privacy/workflows/advisory-brief-planner.json

{
  "schema_version": 1,
  "workflow": "advisory-brief-planner",
  "display_name": "Plan an advisory assignment",
  "governed_paths": [
    "contracts/advisory_contract.v1.schema.json",
    "scripts/validate_advisory_contract.py",
    "skills/advisory-brief-planner/SKILL.md",
    "skills/advisory-brief-planner/agents/openai.yaml",
    "skills/advisory-brief-planner/references/advisory-contract.md",
    "scripts/self_relaunch.py",
    "scripts/managed_python_runtime.py",
    "scripts/_managed_python_runtime.py",
    "requirements.txt",
    "components.json",
    "scripts/_shared_python_runtime.py",
    "requirements-shared-core.txt",
    "requirements-shared-ocr.txt",
    "constraints-shared-macos-py312.txt",
    "scripts/_python_bootstrap.py",
    "skills/clara/references/workflow-catalog.md"
  ],
  "codex_context": {
    "policy": "real_professional_data_may_enter_codex_context",
    "classes": [
      {
        "id": "assignment-and-selected-inputs",
        "purpose": "Understand the advisory assignment and preserve its controlling facts",
        "content": "The user's natural assignment; selected notes, documents, data descriptions, or prior outputs; real names and entities; dates, figures, constraints, explicit questions, intended decision, audience, deliverable, and language"
      },
      {
        "id": "assignment-contract-and-review",
        "purpose": "Create and review the assignment contract",
        "content": "Included and excluded scope, available and missing inputs, evidence requirements, assumptions, unresolved material questions, analytical approach, success criteria, selected Clara workflow, validation and correction policies, professional judgement boundary, literal source anchors, declared date and number values, generation instructions, and model-led conformance assessments"
      },
      {
        "id": "downstream-workflow-handoff",
        "purpose": "Give an existing Clara workflow the reviewed generation contract",
        "content": "The complete advisory_contract.json, including source facts, questions, input references, expected outputs, and the selected workflow's objective and instructions"
      },
      {
        "id": "local-validation-and-recovery",
        "purpose": "Inspect packaging failures and recover an earlier assignment contract",
        "content": "Source filenames, byte counts and hashes; observational literal inventories containing source dates, numbers, URLs and questions; errors and prior canonical contracts retained at content-hashed recovery paths after a failed attempt. These local artifacts may contain professional information and have no automatic deletion policy in this helper."
      }
    ]
  },
  "ordinary_codex_model_processing": {
    "scope": "content_supplied_to_the_codex_model",
    "account_arrangement": "user_selected_chatgpt_or_codex_account",
    "separate_clara_recipient_or_arrangement": false,
    "automatic_anonymisation": false,
    "local_filter_or_aggregate": "only_when_useful_for_professional_work",
    "plan_visibility": "not_inspected_or_enforced_by_clara"
  },
  "codex_account_boundary": {
    "selected_by": "firm_or_user",
    "clara_runtime_enforcement": "none",
    "review_timing": "before_professional_use_and_when_account_or_terms_change",
    "review_items": [
      "account_or_workspace_plan",
      "model_training_data_controls",
      "retention_and_deletion_controls"
    ],
    "per_case_record_required": false
  },
  "hosted_service_ids": [],
  "boundaries_beyond_codex": [
    {
      "id": "direct-cli-python-dependency-setup",
      "kind": "public_research",
      "destination": "Python Package Index (PyPI) or the index selected by the user's Python configuration",
      "purpose": "Prepare the published shared Vera, Clara and Lucia core dependencies, and validate the selected workflow, in one user-scoped Python 3.12 environment per operating-system host.",
      "content": "Shared published package names and version constraints plus ordinary package-index request metadata. Client files, prompts, case data and generated work are not included in installer requests. Workflow arguments stay in the local child process.",
      "optional": false,
      "requires_confirmation": false,
      "controls": [
        "Only published shared requirements are installed, never requirements derived from client material or prompts.",
        "One fixed environment outside plugin source and client folders is reused across products and modules. Explicitly approved OCR is retained in the same environment.",
        "A reader lease prevents setup from modifying packages while managed workflows run. Setup validates dependencies before writing the readiness receipt. Failed updates leave execution unavailable until repair.",
        "Older plugin policies cannot downgrade an environment created by a newer shared policy revision."
      ]
    },
    {
      "id": "declared-python312-retrieval",
      "kind": "public_research",
      "destination": "Astral python-build-standalone CPython distributions on GitHub, or the Python download mirror explicitly configured in uv",
      "purpose": "Provision the declared CPython 3.12 workflow interpreter when absent, automatically bootstrapping uv if needed",
      "content": "The fixed CPython 3.12 version request, operating-system and architecture selection, and ordinary download request metadata. Setup does not read client files or add prompts, case material or generated reports to this request.",
      "optional": false,
      "requires_confirmation": false,
      "controls": [
        "Use an installed CPython 3.12 when available; otherwise use uv or automatically download the published uv 0.12.10 wheel, verify its pinned SHA-256, and provision private CPython 3.12 without changing system Python or shell profiles.",
        "Probe the selected interpreter before creating the dependency environment; never fall back to executing workflows with another Python minor version.",
        "A failed download or interpreter probe stops setup; existing environments and client files remain intact."
      ]
    }
  ],
  "security_controls": [],
  "review": {
    "reviewed_at": "2026-09-15",
    "reviewed_by": "privacy-surface-review",
    "basis": "external_boundary_review_of_workflow_source",
    "source_fingerprint": "21a3e9d4e7e790d50a4d5fc2a75e035d0d07fae7795a92e1fa6074c63be02f96"
  }
}