S37 · Privacy & Data Governance

Declared state: built, unproven by use — hygiene real, policy now enforced at the write boundary.

This is the repository plan and evidence, not a live health reading. A task marked done may still depend on credentials, devices, deployment or a newer acceptance test.

Dependencies

No dependencies are declared in the catalog.

Tasks and gates

37.F1 · **A data inventory**: every store, what personal data it holds, where it lives, who can

Tier F · done · Verification: hermetic-test

Gate: `test_data_inventory.py` — every memory/audit store appears.

  • recorded-note · 2026-09-13 · docs/SYSTEMS-DETAILS.md:3737

37.F2 · A retention policy per store, enforced by the hygiene job, not by intention.

Tier F · done · Verification: hermetic-test

Gate: `test_memory_hygiene.py` [per-store TTL]

  • recorded-note · 2026-09-13 · docs/SYSTEMS-DETAILS.md:3749

37.F3 · `forget X` actually removes X from every store, verified by re-querying.

Tier F · done · Verification: hermetic-test

Gate: `test_right_to_forget.py`

  • recorded-note · 2026-09-13 · docs/SYSTEMS-DETAILS.md:3761

37.R1 · Sensitivity classification — biometric, financial, medical, ordinary — with rules per

Tier R · open · Verification: hermetic-test

Gate: `test_data_inventory.py` [classification]

    37.R2 · Egress accounting: what left the machine, to which provider, when.

    Tier R · open · Verification: planned-test

    Gate: new `test_egress_log.py` - planned gate. new `test_egress_log.py`

      37.R3 · Consent gates for anything shared with a third party.

      Tier R · open · Verification: hermetic-test

      Gate: `test_confirm_tier_documented.py` extended.

        37.E1 · A full privacy report the owner can read in five minutes and act on.

        Tier E · open · Verification: manual

        Gate: generated report reviewed and recorded.

          37.R4 · **Classify data first — biometric, financial, medical, ordinary** — before writing any retention rule. Jev p=0.95, conf 0.93: every other rule, retention included, depends on knowing which class a thing is. The policy does NOT gate the unpark (p=0.81).

          Tier R · done · Verification: hermetic-test

          Gate: new `test_data_classification.py` — every store declares a class, and an unclassified store fails the gate.

          • recorded-note · 2026-09-20 · TODO.md

          37.R5 · The never-store set is enforced at the store boundary, not described in prose: a write of plaintext passwords, raw biometric sensor feeds, banking credentials or unfiltered health-crisis journaling is refused where it is attempted (D-24).

          Tier R · in-progress · Verification: hermetic-test

          Gate: new `test_never_store.py` — each of the four never-store classes is refused at the write boundary, the refusal is audited, and no path can be reached that would persist one.

          • hermetic-green · undated · bench/test_never_store.py
          • hermetic-green · undated · bench/test_never_store.py

          HUD screen contracts

          All subsystems · Source: docs/systems-plan.json.