systemNotReady/quotaLimitReached等を運用状態として扱う。OS更新時にprompt regression testを再実行する。

## SAFE_WORDING_FOR_FUTURE_BOOK
「AppleのAI運用は『オンデバイスかクラウドか』の二択では捉えにくい。Apple Intelligenceには端末上で動くFoundation Modelと、より大きな処理をPrivate Cloud Computeへ送る経路があり、2026年のFoundation Models frameworkはさらに他のモデル提供者を共通APIへ接続できる。Private Cloud Computeは通常のクラウド推論とは異なるstateless処理・attestation・software transparencyを設計しているが、これはすべてのApple AI機能や外部モデルに自動適用される保証ではない。Core ML、Vision、MLX、App Intentsも同じApple系統に見えるが、それぞれmodel実行、画像等のdomain ML、研究用ML基盤、app action統合という別の役割と信頼境界を持つ。法人運用では、実行場所、モデル提供者、device/OS/region、管理制限、network/quota、action権限を分けて確認する。」

## UPDATE_WORK_HANDOFF
1. 公開後版ではEA-003を七面図（Apple Intelligence experience / on-device Foundation Model / PCC / App Intents / Core ML-family / MLX / external-provider interoperability）として構成する。
2. Foundation Modelsのcurrent canonical API名、SystemLanguageModel model generations、PrivateCloudComputeLanguageModelのBeta/GA、32K/4K context、reasoning level、quota/iCloud+ pathを公開直前に再採集する。
3. Apple Intelligence supported device/OS/language/region matrixは本文固定せずas-of表にする。特にmainland China、EU、watchOS/visionOS差を再確認する。
4. MDM restrictionsを管理表にする。Writing Tools/Image Playground/Genmoji/external intelligence integration/external-provider sign-in等についてsupervision requirementとOS minimumを公開時に再確認する。
5. PCC節はApple Security Guide + production transparency materials + independent researchの三段証拠にする。「Apple claim」「technically enforceable design」「independent evidence/remaining opacity」を別欄にする。
6. Dittmar et al. 2605.24239の本文/公開artifactを追加採集し、どのprivacy claimを実測/逆解析で支持・限定したかをclaim-levelで整理する。abstractだけで詳細を過剰解釈しない。
7. LanguageModel protocolで利用可能なthird-party model packageの公式provider implementation/termsを別途採集し、Apple PCC privacyを第三者providerへ外挿しない。
8. App IntentsのauthenticationPolicy、OwnershipProvidingEntity、confirmation、execution targetをEA-054/055等のagent identity/governanceとcross-referenceする。
9. Core ML/Vision/Speech/Sound AnalysisとEA-004非LLM AI総合編を接続する。EA-004ではOCR/image recognition/STT/TTS/translation/embedding等をprovider-neutralに再整理し、Apple固有実装はmappingとして置く。
10. MLXについては公開時current release/tag/backend matrixを再確認する。Apple silicon起源だがcurrent repoのLinux CPU/CUDA pathを確認し、platform scopeを固定観念で書かない。
11. TEST_PROFILE（未実施）: 同一taskのSystemLanguageModel/PCC比較、network遮断時PCC→on-device fallback、OS update前後の固定prompt regression、MDM external intelligence restriction、quotaLimitReached時のstate handling。認証・課金・MDM変更を伴うため、このRUNでは実施しない。
12. 接続候補: EA-004非LLM AI総合編、EA-012公称能力vs実効能力、EA-018端末内AI/Edge AI、EA-030継続観測所、EA-046小型モデル/SLM、EA-054 agent identity、EA-062 AI操作権限モデル、EA-064 AI機能可用性モデル、EA-085 hardware-aware AI、EA-131 Apple Intelligence導入設計。

## OPEN_UNKNOWN
/ STOP_CONDITION

## OPEN_UNKNOWN
- 2026-09-11時点のPrivateCloudComputeLanguageModel managed entitlement eligibilityの具体審査条件とorganization distribution条件。
- PCC daily quotaの具体値、iCloud+ tierごとの差、enterprise/managed accountでの扱い。
- Foundation Models LanguageModel protocolのthird-party package別data path、provider terms、enterprise administration。
- Apple Intelligence各featureがon-device/PCC/external modelのどれへrouteされるかの完全matrix。
- Apple Platform Deploymentにおける各Apple Intelligence restrictionの最新supervision requirementとOS 27での変更。
- Dittmar et al.が各PCC security claimをどこまで実測確認できたかの本文レベルmapping。
- production PCC transparency log/imageの継続availabilityと、researcher toolchainのcurrent version。
- SystemLanguageModel/PCCの企業アプリ内利用に関するtelemetry/audit/retention設計の全仕様。
- 2026年Apple Foundation ModelsとGoogle/Gemini collaborationのmodel supply/training/runtime境界。
- MLXのcurrent backend/platform roadmapとApple Intelligence内部利用の有無。公開根拠なしに内部利用を推測しない。

## STOP_CONDITION
EA-003の更新章に必要なtopology、on-device/PCC/external-provider境界、PCC security claimと独立検証限界、App Intents/Core ML/MLXの別役割、hardware/OS/region/MDM/quota/model-version gateまで一次資料と独立研究で確立した。PCC developer APIとOS 27世代は変動が速く、具体quota/entitlement/feature routingを今固定するとPRODUCT_VOLATILE化が早い。今回はEA-003をbounded closeし、次の未調査最小番号EA-004「非LLM AI総合編」へ送る。

## CURRENTNESS_DECISION
The canonical EA-003 packet remains structurally valid under the current v2.1 Research Gate. Its central topology — Apple Intelligence experience plane, on-device Foundation Model, Private Cloud Compute, App Intents, classical on-device ML, MLX/local model plane, and external/provider interoperability — remains supported. The supplement below updates fast-moving API/availability/admin-control facts without rewriting the canonical packet.

CURRENT_PRIMARY_EVIDENCE:
- Apple Developer, “Apple Intelligence”, accessed 2026-10-11: Foundation Models exposes Apple Foundation Models on device and in Private Cloud Compute, and can use model providers whose Swift packages conform to the LanguageModel protocol. App Intents remains a separate app-content/action integration layer.
  URL: https://developer.apple.com/apple-intelligence/
- Apple Developer, “Foundation Models updates”, current June 2026 update, accessed 2026-10-11: iOS/iPadOS/macOS/visionOS 27 changes the on-device SystemLanguageModel and Apple explicitly instructs developers to retest prompts after OS/model changes; LanguageModel supports server or on-device LLMs.
  URL: https://developer.apple.com/documentation/Updates/FoundationModels
- Apple Developer, “PrivateCloudComputeLanguageModel”, accessed 2026-10-11: PCC is a distinct server-side Apple Foundation Model; availability depends on Apple Intelligence device/region support.
  URL: https://developer.apple.com/documentation/FoundationModels/PrivateCloudComputeLanguageModel
- Apple Developer, “Adding server-side intelligence with Private Cloud Compute”, accessed 2026-10-11: SystemLanguageModel and PCC share a session API but differ materially in offline availability, usage limit, reasoning and context size; PCC requires eligibility/managed entitlement and developers are instructed to fall back to on-device where appropriate.
  URL: https://developer.apple.com/documentation/foundationmodels/adding-server-side-intelligence-with-private-cloud-compute
- Apple Developer WWDC26, “What’s new in the Foundation Models framework”, accessed 2026-10-11: Apple documents PCC, LanguageModel abstraction, Core AI/MLX local paths and partner-model integrations as separate model/runtime options rather than one trust boundary.
  URL: https://developer.apple.com/videos/play/wwdc2026/241/
- Apple Support, “External intelligence declarative configuration for Apple devices”, accessed 2026-10-11: supervised managed devices can restrict external intelligence integration, sign-in and allowed workspace IDs; availability of settings also depends on the device-management service implementation.
  URL: https://support.apple.com/en-euro/guide/deployment/depedd7d23ef/1/web/1.0

## CURRENTNESS_FINDINGS
1. ESTABLISHED: “Apple Intelligence = on-device only” remains unsafe wording. Current Apple documentation explicitly distinguishes on-device SystemLanguageModel and server-side PrivateCloudComputeLanguageModel.
2. ESTABLISHED: A common Foundation Models session/API surface does not collapse trust/data/runtime boundaries. LanguageModel can bridge different local or server models.
3. ESTABLISHED: The on-device system model is OS-generation dependent. Current Apple documentation explicitly tells developers to retest prompts after the iOS/iPadOS/macOS/visionOS 27 model change.
4. ESTABLISHED: PCC has availability/eligibility/network/usage-limit gates and is not interchangeable with offline SystemLanguageModel merely because both fit LanguageModelSession.
5. ESTABLISHED: Enterprise/managed-device controls for external intelligence are a separate organization overlay. Supervision, enrollment, integration sign-in and workspace restrictions can change effective availability.
6. LIMIT: Apple’s PCC privacy/security claims and developer API description do not by themselves prove a tenant-specific enterprise audit trail, independent reproducibility of every production image, or equivalent privacy properties for third-party model providers.

## COUNTEREVIDENCE_AND_FAILURE_ENVELOPE
The canonical packet’s existing counterevidence and independent-research limits remain controlling. This supplement does not promote Apple architecture claims into proof of universal third-party-provider behavior, enterprise tenant audit completeness, or deployment conformance. Current Apple documentation strengthens rather than removes the packet’s model-version, region, network, managed-entitlement, MDM and external-provider gates.

## SAFE_WORDING_UPDATE
“AppleのAI運用を『端末内かクラウドか』の二択で扱わない。Foundation Modelsは共通セッションから端末内モデル、Private Cloud Compute、さらにLanguageModelに適合する別モデルへ接続できるが、APIの共通性はデータ境界・認証・課金・可用性・監査境界の共通性を意味しない。OS/model世代、device/region、PCC entitlement/network/limit、MDMによる外部intelligence制御を個別gateとして記録する。”

## OPEN_UNKNOWN_RETAINED
- tenant/organizationごとのPCC managed entitlement条件と実効quota
- third-party LanguageModel packageごとのdata path, terms, auth, billing, admin controls
- Apple Intelligence各featureの完全な runtime-routing matrix
- enterprise tenant audit/retention semantics across SystemLanguageModel/PCC/external providers
- independent verification coverage of current PCC production generations

RESEARCH_GATE:
PASS_FOR_BOUNDED_BASE_REVISION — canonical packet already contains exact topic/questions, claim-level evidence, independent/official counterevidence, scope boundaries, failure envelope, availability gates, security/privacy/audit/cost/operability, SAFE_WORDING, OPEN_UNKNOWN and STOP_CONDITION. Currentness was rechecked on 2026-10-11 with current Apple primary documentation. No claim is made that an independent content audit has passed.

CANDIDATE_IMPLEMENTATION_OVERLAY:

NEXT: /agent/start.json
STOP: This is a knowledge projection, not an execution order.