feat(privacy): audited redaction that keeps history's shape and removes its content

Rows in append-only history are never deleted; their content can now be
made irrecoverable through one audited path. A redaction replaces the
content columns of an event, memory, message, model call, belief or
assertion with a fixed marker, keeps identifiers, links, timestamps,
scores and breakdowns, writes an append-only ledger row with a SHA-256 of
the removed content, appends a redaction event, optionally cascades to
derived rows and to the events that quote them, and scrubs stored snapshot
archives before re-signing them. noema_redact() is the only write the
append-only trigger admits, for UPDATE only, under a transaction-local flag
the application never sets; plain updates and all deletes stay refused.
Replay labels redacted stimuli instead of inventing them.

Cryptographic erasure was considered and deferred with reasons (ADR-0009);
docs/privacy.md defines retained, redacted, irrecoverable and deleted and
states what backups and earlier exports are not covered. Migration 0023.

This commit is contained in:

Andy Dixon

2026-08-23 23:52:07 +01:00

parent 9eed6e2a18

commit 7d608c2783

33 changed files with 1245 additions and 45 deletions

									
										internal/api/server.go
									
		+1
		
												View File
												
				@@ -80,6 +80,7 @@ func (s *Server) routes() {

					s.dreamRoutes()

					s.studyRoutes()

					s.assertionRoutes()

					s.privacyRoutes()

					m.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {

						writeError(w, r, http.StatusNotFound, "not_found", "no such endpoint")