feat(privacy): record provider field codes without source text

ARCHITECTURE.md

@@ -61,6 +61,7 @@ boundaries above remain the target modular MSA architecture.
 | `tepp_simulation` | known-truth temporal/event data generation |
 | `validation_core` | RMSE, bias, coverage, graph, and Monte Carlo metrics |
 | `tepp_api` | versioned DTO, schema, and export contracts |
+| `provider_receipt` | provider-disclosure field-code receipts; source text and identity are not disclosable |
 | `operational_log` | operational logs; `try_record` is the only recording API; source text and source identity are not loggable; `persistence_postgres` `audit_event` inserts call the same gate |
 | `service_tls` | production TLS bind gates and rustls server config |
 | `derived_sensitivity` | derived topic/factor/relation outputs inherit source sensitivity |

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `provider_receipt` disclosure audit: a receipt records purpose and field codes sent to a model provider; source text, source identity, and blanket PII masking fail closed; recovered field codes match known truth at a higher computed rate than a collapsed set (ADR 0009).
 - `tepp_api` corpus-split leakage-audit manifest v1: cutoff exclusion counts, relation-component and partition digests, governed link-kind vocabulary, and a canonical `SHA-256` that binds to `corpus_split_manifest` without exporting source text.
 - `persistence_postgres` `audit_event` inserts call `operational_log::try_record` before SQL is rendered: author/customer/project source text, source identity, and blanket-mask grants cannot enter `INSERT INTO audit_event`; clear inspection still persists a validated action code (ADR 0009; ISO/IEC 29100:2024). No new migration number. `OperationalLogRecord::new` stays crate-private.
 - `operational_log` source separation: `try_record` is the only recording API and inspects source text, source identity, and blanket-mask intent before creating a line; `OperationalLogRecord::new` is crate-private; a source-identity `&str` cannot become an `AnalyticalSubject`; privileged-export / identity-mapping / diagnosis action codes keep author, customer, and project memberships distinct; replayed lines match known truth at a higher computed rate than a collapsed single-action or collapsed-subject log (ADR 0009; ISO/IEC 29100:2024). The live docstring crate-root count is bound to `EXPECTED_CRATES` so the eleventh crate cannot fail a hard-coded `10`.
@@ -104,6 +105,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Changed
 
+- Kept one maturity row per capability in the traceability matrix while recording the active provider-receipt evidence without duplicating or downgrading existing capabilities.
 - `tepp_api` corpus-split manifest validation now rejects governed link-kind arrays that are unsorted or duplicated, keeping untrusted JSON aligned with the schema's unique canonical representation and preventing equivalent audits from receiving different valid digests.
 - Grounded `derived_sensitivity` doctoring on GDPR Article 4(1)/Recital 26 and WP29 Opinion 4/2007 (WP 136) as read from the official texts, and replaced the withdrawn ISO/IEC 29100:2011 use-limitation overclaim with the current 29100:2024 catalogue edition without quoting unread clause text.
 - Added APA 7th method citations (Allen 1983; ISO 24617-1:2012; Hobbs & Pan 2017; Fox & Glas 2001; AERA/APA/NCME 2014; Blei & Lafferty 2006; Roberts et al. 2014, 2019; Chang & Blei 2009; Mimno et al. 2009; Asparouhov & Muthén 2009; Asparouhov et al. 2018; Marsh et al. 2014; Aitchison 1982; Allan 2002; Li et al. 2021; Anagnostopoulos et al. 2013) into ADRs 0002–0005, 0012, and 0016, plus TRACEABILITY/ARCHITECTURE/TRD method rows. Clarified that TRSL-TM is the product contract, STM-style logistic-normal is the reference family, ESEM/DSEM/TDT/CHRONOS remain accepted-target, and merged PRs #8/#9—not superseded drafts #5/#6—are the protected-main temporal lineage.

Cargo.toml

@@ -11,6 +11,7 @@ members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/provider_receipt",
     "crates/operational_log",
     "crates/service_tls",
     "crates/derived_sensitivity",
@@ -32,6 +33,7 @@ default-members = [
     "crates/tepp_simulation",
     "crates/validation_core",
     "crates/tepp_api",
+    "crates/provider_receipt",
     "crates/operational_log",
     "crates/service_tls",
     "crates/derived_sensitivity",

README.md

@@ -33,6 +33,7 @@ crates/corpus_split
 crates/tepp_simulation
 crates/validation_core
 crates/tepp_api
+crates/provider_receipt
 crates/operational_log
 crates/service_tls
 crates/derived_sensitivity

crates/provider_receipt/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "provider_receipt"
+description = "Provider-disclosure receipts that refuse source text and identity."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+readme.workspace = true
+keywords.workspace = true
+categories.workspace = true
+publish = false
+
+[lints]
+workspace = true

crates/provider_receipt/src/error.rs

@@ -0,0 +1,64 @@
+//! Fail-closed provider-receipt errors.
+
+use std::fmt;
+
+/// A fail-closed provider-receipt error.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[non_exhaustive]
+pub enum ProviderReceiptError {
+    /// Raw source text was supplied to a provider receipt.
+    SourceTextNotDisclosable,
+    /// Source identity was supplied to a provider receipt.
+    SourceIdentityNotDisclosable,
+    /// Blanket PII masking was treated as a disclosure grant.
+    BlanketMaskIsNotAuthorization,
+    /// A receipt or recovery slice was empty or length-mismatched.
+    InvalidReceiptPayload,
+}
+
+impl fmt::Display for ProviderReceiptError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let message = match self {
+            Self::SourceTextNotDisclosable => "source text cannot appear in a provider receipt",
+            Self::SourceIdentityNotDisclosable => {
+                "source identity cannot appear in a provider receipt"
+            }
+            Self::BlanketMaskIsNotAuthorization => {
+                "blanket PII masking is not provider-disclosure authorization"
+            }
+            Self::InvalidReceiptPayload => "invalid provider-receipt payload",
+        };
+        formatter.write_str(message)
+    }
+}
+
+impl std::error::Error for ProviderReceiptError {}
+
+#[cfg(test)]
+mod tests {
+    use super::ProviderReceiptError;
+
+    #[test]
+    fn error_messages_are_stable() {
+        for (error, message) in [
+            (
+                ProviderReceiptError::SourceTextNotDisclosable,
+                "source text cannot appear in a provider receipt",
+            ),
+            (
+                ProviderReceiptError::SourceIdentityNotDisclosable,
+                "source identity cannot appear in a provider receipt",
+            ),
+            (
+                ProviderReceiptError::BlanketMaskIsNotAuthorization,
+                "blanket PII masking is not provider-disclosure authorization",
+            ),
+            (
+                ProviderReceiptError::InvalidReceiptPayload,
+                "invalid provider-receipt payload",
+            ),
+        ] {
+            assert_eq!(error.to_string(), message);
+        }
+    }
+}

crates/provider_receipt/src/lib.rs

@@ -0,0 +1,24 @@
+#![forbid(unsafe_code)]
+#![deny(missing_docs)]
+#![allow(clippy::cast_precision_loss)]
+//! Provider-disclosure receipts that refuse source text and identity.
+//!
+//! A receipt records which field codes were sent to a model provider under one
+//! purpose. It cannot carry source text or source identity, and blanket PII
+//! masking is not a disclosure grant (ADR 0009).
+
+mod error;
+mod receipt;
+
+/// Fail-closed provider-receipt errors.
+pub use error::ProviderReceiptError;
+/// One provider-disclosure receipt of field codes under a purpose.
+pub use receipt::ProviderReceipt;
+/// Fraction of recovered field codes that match known truth.
+pub use receipt::receipt_recovery_rate;
+/// Refuse to treat a blanket PII mask as provider-disclosure authorization.
+pub use receipt::refuse_blanket_mask_as_disclosure;
+/// Refuse to place source identity in a provider receipt.
+pub use receipt::refuse_source_identity_in_receipt;
+/// Refuse to place raw source text in a provider receipt.
+pub use receipt::refuse_source_text_in_receipt;

crates/provider_receipt/src/receipt.rs

@@ -0,0 +1,128 @@
+//! Purpose-bound field-code receipts for provider disclosure.
+
+use crate::ProviderReceiptError;
+
+/// One provider-disclosure receipt of field codes under a purpose.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct ProviderReceipt {
+    purpose_code: u16,
+    field_codes: Vec<u16>,
+}
+
+impl ProviderReceipt {
+    /// Record the field codes sent to a provider under one purpose.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ProviderReceiptError::InvalidReceiptPayload`] when no field
+    /// codes are supplied.
+    pub fn new(purpose_code: u16, field_codes: &[u16]) -> Result<Self, ProviderReceiptError> {
+        if field_codes.is_empty() {
+            return Err(ProviderReceiptError::InvalidReceiptPayload);
+        }
+        Ok(Self {
+            purpose_code,
+            field_codes: field_codes.to_vec(),
+        })
+    }
+
+    /// Purpose bound to the disclosure.
+    #[must_use]
+    pub const fn purpose_code(&self) -> u16 {
+        self.purpose_code
+    }
+
+    /// Field codes sent, never source text.
+    #[must_use]
+    pub fn field_codes(&self) -> &[u16] {
+        &self.field_codes
+    }
+}
+
+/// Refuse to place raw source text in a provider receipt.
+///
+/// # Errors
+///
+/// Always returns [`ProviderReceiptError::SourceTextNotDisclosable`].
+pub fn refuse_source_text_in_receipt() -> Result<(), ProviderReceiptError> {
+    Err(ProviderReceiptError::SourceTextNotDisclosable)
+}
+
+/// Refuse to place source identity in a provider receipt.
+///
+/// # Errors
+///
+/// Always returns [`ProviderReceiptError::SourceIdentityNotDisclosable`].
+pub fn refuse_source_identity_in_receipt() -> Result<(), ProviderReceiptError> {
+    Err(ProviderReceiptError::SourceIdentityNotDisclosable)
+}
+
+/// Refuse to treat a blanket PII mask as provider-disclosure authorization.
+///
+/// # Errors
+///
+/// Always returns [`ProviderReceiptError::BlanketMaskIsNotAuthorization`].
+pub fn refuse_blanket_mask_as_disclosure() -> Result<(), ProviderReceiptError> {
+    Err(ProviderReceiptError::BlanketMaskIsNotAuthorization)
+}
+
+/// Fraction of recovered field codes that match known truth.
+///
+/// # Errors
+///
+/// Returns [`ProviderReceiptError::InvalidReceiptPayload`] when the field-code
+/// lengths differ.
+pub fn receipt_recovery_rate(
+    truth: &ProviderReceipt,
+    decided: &ProviderReceipt,
+) -> Result<f64, ProviderReceiptError> {
+    if truth.field_codes.len() != decided.field_codes.len() {
+        return Err(ProviderReceiptError::InvalidReceiptPayload);
+    }
+    let mut matches = 0_u32;
+    for (truth_field, decided_field) in truth.field_codes.iter().zip(&decided.field_codes) {
+        if truth_field == decided_field {
+            matches += 1;
+        }
+    }
+    Ok(f64::from(matches) / truth.field_codes.len() as f64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        ProviderReceipt, receipt_recovery_rate, refuse_blanket_mask_as_disclosure,
+        refuse_source_identity_in_receipt, refuse_source_text_in_receipt,
+    };
+    use crate::ProviderReceiptError;
+
+    #[test]
+    fn local_branches_cover_construct_and_fail_closed_paths() {
+        let receipt = ProviderReceipt::new(7, &[1, 2]).expect("receipt");
+        assert_eq!(receipt.purpose_code(), 7);
+        assert_eq!(receipt.field_codes(), &[1, 2]);
+        let matched = receipt_recovery_rate(&receipt, &receipt).expect("rate");
+        assert!((matched - 1.0).abs() < f64::EPSILON);
+        assert_eq!(
+            ProviderReceipt::new(7, &[]),
+            Err(ProviderReceiptError::InvalidReceiptPayload)
+        );
+        let short = ProviderReceipt::new(7, &[1]).expect("short");
+        assert_eq!(
+            receipt_recovery_rate(&receipt, &short),
+            Err(ProviderReceiptError::InvalidReceiptPayload)
+        );
+        assert_eq!(
+            refuse_source_text_in_receipt(),
+            Err(ProviderReceiptError::SourceTextNotDisclosable)
+        );
+        assert_eq!(
+            refuse_source_identity_in_receipt(),
+            Err(ProviderReceiptError::SourceIdentityNotDisclosable)
+        );
+        assert_eq!(
+            refuse_blanket_mask_as_disclosure(),
+            Err(ProviderReceiptError::BlanketMaskIsNotAuthorization)
+        );
+    }
+}

crates/provider_receipt/tests/crate_contract.rs

@@ -0,0 +1,7 @@
+//! Integration contract for the `provider_receipt` package identity.
+
+#[test]
+fn package_identity_is_stable() {
+    let observed = std::hint::black_box(env!("CARGO_PKG_NAME"));
+    assert_eq!(observed, "provider_receipt");
+}

crates/provider_receipt/tests/receipt_contract.rs

@@ -0,0 +1,62 @@
+//! Provider receipts cannot carry source text, identity, or a blanket mask.
+
+use provider_receipt::{
+    ProviderReceipt, ProviderReceiptError, receipt_recovery_rate,
+    refuse_blanket_mask_as_disclosure, refuse_source_identity_in_receipt,
+    refuse_source_text_in_receipt,
+};
+
+fn receipt(purpose: u16, fields: &[u16]) -> ProviderReceipt {
+    ProviderReceipt::new(purpose, fields).expect("receipt")
+}
+
+#[test]
+fn source_text_identity_and_blanket_mask_cannot_enter_a_receipt() {
+    assert_eq!(
+        refuse_source_text_in_receipt(),
+        Err(ProviderReceiptError::SourceTextNotDisclosable)
+    );
+    assert_eq!(
+        refuse_source_identity_in_receipt(),
+        Err(ProviderReceiptError::SourceIdentityNotDisclosable)
+    );
+    assert_eq!(
+        refuse_blanket_mask_as_disclosure(),
+        Err(ProviderReceiptError::BlanketMaskIsNotAuthorization)
+    );
+}
+
+#[test]
+fn recovered_field_codes_match_known_truth_better_than_a_collapsed_set() {
+    let truth = receipt(7, &[1, 2, 3]);
+    let recovered = receipt(7, &[1, 2, 3]);
+    let collapsed = receipt(7, &[1, 1, 1]);
+    let recovered_rate = receipt_recovery_rate(&truth, &recovered).expect("recovered");
+    let collapsed_rate = receipt_recovery_rate(&truth, &collapsed).expect("collapsed");
+    let expected = {
+        let mut matches = 0_u32;
+        for (truth_field, decided_field) in truth.field_codes().iter().zip(recovered.field_codes())
+        {
+            if truth_field == decided_field {
+                matches += 1;
+            }
+        }
+        f64::from(matches) / f64::from(u32::try_from(truth.field_codes().len()).expect("len"))
+    };
+    assert!((recovered_rate - expected).abs() < f64::EPSILON);
+    assert!(recovered_rate > collapsed_rate);
+}
+
+#[test]
+fn empty_or_mismatched_receipt_payloads_fail_closed() {
+    assert_eq!(
+        ProviderReceipt::new(7, &[]),
+        Err(ProviderReceiptError::InvalidReceiptPayload)
+    );
+    let truth = receipt(7, &[1, 2]);
+    let short = receipt(7, &[1]);
+    assert_eq!(
+        receipt_recovery_rate(&truth, &short),
+        Err(ProviderReceiptError::InvalidReceiptPayload)
+    );
+}

docs/PRIVACY_DATA_GOVERNANCE.md

@@ -82,5 +82,6 @@ Ordinary logs contain identifiers/digests sufficient for diagnosis without copyi
 
 ## 10. Privacy validation
 
+Required tests include cross-tenant denial, expired-purpose denial, re-identification-boundary checks, export authorization, provider payload minimization, raw-source log absence, deletion/retention behavior, audit replay, and derived-sensitive-data classification. Privacy controls must be tested with realistic author/customer/project/multiple-membership cases rather than only anonymous fixtures. The in-memory `provider_receipt` crate is the current disclosure-audit gate; persistence of receipts remains accepted-target.
 Required tests include cross-tenant denial, expired-purpose denial, re-identification-boundary checks, export authorization, provider payload minimization, raw-source log absence, deletion/retention behavior, audit replay, and derived-sensitive-data classification. Privacy controls must be tested with realistic author/customer/project/multiple-membership cases rather than only anonymous fixtures. The in-memory `operational_log` crate is the current source-separation gate: `try_record` is the only recording API and inspects source text, source identity, and blanket-mask intent; a source-identity `&str` cannot become an analytical subject. `persistence_postgres` `audit_event` inserts call the same gate before SQL is rendered. Live HTTP and provider adapters remain accepted-target.
 Required tests include cross-tenant denial, expired-purpose denial, re-identification-boundary checks, export authorization, provider payload minimization, raw-source log absence, deletion/retention behavior, audit replay, and derived-sensitive-data classification. Privacy controls must be tested with realistic author/customer/project/multiple-membership cases rather than only anonymous fixtures. The in-memory `derived_sensitivity` crate is the current inheritance gate; persistence of classifications remains accepted-target.

docs/TRACEABILITY.md

@@ -31,9 +31,8 @@ The full APA 7th standards/literature register remains `docs/research/standards-
 | longitudinal within/between decomposition | ADR 0005 | `longitudinal_core` decomposition, component RMSE, and known-truth recovery on the active PR | active-PR |
 | posterior ESEM / longitudinal invariance / DSEM | ADR 0005 | future `psychometric_core`; invariance and ESEM/DSEM fit remain accepted-target | accepted-target |
 | CPU bounded multithreading + GPU/VRAM streaming/parity | ADR 0001/0006 | future `compute_backend` | accepted-target |
-| TDT detection/tracking | ADR 0016; Allan (2002) | future `event_intelligence` | accepted-target |
-| neural event-schema induction and prediction | ADR 0016; Li et al. (2021) | future `event_intelligence` | accepted-target |
-| symbolic qualitative temporal consistency | ADR 0016; Anagnostopoulos et al. (2013) | future `event_intelligence` | accepted-target |
+| TDT detection/tracking vs CHRONOS schema/prediction/temporal consistency | ADR 0016; PRD/research | future `event_intelligence` | accepted-target |
+| purpose-bound PII handling without blanket masking | ADR 0009; `docs/PRIVACY_DATA_GOVERNANCE.md` | `provider_receipt` field-code disclosure audit on the active PR; persistence/live HTTP remaining | active-PR |
 | evidence-bounded LLM interpretation | ADR 0010/0012; PRD | `tepp_api` router plus future `interpretation_gateway` | partial |
 | adaptive direct/verify/committee/conductor test-time compute | ADR 0010; `docs/LLM_ORCHESTRATION.md` | `tepp_api::route_orchestration` and ablation records implemented-main; live contextual-orchestrator execution remaining | partial |
 | purpose-bound PII handling without blanket masking | ADR 0009; `docs/PRIVACY_DATA_GOVERNANCE.md` | provider-payload minimization, elevated re-identification, retention/deletion, and legal hold implemented-main; `operational_log::try_record` and inspected `audit_event` inserts active-PR; live HTTP/provider adapters remaining | active-PR |