privacy/contracts/html-deck.json

{"host_omissions":{"anthropic-cowork":{"paths":{"privacy/services/operational-incidents.json":["scripts/onboarding_session_start.py"],"privacy/services/plugin-feedback.json":["hooks/cowork-hooks.json","scripts/check_for_update.py"],"privacy/services/run-receipt-stamping.json":[".codex-plugin/plugin.json"],"privacy/workstreams/advisory-brief-planner.json":["skills/mparanza-advisory-brief-planner/agents/openai.yaml"],"privacy/workstreams/advisory-case-director.json":["skills/mparanza-advisory-case-director/agents/openai.yaml"],"privacy/workstreams/advisory-deliverable-validator.json":["scripts/finalize_hosted_transcript.py","scripts/integrate_transcript_review.py"],"privacy/workstreams/clara.json":[".codex-plugin/plugin.json","hooks/cowork-hooks.json","skills/mparanza-clara/references/cowork-runtime.md"],"privacy/workstreams/learn-with-clara.json":["assets/onboarding","marketplace_skill_instructions.json","scripts/_desktop_teaching.py","scripts/course_chat_bridge.py","scripts/course_chat_mcp.cjs","scripts/local_onboarding.py","scripts/local_onboarding_case.py","scripts/local_teaching.py","scripts/onboarding_session_start.py","skills/mparanza-clara/references/local-onboarding.md","skills/mparanza-clara/references/tutorial-cases.md"],"privacy/workstreams/management-control-pack.json":[".codex-plugin/plugin.json","shared:vendor/modules/reporting_table.py","shared:vendor/modules/vera_assurance"],"privacy/workstreams/reporting-engine.json":["hooks/cowork-hooks.json","modules/reporting-engine/README.md","scripts/build_monthly_pnl_reporting_handoff.py","skills/mparanza-clara/references/cowork-runtime.md"],"privacy/workstreams/research-video.json":["skills/mparanza-research-video/agents/openai.yaml"],"privacy/workstreams/variance-analysis.json":[".codex-plugin/plugin.json","mcp","shared:vendor/modules/vera_assurance"]},"services":["hosted-interviews","hosted-voice","plugin-update-check","research-video-voice"],"workstreams":["deck-correction","hosted-interview","transcribe"]},"google-antigravity":{"paths":{"privacy/services/on-demand-mcp.json":[".mcp.json"],"privacy/services/operational-incidents.json":[".mcp.json"],"privacy/services/plugin-update-check.json":["hooks/hooks.json"],"privacy/workstreams/clara.json":[".claude-plugin/plugin.json","hooks/hooks.json"],"privacy/workstreams/learn-with-clara.json":[".mcp.json","hooks/hooks.json"],"privacy/workstreams/management-control-pack.json":["shared:vendor/modules/reporting_table.py","shared:vendor/modules/vera_assurance"],"privacy/workstreams/reporting-engine.json":["scripts/build_monthly_pnl_reporting_handoff.py"],"privacy/workstreams/variance-analysis.json":["shared:vendor/modules/vera_assurance"]},"services":[],"workstreams":[]},"openai-chatgpt":{"paths":{"privacy/services/plugin-feedback.json":["hooks/cowork-hooks.json"],"privacy/services/plugin-update-check.json":["hooks/hooks.json"],"privacy/workstreams/clara.json":[".claude-plugin/plugin.json","agents/clara.md","hooks/cowork-hooks.json","hooks/hooks.json"],"privacy/workstreams/learn-with-clara.json":["hooks/hooks.json","marketplace_skill_instructions.json"],"privacy/workstreams/management-control-pack.json":["shared:vendor/modules/reporting_table.py","shared:vendor/modules/vera_assurance"],"privacy/workstreams/reporting-engine.json":["hooks/cowork-hooks.json","scripts/build_monthly_pnl_reporting_handoff.py"],"privacy/workstreams/variance-analysis.json":["shared:vendor/modules/vera_assurance"]},"services":[],"workstreams":[]},"openai-codex":{"paths":{"privacy/workstreams/clara.json":[".claude-plugin/plugin.json","agents/clara.md"],"privacy/workstreams/management-control-pack.json":["shared:vendor/modules/reporting_table.py","shared:vendor/modules/vera_assurance"],"privacy/workstreams/reporting-engine.json":["scripts/build_monthly_pnl_reporting_handoff.py"],"privacy/workstreams/variance-analysis.json":["shared:vendor/modules/vera_assurance"]},"services":[],"workstreams":[]}},"manifest":{"display_name":"HTML Deck","external_boundaries":[{"content":"Published package requirements and ordinary package-index request metadata. Existing workflow arguments are forwarded to a local Python child; they are not included in the pip install command.","controls":["The direct CLI selects published core or registered component requirements before importing workflow modules.","The launcher preserves the working directory and arguments in the local child process; this does not redact arguments or change the workflow data boundary.","An existing matching runtime is reused. Setup installs into a fingerprinted user-scoped environment and propagates failure; it does not install into the case folder."],"destination":"Python Package Index (PyPI) or the index selected by the user's Python configuration","id":"direct-cli-python-dependency-setup","kind":"public_research","optional":false,"purpose":"Prepare the declared Python dependencies before running a documented workflow CLI","requires_confirmation":false,"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":["skills/html-deck/SKILL.md","skills/html-deck/assets","skills/html-deck/references","skills/html-deck/scripts","scripts/verify_advisory_html_delivery.py","scripts/advisory_delivery.py","scripts/advisor_case_core.py","scripts/advisory_evidence_lineage.py","scripts/case_store.py","scripts/bounded_process.py","scripts/self_relaunch.py","scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","requirements.txt","components.json","scripts/advisory_lineage_labels.py"],"model_context":{"classes":[{"content":"Word, PDF, Markdown, spreadsheet, case-workspace, sealed JSON or CSV evidence artifacts, or mixed source material, including names, facts, figures, qualifications, evidence gaps, and advisor judgement","id":"source-and-case-material","purpose":"Build a source-faithful presentation","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Storyline, claims, stable claim and evidence receipt identifiers, dependency edges, evidence bundle and binding records, source hashes, resolved values, slide titles and text, speaker notes, layout choices, content and evidence ledgers, exact hash-bound output appearances written to the shared advisory claim register, workpaper and delivery checkpoints, HTML/CSS, screenshots, and QA findings","id":"deck-work","purpose":"Plan, compose, revise, and review the presentation","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Editable plans and full source ledgers, resolved evidence values, source labels and hashes, speaker notes, final embedded ledgers, ZIPs, previous content-addressed builds, revision maps, screenshots, print-preview PDFs and browser console diagnostics may enter model context. The publication content ledger omits source locators unless publish_locator is true, but retains source labels, IDs, hashes and slide records; this is field filtering, not automatic anonymisation. Hidden notes and JSON remain readable in the HTML. Bound previous builds are retained until separately removed; the cleanup checker does not enforce filesystem access. A hashed directory and noindex metadata provide neither authentication nor a deletion guarantee.","id":"embedded-and-retained-deck-artifacts","purpose":"Review what the deck contains and preserve exact evidence across revisions","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"When a presentation is imported through the shared case helper and requires normalization, local attempt directories retain converted presentation files and converter stdout/stderr logs. They may contain source document content, metadata and local paths, including after failure or cancellation. Reading them supplies their contents to model context. This conditional import path does not mean every workflow execution converts a presentation or sends these files to a hosted service. Retained attempt files remain until separately removed.","id":"shared-case-normalization-attempts","purpose":"Inspect case presentation imports and any normalization diagnostics used by this workflow","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"policy":"real_case_data_may_enter_selected_runtime_model_context"},"public_explanations":{"clara-presentations":{"copy":{"de":["Das Modell liest die Quellen und Prüfunterlagen, die zum Erstellen oder Korrigieren der Präsentation nötig sind.","Das Modell kann Anweisungen, ausgewählte Dokumente und Datendateien, Workpaper, Storyline, Werte und Einschränkungen, Nachweise und Quellenreferenzen, Folienplan, Aussagen und deren Quellenzuordnung erhalten. Bei einer Überarbeitung können außerdem bestehende Präsentation, gerenderte Folien, Feedback, Transkript und Liste der gewünschten Änderungen einfließen.","Der Code setzt Dateien zusammen, rendert und prüft Hashes, Nachweisbindungen und mechanische Vorgaben; er entscheidet nicht über die fachliche Gültigkeit der Aussagen. Die erzeugte Präsentation kann für redaktionelle und visuelle Prüfung erneut vom Modell gelesen werden. Veröffentlichung, Upload oder Weitergabe sind getrennte Schritte und erfolgen nur auf ausdrückliche Anfrage."],"en":["The model reads the sources and review material needed to create or correct the presentation.","The model may receive instructions, selected documents and data files, the workpaper, storyline, values and qualifications, evidence and source references, the slide plan, claims, and the map linking claims to sources. For a revision, it may also receive the existing deck, rendered slides, feedback, transcript, and requested-change list.","Code composes, renders, and verifies files, hashes, evidence bindings, and mechanical constraints; it does not decide whether professional claims are valid. The generated presentation may be read again by the model for editorial and visual review. Publishing, uploading, or sharing is a separate step performed only when explicitly requested."],"es":["El modelo lee las fuentes y el material de revisión necesarios para crear o corregir la presentación.","El modelo puede recibir instrucciones, documentos y archivos de datos seleccionados, el papel de trabajo, la narrativa, valores y salvedades, evidencias y referencias, el plan de diapositivas, las afirmaciones y el mapa que las vincula a las fuentes. En una revisión también puede recibir la presentación existente, diapositivas renderizadas, comentarios, transcripción y lista de cambios solicitados.","El código compone, renderiza y verifica archivos, hashes, vínculos de evidencia y restricciones mecánicas; no decide la validez profesional de las afirmaciones. El modelo puede volver a leer la presentación generada para la revisión editorial y visual. Publicar, cargar o compartir es un paso separado que solo se realiza a petición explícita."],"fr":["Le modèle lit les sources et les éléments de revue nécessaires pour créer ou corriger la présentation.","Le modèle peut recevoir les instructions, documents et fichiers de données sélectionnés, le workpaper, la trame, les valeurs et réserves, les preuves et leurs références, le plan des diapositives, les affirmations et la carte qui les relie aux sources. Pour une révision, il peut aussi recevoir la présentation existante, les diapositives rendues, le feedback, la transcription et la liste des modifications demandées.","Le code compose, rend et vérifie fichiers, empreintes, liens de preuve et contraintes mécaniques ; il ne décide pas de la validité professionnelle des affirmations. La présentation générée peut être relue par le modèle pour le contrôle éditorial et visuel. Publication, envoi ou partage constituent une étape distincte, uniquement sur demande explicite."],"it":["Il modello legge le fonti e il materiale di revisione necessari a creare o correggere la presentazione.","Possono arrivare al modello le istruzioni, i documenti e i file dati selezionati, il workpaper, la storyline, i valori e le qualificazioni, le evidenze e i relativi riferimenti, il piano delle slide, le affermazioni e la mappa che le collega alle fonti. In una revisione possono entrare anche la presentazione esistente, le slide renderizzate, il feedback, la trascrizione e l'elenco delle modifiche richieste.","Il codice compone, renderizza e verifica file, hash, collegamenti delle evidenze e vincoli meccanici; non decide la validità professionale delle affermazioni. La presentazione generata può essere riletta dal modello per il controllo editoriale e visivo. Pubblicazione, upload o condivisione sono passaggi separati e avvengono solo su richiesta esplicita."]},"status":"relevant"}},"review":{"basis":"external_boundary_review_of_workflow_source","reviewed_at":"2026-10-29","reviewed_by":"privacy-surface-review","source_fingerprint":"65e9b8d0fcd4c22ad60772ff1836855df2ba77e769fa5a1dcc40f2796543a392"},"role":"workflow","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":3,"security_controls":[{"control":"Static validation rejects detected remote resource references, external CSS URLs/imports, executable attributes and named dynamic-network/evaluation patterns. These finite syntax checks do not prove that arbitrary JavaScript cannot make network requests. Current browser QA opens a fresh context without a request-interception policy; it is not a network sandbox.","id":"static-resource-and-markup-checks"},{"control":"The embedded content-ledger projection excludes each source locator unless its explicit publish_locator flag is true. It retains source labels, hashes and slide records and does not detect confidential content in those fields.","id":"publication-source-locator-filter"}],"service_ids":["managed-python-runtime","operational-incidents","run-receipt-stamping","workflow-usage"],"workstream":"html-deck"},"product":"clara","registration":{"components":[],"public_pages":[{"languages":["it","en","fr","de","es"],"page_id":"clara-presentations","path":"static/shared/clara-presentations/index.html"}],"role":"workflow","skills":["html-deck"],"source":"product","workflow_ids":["html-deck"]},"runtime_profiles":[{"account_boundary":{"per_case_record_required":false,"product_runtime_enforcement":"none","review_items":["account_or_workspace_plan","model_training_data_controls","retention_and_deletion_controls"],"review_timing":"before_professional_use_and_when_account_or_terms_change","selected_by":"firm_or_user"},"id":"openai-codex","model_processing":{"account_arrangement":"existing_openai_codex_account_or_workspace_selected_by_firm_or_user","automatic_anonymization":false,"destination":"OpenAI model processing used by Codex","local_filtering_or_aggregation":"only_when_useful_for_the_work","local_only":false,"scope":"ordinary_openai_codex_model_processing","separate_product_recipient":false},"provider":"OpenAI","runtime":"Codex","surfaces":["codex"]},{"account_boundary":{"per_case_record_required":false,"product_runtime_enforcement":"none","review_items":["account_or_workspace_plan","model_training_data_controls","retention_and_deletion_controls"],"review_timing":"before_professional_use_and_when_account_or_terms_change","selected_by":"firm_or_user"},"id":"anthropic-cowork","model_processing":{"account_arrangement":"existing_anthropic_claude_account_or_workspace_selected_by_firm_or_user","automatic_anonymization":false,"destination":"Anthropic model processing used by Cowork","local_filtering_or_aggregation":"only_when_useful_for_the_work","local_only":false,"scope":"ordinary_anthropic_cowork_model_processing","separate_product_recipient":false},"provider":"Anthropic","runtime":"Cowork","surfaces":["cowork"]},{"account_boundary":{"per_case_record_required":false,"product_runtime_enforcement":"none","review_items":["account_or_workspace_plan","model_training_data_controls","retention_and_deletion_controls"],"review_timing":"before_professional_use_and_when_account_or_terms_change","selected_by":"firm_or_user"},"id":"openai-chatgpt","model_processing":{"account_arrangement":"existing_chatgpt_account_or_workspace_selected_by_firm_or_user","automatic_anonymization":false,"destination":"Model provider selected in ChatGPT","local_filtering_or_aggregation":"only_when_useful_for_the_work","local_only":false,"scope":"ordinary_chatgpt_model_processing","separate_product_recipient":false},"provider":"OpenAI","runtime":"ChatGPT","surfaces":["chatgpt"]},{"account_boundary":{"per_case_record_required":false,"product_runtime_enforcement":"none","review_items":["account_or_workspace_plan","model_training_data_controls","retention_and_deletion_controls"],"review_timing":"before_professional_use_and_when_account_or_terms_change","selected_by":"firm_or_user"},"id":"google-antigravity","model_processing":{"account_arrangement":"existing_antigravity_account_or_workspace_selected_by_firm_or_user","automatic_anonymization":false,"destination":"Model provider selected in Antigravity","local_filtering_or_aggregation":"only_when_useful_for_the_work","local_only":false,"scope":"ordinary_antigravity_model_processing","separate_product_recipient":false},"provider":"selected_in_host","runtime":"Antigravity","surfaces":["antigravity"]}],"schema_version":1,"scope":"reviewed_source_contract_not_observed_run_or_hosted_deployment","services":{"managed-python-runtime":{"display_name":"Managed Python runtime","external_boundaries":[{"activation":"automatic_on_first_use","content":"Published shared package names and version constraints plus ordinary package-index request metadata. No client files, prompts, case data, credentials, or generated work are sent by this runtime installer.","controls":["Only published shared core and explicitly selected OCR recipes are installed; package names are never derived from client material or prompts.","Host network denials stop package retrieval. Retry only the same declared setup after the host user or administrator authorizes registry access; never change host network settings or use an alternate installer to evade a denial.","Readiness probes the managed CPython 3.12 interpreter locally with isolated Python and site loading disabled, checks completed installation metadata, then checks the selected declared package versions and component imports in that interpreter. Recipe revisions, backend bytes and historical platform labels do not block a compatible environment. Compatible reuse leaves installation receipts unchanged; actual missing or incompatible dependencies require serialized repair.","All three products and their modules use the same environment. Optional OCR requires approval and is then retained in that environment. A shared environment is not a boundary between client matters."],"destination":"Python Package Index (PyPI), using the published dependency lock","id":"declared-core-dependency-retrieval","kind":"hosted_service","optional":false,"purpose":"Prepare the published shared Vera, Clara and Lucia core requirements and explicitly approved optional OCR in one user-scoped Python 3.12 environment per operating-system host.","requires_confirmation":false,"retention":"Packages remain in one fixed user-scoped environment outside plugin source and client folders until explicitly removed. The default location is ~/.local/share/mparanza/runtime/venv on macOS and Linux, and LOCALAPPDATA/mpr/venv on Windows; MPARANZA_RUNTIME_ROOT may override the parent. Enabled OCR remains enabled across later core updates. Package-index request-log retention is controlled by PyPI. Failed updates invalidate the readiness receipt and require repair before execution; this shared environment has no retained generations. Verified temporary code copies are owned by the creating command and removed after completion, failure or cooperative cancellation, with process-exit retry if deletion is temporarily blocked. Preflight verification does not lease a persistent code copy. Installed code, client files and retained professional outputs are not removed. Forced termination or power loss may leave an orphan. On macOS and Linux, fresh code snapshots and native bootstrap copies have private sidecar device/inode records and shared kernel flock leases. Detached native workers inherit the snapshot lease. Normal termination signals stop intake and retain accepted jobs until completion; SIGKILL or power loss can leave copies, recovered on a later verified startup only after an exclusive nonblocking lease proves no holder remains and the directory identity matches. Unmarked historical copies, replaced directories, symlinks and live leases are retained. Lease records contain technical directory identity only, remain outside the indexed code and client folders, and are not returned to the model or sent to a service. Windows retains process-owned cleanup without automatic POSIX orphan recovery. Managed CLI command children independently acquire and inherit the same snapshot lease before launch; a terminated launcher cannot release a surviving helper's code. The child keeps that kernel lease until its actual exit. Automatic recovery accepts only lease protocol 2, which guarantees both native-worker and CLI-child inheritance. Older protocol-1 records remain uncollected even without a holder, because legacy helpers may be untracked; current CLI calls may still borrow their leases. Persistent shared-code device/inode metadata is renewed locally after complete package byte verification and a stable identity check during the current verification. This allows filesystem remounts without trusting a stale identity as executable authority. Modified bytes and directory changes during verification remain rejected; unverified replacements do not become eligible for collection. No client content or identity metadata is transmitted by this renewal. Before collecting an inactive package containing Journal Sampling, the collector preserves its index-verified module and unchanged package index under runtime/journal-sampling-replay, independently of idle-release limits. This local archive retains shipped code only, without product launchers or client data, until explicitly removed. Vouching validates the complete historical receipt set again and uses a private read-only replay; archived modules cannot launch new product work. If preservation fails, the original release remains available and current work continues. Removal of this replay archive can make historical verification unavailable.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"The fixed CPython 3.12 version request, operating-system and architecture selection, and ordinary download request metadata. Setup does not read client files or add prompts, case material or generated reports to this request.","controls":["Use an installed CPython 3.12 when available; otherwise use uv or automatically download the published uv 0.12.10 wheel, verify its pinned SHA-256, and provision private CPython 3.12 without changing system Python or shell profiles.","Probe the selected interpreter before creating the dependency environment; never fall back to executing workflows with another Python minor version.","A failed download or interpreter probe stops setup; existing environments and client files remain intact."],"destination":"PyPI files.pythonhosted.org for the pinned uv bootstrap, and Astral python-build-standalone CPython distributions on GitHub","id":"declared-python312-retrieval","kind":"hosted_service","optional":false,"purpose":"Provision the single supported CPython 3.12 interpreter when it is absent, automatically bootstrapping uv if needed","requires_confirmation":false,"retention":"When uv must be bootstrapped, the bootstrap executable and private interpreter remain inside shared runtime storage until removed. Download request-log retention is controlled by the providers.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"Random installation UUID and opaque capability, Vera/host/runtime versions, platform and workflow technical IDs, failed stage, complete available technical diagnostic chains and measurements, explicit missing-measurement reasons, retry IDs and actual recovery outcomes. No professional helper stdout, client documents, case text, user prompts or arbitrary task logs. Known path, email and credential patterns are removed from technical messages; this mechanical filter does not establish semantic privacy. The host agent must select technical evidence without unrelated personal/client material. The remote channel does not read local files. Failed helpers retain complete stderr privately on disk; stderr may include unrelated private/client text and is read by the selected host model for semantic review under its existing account. Raw stderr is not forwarded to Mparanza. Only reviewed relevant technical diagnostics, linked by the original report UUID, are submitted as supplemental evidence. Professional stdout is not captured. Managed helpers also send source-bound exception classes, OS error numbers, package-relative stack coordinates, developer-authored error templates and missing required option names automatically. Dynamic exception/argument values, locals, professional stdout and arbitrary source excerpts are not part of these structured events. Process-session UUIDs, persistent operation UUIDs and optional keyed digests of existing run/input-receipt identities bind attempts without disclosing receipt fields or raw client-input hashes. Actual worker interpreter/platform fields are separate from the reporter's interpreter. Capture completeness, pending semantic review, exact remedy/retry events and host verification of the original task remain distinct evidence states; a structured event is not a semantic diagnosis. Installation-preparation failures also include stack coordinates from the independently digest-verified verification module, the numeric Windows error code when available, and the failed pathname character count. The pathname itself, exception message and values, locals and client contents are excluded from these automatic fields. These technical facts establish capture, not diagnosis or recovery. Windows execution snapshots use extended filesystem paths in the existing private runtime location without changing machine policy, access controls or network destinations.","controls":["Only closed technical transport schemas are accepted; unknown fields and arbitrary recovery commands are rejected.","The fixed HTTPS transport refuses redirects. Reporting failures retain the outbox and do not discard professional outputs.","The remote connector is independent of local command-process startup. If the host cannot expose/connect it, no successful report is claimed.","Only two built-in setup/preparation retries may execute automatically, once per remedy revision. Client documents, ACLs and security settings are not changed.","A published update is not recovery. The failed operation must actually execute successfully before that installation delivery closes.","Supplemental diagnostics require ownership of the original report and matching execution metadata; they are stored separately and cannot change the original report UUID, delivery status or remedy revision. Raw local diagnostic files can only be removed by acknowledging a matching recorded supplement.","Actionable remedies target an explicit original report. Each delivery uses its own applicable revision; a different report with the same generic signal does not inherit that remedy.","A cached actual connector status permits only the two fixed retries for an existing matching local receipt and latest report. It performs no direct HTTP polling or identity adoption. Missing local receipts cannot be fabricated to authorise a retry.","A helper success records readiness. Host AI verification of the original task and inputs is required for all recovered outcomes, including setup/startup. Delayed failures cannot reopen an already recovered episode.","Failed fixed retries retain complete stderr privately for semantic review. Raw recovery stderr is not automatically transmitted.","An explicitly selected MPARANZA_INCIDENT_DELIVERY=local-only setting blocks automatic client HTTP transport for this execution while preserving local evidence. Incident queues are durably marked and not automatically flushed later; this does not make model-provider processing local-only."],"destination":"Mparanza HTTPS operational-incident API and Streamable HTTP MCP endpoint","id":"runtime-failure-incident-delivery","kind":"hosted_service","optional":false,"purpose":"Diagnose observed execution/setup failures, return installation-specific remedies and receive actual recovery outcomes","requires_confirmation":false,"retention":"Local capability, pending reports and receipts persist outside client folders. The service retains incident, report, remedy and outcome records; no automatic deletion period is enforced. Status access is scoped by the opaque capability. Pending diagnostic pointers and raw stderr persist in the private incident directory until a matching actual recorded supplementation receipt is acknowledged; unsuccessful review or delivery retains them. Supplementation never replaces the original recovery episode or reopens recovered records. Recorded original/outcome receipts can acknowledge only their exact local queued UUID without replacing the local capability or saved connector identity. Remedy revisions are retained from the surviving migration revision onward; overwritten legacy revisions are not reconstructed.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":["components.json","scripts/check_dependencies.py","scripts/_managed_python_runtime.py","scripts/managed_python_runtime.py","skills/clara/SKILL.md","scripts/_shared_python_runtime.py","scripts/_locked_dependencies.py","requirements-shared-core.lock","requirements-shared-ocr.lock","requirements-shared-core.txt","requirements-shared-ocr.txt","constraints-shared-macos-py312.txt","scripts/_python_bootstrap.py","scripts/verified_execution.py","scripts/operational_incidents.py","scripts/technical_runner.py"],"governed_repository_paths":["plugins/_shared/vendor/modules/vera_assurance/recovery.py"],"review":{"basis":"external_boundary_review_of_shared_service_source","reviewed_at":"2026-11-06","reviewed_by":"privacy-surface-review","source_fingerprint":"efadc372d1d61ac520106289bc159056b3d4d600771d8d0b412f3ade8ac81059"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Setup validates package-relative selections and installs the published shared recipe. No package names or dependency instructions are accepted from client documents. Managed pip ignores inherited PIP_* options and all pip configuration files, so ambient dry-run or target settings cannot skip or redirect installation. The published command and hash lock choose dependencies and their destination environment. Ordinary proxy and CA environment settings remain available. This changes setup configuration only; no professional content is read or sent.","id":"published-requirements-only","implemented_by":["scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","scripts/_shared_python_runtime.py"],"on_violation":"An unknown module, missing requirements file, invalid target, or failed dependency validation stops the helper instead of executing it in a partial environment."},{"control":"One fixed environment is located outside plugin source and client folders. An exclusive operating-system installation lock waits for running managed Python readers, which hold a shared lease through a startup hook. Setup removes the ready receipt before mutation and restores it only after pip check and component validation. Failed setup leaves execution unavailable until repair. Symlink roots, locks and metadata are rejected. The installer is launched from base Python to avoid self-deadlock. This lease is concurrency protection, not a security sandbox. Other historical environments are not automatically deleted. State metadata normally uses atomic replacement. Only EXDEV or Windows error 17 falls back under the same installer lock to a single-link regular-file write with full-byte writes and fsync. Failed writes attempt to restore existing metadata or remove a newly created file; the ready receipt remains invalid until setup succeeds. This fallback is local and does not add a recipient or payload.","id":"user-scoped-runtime-isolation","implemented_by":["scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","scripts/_shared_python_runtime.py"],"on_violation":"A target creation or validation failure returns a bounded setup error and the requested helper is not run."},{"control":"For the six explicitly supported assured modules, the launchers verify the complete package inventory and stable regular-file bytes against the embedded build-generated SHA-256 index. Symlinks, reparse entries, special files, extra directories/files, missing or changed code and unstable reads stop preparation. Unchanged hardlinked package code is materialized into a fresh private OS temporary directory; each copied file is re-read and must have one physical link, then the unchanged component integrity validator must pass. The managed installation and aliases are not modified. The copy contains indexed product code/assets, not client documents, credentials, workflow reports or dependency environments. This local index detects package drift; it is not a publisher signature, a signed origin attestation or proof of installed-host acceptance. The command releases its own temporary code copy after success, failure or cancellation; process-exit cleanup retries pending copies. Ownership is recorded by process ID and directory identity, so borrowed installations, caller paths and replaced roots are not deleted. Forced termination, power loss or persistent file locks can leave an orphan. Cleanup failures log the temporary path and local OS error; they do not add an external recipient or transmit client content. The root-level host .in_use directory is non-executable bookkeeping: only ASCII numeric, ordinary single-link regular marker files are excluded from the product inventory. Nested directories, links, reparse points and non-numeric names there are rejected. Marker contents are not read, executed, transmitted or included in a recovery copy; host markers and installed product files are not modified. On macOS and Linux, fresh code snapshots and native bootstrap copies have private sidecar device/inode records and shared kernel flock leases. Detached native workers inherit the snapshot lease. Normal termination signals stop intake and retain accepted jobs until completion; SIGKILL or power loss can leave copies, recovered on a later verified startup only after an exclusive nonblocking lease proves no holder remains and the directory identity matches. Unmarked historical copies, replaced directories, symlinks and live leases are retained. Lease records contain technical directory identity only, remain outside the indexed code and client folders, and are not returned to the model or sent to a service. Windows retains process-owned cleanup without automatic POSIX orphan recovery. Managed CLI command children independently acquire and inherit the same snapshot lease before launch; a terminated launcher cannot release a surviving helper's code. The child keeps that kernel lease until its actual exit. Automatic recovery accepts only lease protocol 2, which guarantees both native-worker and CLI-child inheritance. Older protocol-1 records remain uncollected even without a holder, because legacy helpers may be untracked; current CLI calls may still borrow their leases.","id":"verified-code-copy-before-assured-execution","implemented_by":["scripts/verified_execution.py","scripts/check_dependencies.py","scripts/managed_python_runtime.py"],"on_violation":"Preparation failures and host permission denials stop execution. A failed private copy is removed; no installation chmod/unlink/manual repair, alternate sandbox or relaxed component validation is permitted."},{"control":"The parent Vera launcher reports a negative exit code or 137/247 as forced termination. It writes execution_failure.json only inside the selected workflow context output directory or its normalization/sample subdirectories; without that matching context it logs only. The diagnostic stores workflow/run identifiers, exit status and an explicit statement that memory exhaustion is not established by the exit code. It makes no model calls or network requests.","id":"worker-forced-termination-diagnostic","implemented_by":["scripts/managed_python_runtime.py"],"on_violation":"A worker failure remains failure; diagnostic persistence errors are logged rather than converted into a success."},{"control":"The standalone Python bootstrap passes uv only declared host paths, locale, proxy, CA and cache settings, preserving original environment-name casing. Unrelated token/API-key variables and inherited UV_*, VIRTUAL_ENV, CONDA_PREFIX, PYTHONHOME and PYTHONPATH are excluded; private UV_PYTHON_* and UV_CACHE_DIR values are set by the bootstrap. The same environment is used for interpreter discovery and its local probe.","id":"python-installer-environment-allowlist","implemented_by":["scripts/_python_bootstrap.py"],"on_violation":"Undeclared environment names are absent from every bootstrap child process."},{"control":"The built-in incident dependency-setup retry uses the shared host/runtime environment allowlist, named runtime/state locations and recovery recursion guard instead of inheriting unrelated user tokens and keys.","id":"helper-environment-allowlist","implemented_by":["scripts/operational_incidents.py"],"on_violation":"Undeclared environment names are absent from the child environment."},{"control":"When the maintained launcher itself runs under Python -I -B, it restores only its own resolved scripts directory for sibling technical-diagnostic imports. It does not add the caller working directory. Helper execution, diagnostic retention and explicit incident delivery policy remain unchanged.","id":"isolated-launcher-owned-imports","implemented_by":["scripts/managed_python_runtime.py"],"on_violation":"The maintained launcher must stop rather than resolving technical diagnostics from the caller working directory."},{"control":"When a managed helper carries a selected Archive context, the launcher checkpoints that exact run before and after the helper. Owner-private storage outside the selected archive retains deduplicated admitted inputs, source-receipt snapshots, completed outputs and run headers. It adds local copies with no external upload or automatic deletion. Recovery selects the same IDs and exact byte hashes, retains changed evidence and refuses unrelated destinations. Missing optional checkpoint storage does not hide a committed result or invalidate unchanged available inputs. The selected model may receive checkpoint status, technical identities and local context/output paths from the owning tool; copying bytes itself does not send them to a model. Standalone helpers without Archive context do not create an Archive run.","id":"admitted-archive-work-checkpoints","implemented_by":["scripts/_managed_python_runtime.py","repository:plugins/_shared/vendor/modules/vera_assurance/recovery.py"],"on_violation":"Keep the same job and accessible completed work, expose checkpoint availability separately, and recover only from actual verified copies at an authorized destination. Do not claim inaccessible or unsaved bytes were recovered."}],"service_id":"managed-python-runtime"},"operational-incidents":{"display_name":"Automatic operational incident recovery","external_boundaries":[{"activation":"automatic_session_start","content":"Random installation UUID and opaque capability, Clara/host/runtime versions, platform and workflow technical IDs, failed stage, complete available technical diagnostic chains and measurements, explicit missing-measurement reasons, retry IDs and actual recovery outcomes. No professional helper stdout, client documents, case text, user prompts or arbitrary task logs. Known path, email and credential patterns are removed from technical messages; this mechanical filter does not establish semantic privacy. The host agent must select technical evidence without unrelated personal/client material. The remote channel does not read local files. Reporting uses ordinary HTTPS with local capabilities or a browser cookie. Remote MCP endpoints and their OAuth authorization routes are retired. The server stores capability hashes and random owner UUIDs. Previously retained OAuth hashes, callback metadata and reporting records are not deleted by endpoint retirement. No personal account signup, user profile, email or client-file permission is involved. Failed helpers retain complete stderr privately on disk; stderr may include unrelated private/client text and is read by the selected host model for semantic review under its existing account. Raw stderr is not forwarded to Mparanza. Only reviewed relevant technical diagnostics, linked by the original report UUID, are submitted as supplemental evidence. Professional stdout is not captured. Installation-preparation failures submit only a fixed technical message, exception type/errno, or the indexed package-relative file name and expected/observed SHA-256 values for a content mismatch. No altered file contents or professional files are read for this report. Managed helpers also send source-bound exception classes, OS error numbers, package-relative stack coordinates, developer-authored error templates and missing required option names automatically. Dynamic exception/argument values, locals, professional stdout and arbitrary source excerpts are not part of these structured events. Process-session UUIDs, persistent operation UUIDs and optional keyed digests of existing run/input-receipt identities bind attempts without disclosing receipt fields or raw client-input hashes. Actual worker interpreter/platform fields are separate from the reporter's interpreter. Capture completeness, pending semantic review, exact remedy/retry events and host verification of the original task remain distinct evidence states; a structured event is not a semantic diagnosis. Current reporting-process version, protocol capabilities and server last-seen time are retained per process session, separately from historical failure versions; they do not establish that all conversations updated. Native-host binding, when invoked, accepts a random host UUID and scoped capability plus an optional explicit native-app label at the same incident service. Only the host capability hash is retained server-side. Stable app-profile UUIDs are derived from host UUID and app label; reporter-instance UUIDs may be task-local and do not count physical computers, plugin copies or people. App grouping grants no additional client status or outcome access. Operator views retain each original report, supplement, outcome and retry event with its actual reporting owner and server receipt time; missing historical task identity is not reconstructed. The native stdio identity bridge verifies its indexed entry, reporter, technical collector and product metadata, then executes an isolated temporary reporter snapshot using existing Python without installing dependencies. Its tool accepts only an existing reporter capability and sends host proof to the fixed register endpoint; it never returns the device key or copies the reporter key into the host identity file. Native broker version/session observations are retained separately from guest reporter and failure-worker observations. When local tools are unavailable, browser reporting depends on the host exposing permitted browser controls. If those controls are absent, delivery remains unverified. Browser identity is distinct from physical-host linkage; no device controls or folder permissions are expanded automatically. Native-helper failures return source-bound exception classes, errno or HTTP status, package-relative frames and developer-authored templates. Dynamic diagnostic values are not returned; unavailable capture is explicit. This bridge does not return raw stderr or device keys. The central recovery agent may request named technical evidence surfaces through a diagnostic-request remedy. The host AI replies with reviewed technical facts, the original report UUID and request revision. Original-task availability is represented by technical booleans, not task text, client identifiers or file contents. A resume remedy communicates a diagnosed correction to the existing authorized workflow; it does not carry executable code. Technical requests, response UUIDs, applicable revisions and their observed status are retained with the original episode. The central agent may implement and deploy incident-related software fixes through reviewed source and green CI under Fabio’s explicit recovery authorization; it does not receive professional case files or gain user-host permissions. Handled Studio Archive exceptions log their active traceback locally before returning the existing error JSON, allowing the same source-bound collector and host semantic review to retain their actual cause. The operator derives diagnostic publication, exact owner/report/revision receipt and reply states, the existing 15-minute deadline and reporting-owner last service contact from retained records. These delivery facts do not establish physical-host availability, diagnosis or original-task recovery. The operator also projects exact delivery, retry and original-task outcome evidence for all actionable remedy kinds, including software updates. Its 15-minute attention cadence is not an execution timeout. A local alert renderer uses technical incident facts and an AI-reviewed blocker, accountable next action, reason and scheduled check. An optional operator-maintained device label is accepted only with a recorded exact-device verification reference; it is not inferred from the recipient, OS or reporter identity. Rendered operator alerts may include opaque machine/case codes and a verified operator-device label, but no client contents, raw diagnostics, personal identifiers or credentials. The renderer neither sends email nor accesses the registry or client files. It rejects stale followup reviews and cannot assign an unreceived or overdue remedy back to the uncontacted Clara. Recovered labels require matching actual original-task success evidence; incomplete historical bindings remain unknown. The shared API also exposes a separate public workflow-testing endpoint: an allowlisted map of pipeline IDs to testing levels and baseline metadata, without incident details, computer IDs, run IDs or user feedback. Its reset is operator-only and does not change incident records. Native workflow transport supplies the same existing host proof during registration when it is available. The shared managed launcher also reports handled PDF recovery failures and subsequent attempts for journal-sampling and journal-bank-reconciliation. It projects fixed strategy/check identifiers, pass/fail/replay flags and attempt/readable-row counts only; PDF text, amounts, paths, adapter code and free-text rationale remain local. Supplements reuse the original report identity across process sessions and cannot certify original-task recovery. Other products carry the shared implementation but do not expose these journal workflows. Bank PDF inspection failures and subsequent corrections are linked per source, independently of journal failures. The bank source digest used in the episode key stays in local reporting state and is not added to transmitted evidence. Other bank statements cannot inherit that extraction recovery. The same native bridge also exposes the fixed task-usage operations documented by the workflow-usage service, with a verified usage-client/catalogue snapshot and task-scoped persistence. Those operations use the existing installation/computer capabilities internally and do not accept credentials, paths, commands or client documents. Error results include SQLite symbolic error codes where available; no raw database contents or diagnostic values are returned. Producer-authored exception measurements may additionally include integer and boolean technical facts with technical identifiers. The Archive state-directory rejection supplies observed POSIX mode, forbidden permission bits, private creation mode, owner/process UID and GID, directory/symlink flags, selection source (explicit, environment or default), and whether creation was requested. It does not transmit the directory path, environment values, client contents, exception arguments or locals. The operator alert displays these facts and package stack coordinates only for its exact original report and linked supplements. The replacement transport preserves the same closed reporting payloads. Browser cookies and optional original local credentials authenticate only; they are not diagnostic fields. Browser status and acknowledgements enter the selected host model context when the agent reads the rendered response. The schema view returns field definitions, not stored user data. The browser fallback sends no professional documents or raw model-data report. Schema rejections now return at most twenty structured error locations and types. Unknown caller-defined keys become unrecognized_field; submitted values, validation context and arbitrary validator messages are excluded. The complete-capture requirement has a fixed explanation naming error_code or technical_frames. The native client reads at most 16 KiB of that response and retains the original owner and rejected request UUID for correction. This does not deliver a rejected supplement or close its incident. Installation-preparation failures also include stack coordinates from the independently digest-verified verification module, the numeric Windows error code when available, and the failed pathname character count. The pathname itself, exception message and values, locals and client contents are excluded from these automatic fields. These technical facts establish capture, not diagnosis or recovery. Windows execution snapshots use extended filesystem paths in the existing private runtime location without changing machine policy, access controls or network destinations.","controls":["Only closed technical transport schemas are accepted; unknown fields and arbitrary recovery commands are rejected.","The fixed HTTPS transport refuses redirects. Reporting failures retain the outbox and do not discard professional outputs.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Only two built-in setup/preparation retries may execute automatically, once per remedy revision. Client documents, ACLs and security settings are not changed.","A published update is not recovery. The failed operation must actually execute successfully before that installation delivery closes.","Supplemental diagnostics require ownership of the original report and matching execution metadata; they are stored separately and cannot change the original report UUID, delivery status or remedy revision. Raw local diagnostic files can only be removed by acknowledging a matching recorded supplement.","Actionable remedies target an explicit original report. Each delivery uses its own applicable revision; a different report with the same generic signal does not inherit that remedy.","A cached actual browser or legacy connector status permits only the two fixed retries for an existing matching local receipt and latest report. It performs no direct HTTP polling or identity adoption. Missing local receipts cannot be fabricated to authorise a retry.","A helper success records readiness. Host AI verification of the original task and inputs is required for all recovered outcomes, including setup/startup. Delayed failures cannot reopen an already recovered episode.","Failed fixed retries retain complete stderr privately for semantic review. Raw recovery stderr is not automatically transmitted.","Actual cached browser or legacy connector status reconciles only readiness hints bound to existing local report receipts. Readiness becomes action-required evidence rather than recovery; already recovered matching hints are cleared and unlinked hints are retained. No remote receipt is fabricated and no case inputs are inferred.","Before reporting an installation-preparation failure, the preflight verifies the reporting script, preflight script and product metadata against a stable build index, then snapshots them in a fresh private temporary directory and executes the reporter in isolated Python. Original-installation, cwd and PYTHONPATH imports are excluded. Damaged workflow code does not run. Unverifiable reporting components require the independent browser route when the host permits it; queued delivery never implies recorded or recovered.","A diagnostic reply requires ownership and exact original execution metadata, plus a retained diagnostic-request revision targeting that original report. A late reply cannot answer a newer request. A diagnostic exchange cannot be marked recovered.","Operator publications can require the inspected current revision. Identical applicable remedies are idempotent and do not create another retry episode. Resume instructions use existing verified workflow tools and ordinary professional gates; service text is never executed as a command.","The shared implementation binds registrations, browser sessions, task events, report signatures, feedback and update downloads to one product. Existing unmapped installations and receipt schema 1 remain Vera. Physical-computer identity is shared, while usage catalogues and testing epochs are separated by product.","An explicitly selected MPARANZA_INCIDENT_DELIVERY=local-only setting blocks incident HTTP transport and persists event and task restrictions, including a successful initial execution with no incident. Legacy globally suppressed entries stay local while unrelated automatic tasks can report. Native retries and supplements honor retained permissions. Authorizing one retained report checks its installation, task, report UUID and canonical content hash locally without sending; only those exact bytes can subsequently be sent. Corrections do not inherit authorization for changed bytes. Authorization metadata stays local and adds no external payload field. This does not make model-provider processing local-only.","PDF recovery evidence uses the existing durable outbox and exact original-report supplementation, including local-only delivery. Readable partial results and independent workflow gates survive incident-service failure. Frozen extraction is explicitly unqualified and never generates a recovered outcome.","When a native execution supplies its retained task UUID, newly created local incident entries and operation identities carry that scope. Failure/progress delivery and success recovery select only that task. Older queued evidence and receipts are neither relabelled, removed nor transmitted by the task. The scope stays local and adds no external report field; unscoped maintenance remains a separate operation.","The technical_facts transport accepts at most 100 integer or boolean values and bounded technical identifier keys. Automatic collection reads only the producer-declared exception field; it does not inspect locals or serialize arbitrary string values. The existing host review path remains available for relevant technical context that cannot be captured by these measurements.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history.","Successful native status stores the exact pending-remedy snapshot locally for automatic managed retry progress, including an empty snapshot. A failed status retains the last known snapshot. Reading status does not execute remedies; original operation, input, report and revision checks still govern closure. No new external report fields or recipients are introduced.","Scoped automatic retries deliver original reports in occurrence order before dependent diagnostics and recovery notices. An unacknowledged item remains private and pending for retry. Each original requires its own server receipt; restrictions on local-only evidence and unrelated task scopes still apply.","Archive retry association compares a keyed local binding of the exact command, client, engagement and run IDs. Older reports require the exact saved invocation. Only the keyed digest enters the existing input_binding field; raw Archive IDs are not added to reporting payloads. A mismatch suppresses incident association without blocking professional execution."],"destination":"Mparanza ordinary HTTPS operational-incident API and https://mparanza.com/clara/incident-recovery","id":"automatic-technical-incident-loop","kind":"hosted_service","optional":false,"purpose":"Diagnose observed execution/setup failures, return installation-specific remedies and receive actual recovery outcomes","requires_confirmation":false,"retention":"Local capabilities, pending reports and receipts persist outside client folders. In tested Cowork task containers this filesystem is task-local; the browser session retains a separate random reporting identity when that host preserves browser cookies. Access tokens last one hour; rotating refresh grants expire after 90 idle days and can be revoked. Token/code hashes and incident records have no automatic deletion period. Access requires the local capability or browser cookie, with explicit capability proof before linking local reports. Retired OAuth tokens no longer authenticate reporting requests; existing historical records remain retained. Pending diagnostic pointers and raw stderr persist in the private incident directory until a matching actual recorded supplementation receipt is acknowledged; unsuccessful review or delivery retains them. Supplementation never replaces the original recovery episode or reopens recovered records. Recorded original/outcome receipts can acknowledge only their exact local queued UUID without replacing the local capability or original reporting identity. Remedy revisions are retained from the surviving migration revision onward; overwritten legacy revisions are not reconstructed. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced. Actual retry progress is retained against exact original report and operation IDs before status polling or report delivery. Pending progress is delivered only when the matching latest episode is known. This carries no source bytes and does not itself close an incident; host verification remains required.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":[".mcp.json","scripts/operational_incidents.py","scripts/check_dependencies.py","scripts/managed_python_runtime.py","scripts/onboarding_session_start.py","skills/clara/SKILL.md","skills/clara/references/incident-recovery.md","scripts/_managed_python_runtime.py","scripts/verified_execution.py","scripts/technical_runner.py","scripts/incident_host_mcp.cjs","scripts/reporting_product.py","scripts/diagnostic_context.py","scripts/incident_tool_schemas.json"],"governed_repository_paths":["modules/operational_incidents","modules/hosted_services/api.py","scripts/manage_incidents.py","scripts/render_incident_alert.py","scripts/summarize_incident_monitor.py","plugins/_shared/reporting-runtime","scripts/sync_reporting_runtime.py","plugins/_shared/vendor/modules/vera_assurance","modules/operational_incidents/recovery.py","templates/incident_recovery.html","static/shared/incident-recovery.js","static/shared/incident-recovery.css"],"review":{"basis":"external_boundary_review_of_shared_service_source","reviewed_at":"2026-11-08","reviewed_by":"privacy-surface-review","source_fingerprint":"7503d373f1cda06f0d4396e650f5724c8ab3c5526c702b88d43e50a86d9c1dd7"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Only a matching random installation capability can retrieve incident status or record its recovery. Stored keys are SHA-256 digests; server validation never echoes invalid input.","id":"capability-isolation","implemented_by":["repository:modules/operational_incidents/store.py","repository:modules/operational_incidents/api.py"],"on_violation":"Reject without returning another installation record."},{"control":"Remote data cannot supply executable commands. Only reviewed built-in action IDs are supported; retries use argv without a shell and preserve integrity guards.","id":"bounded-safe-remedies","implemented_by":["scripts/operational_incidents.py","repository:modules/operational_incidents/contracts.py"],"on_violation":"Reject unsupported actions and keep the incident open."},{"control":"Built-in recovery children receive the shared host/runtime environment allowlist, explicit named runtime/state locations and the recovery recursion guard. Unrelated user tokens and keys are not inherited.","id":"helper-environment-allowlist","implemented_by":["scripts/operational_incidents.py"],"on_violation":"Undeclared environment names are absent from the child environment."},{"control":"Diagnostic collection resolves portable Archive contexts through the maintained identity, manifest and input-receipt verifier. PDF recovery evidence and killed-worker diagnostics use that run's verified output directory; a different run's output is rejected. Context hydration is local and adds no external payload fields.","id":"portable-diagnostic-run-binding","implemented_by":["scripts/diagnostic_context.py","scripts/operational_incidents.py","scripts/managed_python_runtime.py"],"on_violation":"Retain the original execution outcome and report unavailable diagnostics without attributing another run's evidence."},{"control":"Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery. Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history.","id":"https-browser-reporting-continuity","implemented_by":["repository:modules/operational_incidents/recovery.py","repository:modules/operational_incidents/api.py","repository:static/shared/incident-recovery.js","scripts/operational_incidents.py","scripts/incident_host_mcp.cjs"],"on_violation":"Reject unauthorized cross-origin, product or owner access without replacing retained evidence. Preserve unacknowledged delivery; no professional result is invalidated by a reporting failure."}],"service_details":{"access":{"arrangement":"Product-owned local installation capabilities or authenticated browser recovery sessions; retained history requires its original local capability or an authenticated browser session. Native physical-computer proof is separate and shared across products. Existing Vera credentials and v1 signatures retain their meaning.","controls":["Only closed technical transport schemas are accepted; unknown fields and arbitrary recovery commands are rejected.","The fixed HTTPS transport refuses redirects. Reporting failures retain the outbox and do not discard professional outputs.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Only two built-in setup/preparation retries may execute automatically, once per remedy revision. Client documents, ACLs and security settings are not changed.","A published update is not recovery. The failed operation must actually execute successfully before that installation delivery closes.","The retained legacy MCP endpoint for old releases requires OAuth access tokens for its fixed incident resource; new plugin packages do not declare that endpoint. Authorization uses S256 PKCE, exact registered callbacks and a single-use five-minute code. Refresh tokens rotate and a replay revokes the grant; raw OAuth credentials are never placed in model prompts or stored server records.","Supplemental diagnostics require ownership of the original report and matching execution metadata; they are stored separately and cannot change the original report UUID, delivery status or remedy revision. Raw local diagnostic files can only be removed by acknowledging a matching recorded supplement.","Actionable remedies target an explicit original report. Each delivery uses its own applicable revision; a different report with the same generic signal does not inherit that remedy.","A cached actual browser or legacy connector status permits only the two fixed retries for an existing matching local receipt and latest report. It performs no direct HTTP polling or identity adoption. Missing local receipts cannot be fabricated to authorise a retry.","A helper success records readiness. Host AI verification of the original task and inputs is required for all recovered outcomes, including setup/startup. Delayed failures cannot reopen an already recovered episode.","Failed fixed retries retain complete stderr privately for semantic review. Raw recovery stderr is not automatically transmitted.","Actual cached browser or legacy connector status reconciles only readiness hints bound to existing local report receipts. Readiness becomes action-required evidence rather than recovery; already recovered matching hints are cleared and unlinked hints are retained. No remote receipt is fabricated and no case inputs are inferred.","Before reporting an installation-preparation failure, the preflight verifies the reporting script, preflight script and product metadata against a stable build index, then snapshots them in a fresh private temporary directory and executes the reporter in isolated Python. Original-installation, cwd and PYTHONPATH imports are excluded. Damaged workflow code does not run. Unverifiable reporting components require the independent browser route when the host permits it; queued delivery never implies recorded or recovered.","A diagnostic reply requires ownership and exact original execution metadata, plus a retained diagnostic-request revision targeting that original report. A late reply cannot answer a newer request. A diagnostic exchange cannot be marked recovered.","Operator publications can require the inspected current revision. Identical applicable remedies are idempotent and do not create another retry episode. Resume instructions use existing verified workflow tools and ordinary professional gates; service text is never executed as a command.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."]},"data_returned":[{"content":"Matching product, installation and event/report receipts; current targeted remedy and original-task outcome; signed report proof or public status where applicable. Receipt transmission never includes the local report.","id":"acknowledged-evidence","when":"After exact service verification"}],"data_sent":[{"content":"Random installation UUID and opaque capability, Clara/host/runtime versions, platform and workflow technical IDs, failed stage, complete available technical diagnostic chains and measurements, explicit missing-measurement reasons, retry IDs and actual recovery outcomes. No professional helper stdout, client documents, case text, user prompts or arbitrary task logs. Known path, email and credential patterns are removed from technical messages; this mechanical filter does not establish semantic privacy. The host agent must select technical evidence without unrelated personal/client material. The remote channel does not read local files. Reporting uses ordinary HTTPS with local capabilities or a browser cookie. Remote MCP endpoints and their OAuth authorization routes are retired. The server stores capability hashes and random owner UUIDs. Previously retained OAuth hashes, callback metadata and reporting records are not deleted by endpoint retirement. No personal account signup, user profile, email or client-file permission is involved. Failed helpers retain complete stderr privately on disk; stderr may include unrelated private/client text and is read by the selected host model for semantic review under its existing account. Raw stderr is not forwarded to Mparanza. Only reviewed relevant technical diagnostics, linked by the original report UUID, are submitted as supplemental evidence. Professional stdout is not captured. Installation-preparation failures submit only a fixed technical message, exception type/errno, or the indexed package-relative file name and expected/observed SHA-256 values for a content mismatch. No altered file contents or professional files are read for this report. Managed helpers also send source-bound exception classes, OS error numbers, package-relative stack coordinates, developer-authored error templates and missing required option names automatically. Dynamic exception/argument values, locals, professional stdout and arbitrary source excerpts are not part of these structured events. Process-session UUIDs, persistent operation UUIDs and optional keyed digests of existing run/input-receipt identities bind attempts without disclosing receipt fields or raw client-input hashes. Actual worker interpreter/platform fields are separate from the reporter's interpreter. Capture completeness, pending semantic review, exact remedy/retry events and host verification of the original task remain distinct evidence states; a structured event is not a semantic diagnosis. Current reporting-process version, protocol capabilities and server last-seen time are retained per process session, separately from historical failure versions; they do not establish that all conversations updated. Native-host binding, when invoked, accepts a random host UUID and scoped capability plus an optional explicit native-app label at the same incident service. Only the host capability hash is retained server-side. Stable app-profile UUIDs are derived from host UUID and app label; reporter-instance UUIDs may be task-local and do not count physical computers, plugin copies or people. App grouping grants no additional client status or outcome access. Operator views retain each original report, supplement, outcome and retry event with its actual reporting owner and server receipt time; missing historical task identity is not reconstructed. The native stdio identity bridge verifies its indexed entry, reporter, technical collector and product metadata, then executes an isolated temporary reporter snapshot using existing Python without installing dependencies. Its tool accepts only an existing reporter capability and sends host proof to the fixed register endpoint; it never returns the device key or copies the reporter key into the host identity file. Native broker version/session observations are retained separately from guest reporter and failure-worker observations. When local tools are unavailable, browser reporting depends on the host exposing permitted browser controls. If those controls are absent, delivery remains unverified. Browser identity is distinct from physical-host linkage; no device controls or folder permissions are expanded automatically. Native-helper failures return source-bound exception classes, errno or HTTP status, package-relative frames and developer-authored templates. Dynamic diagnostic values are not returned; unavailable capture is explicit. This bridge does not return raw stderr or device keys. The central recovery agent may request named technical evidence surfaces through a diagnostic-request remedy. The host AI replies with reviewed technical facts, the original report UUID and request revision. Original-task availability is represented by technical booleans, not task text, client identifiers or file contents. A resume remedy communicates a diagnosed correction to the existing authorized workflow; it does not carry executable code. Technical requests, response UUIDs, applicable revisions and their observed status are retained with the original episode. The central agent may implement and deploy incident-related software fixes through reviewed source and green CI under Fabio’s explicit recovery authorization; it does not receive professional case files or gain user-host permissions. Handled Studio Archive exceptions log their active traceback locally before returning the existing error JSON, allowing the same source-bound collector and host semantic review to retain their actual cause. The operator derives diagnostic publication, exact owner/report/revision receipt and reply states, the existing 15-minute deadline and reporting-owner last service contact from retained records. These delivery facts do not establish physical-host availability, diagnosis or original-task recovery. The operator also projects exact delivery, retry and original-task outcome evidence for all actionable remedy kinds, including software updates. Its 15-minute attention cadence is not an execution timeout. A local alert renderer uses technical incident facts and an AI-reviewed blocker, accountable next action, reason and scheduled check. An optional operator-maintained device label is accepted only with a recorded exact-device verification reference; it is not inferred from the recipient, OS or reporter identity. Rendered operator alerts may include opaque machine/case codes and a verified operator-device label, but no client contents, raw diagnostics, personal identifiers or credentials. The renderer neither sends email nor accesses the registry or client files. It rejects stale followup reviews and cannot assign an unreceived or overdue remedy back to the uncontacted Clara. Recovered labels require matching actual original-task success evidence; incomplete historical bindings remain unknown. The shared API also exposes a separate public workflow-testing endpoint: an allowlisted map of pipeline IDs to testing levels and baseline metadata, without incident details, computer IDs, run IDs or user feedback. Its reset is operator-only and does not change incident records. Native workflow transport supplies the same existing host proof during registration when it is available.","id":"automatic-technical-incident-loop","when":"Diagnose observed execution/setup failures, return installation-specific remedies and receive actual recovery outcomes"}],"retention":{"statement":"Local capabilities, pending reports and receipts persist outside client folders. In tested Cowork task containers this filesystem is task-local; the browser session retains a separate random reporting identity when that host preserves browser cookies. Access tokens last one hour; rotating refresh grants expire after 90 idle days and can be revoked. Token/code hashes and incident records have no automatic deletion period. Access requires the local capability or browser cookie, with explicit capability proof before linking local reports. Retired OAuth tokens no longer authenticate reporting requests; existing historical records remain retained. Pending diagnostic pointers and raw stderr persist in the private incident directory until a matching actual recorded supplementation receipt is acknowledged; unsuccessful review or delivery retains them. Supplementation never replaces the original recovery episode or reopens recovered records. Recorded original/outcome receipts can acknowledge only their exact local queued UUID without replacing the local capability or original reporting identity. Remedy revisions are retained from the surviving migration revision onward; overwritten legacy revisions are not reconstructed. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","status":"documented"},"trigger":"Automatic technical reporting and per-primary-task events; one optional user rating after delivery. Local-only tutorials and nested infrastructure are not separate rated tasks."},"service_id":"operational-incidents"},"run-receipt-stamping":{"display_name":"Server-stamped run receipts","external_boundaries":[{"activation":"automatic_per_durable_run","content":"Unless the user requests --local-only, each substantive run with a durable local report automatically sends exactly schema version, one random per-run receipt UUID, the Clara version when the request was first created, and the SHA-256 digest of the canonical local model-data report, plus ordinary connection metadata. The report itself, workflow and local run IDs, client or case data, professional purpose, phase labels, counts, filenames, file contents, source-document hashes, prompts, and model outputs are not sent. A later verification request sends the same opaque receipt UUID and report digest. Clara and Lucia use receipt schema 2 with the explicit product as a fifth signed request field; legacy Vera schema 1 is preserved. The replacement transport preserves the same closed reporting payloads. Browser cookies and optional original local credentials authenticate only; they are not diagnostic fields. Browser status and acknowledgements enter the selected host model context when the agent reads the rendered response. The schema view returns field definitions, not stored user data. The browser fallback sends no professional documents or raw model-data report.","controls":["Vera report builds stamp by default. When the user prohibits external receipt transmission, --local-only writes the local JSON and readable report, returns not_requested/local_only, and skips receipt request construction and transport. It does not change host model processing. Do not retry stamping without a later explicit user request. Service failures leave completed work and the local report intact and return pending. The generic Studio Archive helper also disables server attestation.","The client constructs a four-field allow-listed request, restricts production traffic to the fixed Mparanza HTTPS route, permits HTTP only on an explicit loopback port for testing, bounds responses, and rejects additional or mismatched response fields. The default transport rejects HTTP redirects before any redirected request and rejects endpoint URLs containing credentials.","The server rejects additional request fields, assigns its own timestamp, signs the complete retained record with Ed25519, stores only the minimal proof fields, applies request-size and rate limits, and fails closed when signing or verification keys are unavailable.","The local customer receipt states that the proof covers existence, server time, and report integrity only; it does not claim who submitted the digest, provider delivery, analytical correctness, semantic necessity, DPIA completion, legal advice, or GDPR compliance.","Retries retain the original UUID and version. A retry after finalization verifies the retained report against the sealed artifact manifest and writes supplementary receipts outside the immutable output tree.","The workflow remains subject to host network permissions and action-specific approval rules. A denied transmission is not retried through another tool or destination; permission-denied retries wait for the required authorization.","OpenAI desktop onboarding is a local-only exception: reports beneath its .vera-onboarding-local-only directory marker return not_requested/local_onboarding before receipt request construction, including direct later stamp retries. The Claude projection omits this new onboarding behavior.","The report build returns the readable local report as display_markdown for the final response, including when stamping is pending. The show command renders a saved report after validating its recorded hashes; it reads no source documents, writes no files and makes no network or stamping request. Displaying the report uses the current model context and does not send its content to Mparanza.","The separately registered workflow-usage service can link the retained receipt UUID and digest to the installation and primary task. It does not alter the four-field stamping request or send the report itself. See workflow-usage for outcome and optional star/comment fields.","The shared implementation binds registrations, browser sessions, task events, report signatures, feedback and update downloads to one product. Existing unmapped installations and receipt schema 1 remain Vera. Physical-computer identity is shared, while usage catalogues and testing epochs are separated by product.","The authenticated HTTPS browser recovery route can relay the same retained allow-listed stamping request when local delivery is unavailable. Its surrounding envelope includes the existing workflow run UUID; the browser capability and any explicitly linked original local credentials prove ownership. The proof service retains only the original proof fields. No report contents are admitted. Returned receipts are validated locally against the unchanged report and retained request before linking.","Ordinary operations recover only the exact selected client/engagement/run; unrelated pending report locks and server requests are not prerequisites. Explicit maintenance retains the bounded independent recovery queue. Failed or cancelled runs may close using sealed ownership and retained observation evidence even when original or execution input bytes are unavailable. Execution, completion and professional-artifact seals retain their full integrity checks. No new recipient, payload field or source-file transmission is introduced.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."],"destination":"Mparanza's fixed HTTPS Clara run-receipt endpoint and public verification page","id":"automatic-server-stamped-run-receipt","kind":"hosted_service","optional":false,"purpose":"Bind one local model-data report to a Mparanza server timestamp and Ed25519 signature, then let the studio or its customer verify the retained proof","requires_confirmation":false,"retention":"Mparanza retains the opaque receipt UUID, server timestamp, Vera version, report digest, signature, signature key ID, and implicit receipt schema version as the proof record, without an automatic deletion period. The local HTML and JSON receipt remain in the studio's run output, or in a supplementary run receipts directory for a retry after output finalization, until the studio removes them. Administrative deletion of the server proof must be requested from Mparanza and makes later verification impossible. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":[".codex-plugin/plugin.json","scripts/model_data_report.py","scripts/notarized_run_receipt.py","skills/clara/SKILL.md","skills/clara/references/model-data-report-contract.md","scripts/reporting_product.py","scripts/privacy_contract.py","scripts/incident_host_mcp.cjs","scripts/incident_tool_schemas.json","scripts/operational_incidents.py"],"governed_repository_paths":["modules/hosted_services/api.py","modules/run_receipts/__init__.py","modules/run_receipts/api.py","modules/run_receipts/signing.py","modules/run_receipts/store.py","templates/vera_run_receipt_verify.html","plugins/_shared/vendor/modules/italian_tax_litigation","plugins/lucia/scripts/legal_documents.py","plugins/lucia/scripts/legal_docx.py","plugins/lucia/scripts/legal_documents_review.schema.json","plugins/lucia/scripts/legal_documents_labels.json","plugins/lucia/scripts/legal_matter.py","plugins/lucia/scripts/legal_matter.schema.json","plugins/lucia/scripts/legal_matter_labels.json","plugins/_shared/vendor/modules/deal_redux","plugins/lucia/scripts/legal_negotiation.py","plugins/lucia/scripts/legal_negotiation.schema.json","plugins/lucia/scripts/legal_negotiation_labels.json","plugins/_shared/reporting-runtime","scripts/sync_reporting_runtime.py","modules/operational_incidents/recovery.py","templates/incident_recovery.html","static/shared/incident-recovery.js","static/shared/incident-recovery.css","modules/operational_incidents/api.py","modules/operational_incidents/store.py"],"review":{"basis":"external_boundary_review_of_shared_service_source","reviewed_at":"2026-11-07","reviewed_by":"privacy-surface-review","source_fingerprint":"4a363209dd2e10091822ab41940e08bf20cf40dea123d687e65919e8096ab7ce"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Both client and server enforce the same closed receipt request schema, and the server's Pydantic model forbids every unregistered field.","id":"minimal-receipt-request-allow-list","implemented_by":["scripts/notarized_run_receipt.py","repository:modules/run_receipts/api.py"],"on_violation":"The request or response is rejected before a proof is accepted or written locally."},{"control":"The installed client accepts only the fixed Mparanza HTTPS receipt route, with an explicit loopback HTTP port allowed solely for local testing. Endpoint credentials are rejected, and the default stamping and verification transport refuses redirects rather than following another destination.","id":"fixed-receipt-destination","implemented_by":["scripts/notarized_run_receipt.py"],"on_violation":"The client aborts before making a network request."},{"control":"The server generates the timestamp, signs the exact minimal record with Ed25519, persists no report or case fields, and treats reuse of a receipt UUID for a different digest or version as a conflict.","id":"signed-idempotent-minimal-storage","implemented_by":["repository:modules/run_receipts/signing.py","repository:modules/run_receipts/store.py"],"on_violation":"Missing keys make the service unavailable, invalid signatures are not returned as verified, and conflicting retries are rejected."},{"control":"The public receipt API caps request bodies and per-source and global operation rates before stamping or verification.","id":"bounded-public-receipt-service","implemented_by":["repository:modules/run_receipts/api.py"],"on_violation":"Oversized or excess requests receive an explicit 413 or 429 response without creating a receipt."},{"control":"Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery. Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history.","id":"https-browser-reporting-continuity","implemented_by":["repository:modules/operational_incidents/recovery.py","repository:modules/operational_incidents/api.py","repository:static/shared/incident-recovery.js","scripts/operational_incidents.py","scripts/incident_host_mcp.cjs"],"on_violation":"Reject unauthorized cross-origin, product or owner access without replacing retained evidence. Preserve unacknowledged delivery; no professional result is invalidated by a reporting failure."}],"service_details":{"access":{"arrangement":"Product-owned local installation capabilities or authenticated browser recovery sessions; retained history requires its original local capability or an authenticated browser session. Native physical-computer proof is separate and shared across products. Existing Vera credentials and v1 signatures retain their meaning.","controls":["Clara report builds stamp by default. When the user prohibits external receipt transmission, --local-only writes the local JSON and readable report, returns not_requested/local_only, and skips receipt request construction and transport. It does not change host model processing. Do not retry stamping without a later explicit user request. Service failures leave completed work and the local report intact and return pending. The generic Studio Archive helper also disables server attestation.","The client constructs a five-field allow-listed request, restricts production traffic to the fixed Mparanza HTTPS route, permits HTTP only on an explicit loopback port for testing, bounds responses, and rejects additional or mismatched response fields. The default transport rejects HTTP redirects before any redirected request and rejects endpoint URLs containing credentials.","The server rejects additional request fields, assigns its own timestamp, signs the complete retained record with Ed25519, stores only the minimal proof fields, applies request-size and rate limits, and fails closed when signing or verification keys are unavailable.","The local customer receipt states that the proof covers existence, server time, and report integrity only; it does not claim who submitted the digest, provider delivery, analytical correctness, semantic necessity, DPIA completion, legal advice, or GDPR compliance.","Retries retain the original UUID and version. A retry after finalization verifies the retained report against the sealed artifact manifest and writes supplementary receipts outside the immutable output tree.","The workflow remains subject to host network permissions and action-specific approval rules. A denied transmission is not retried through another tool or destination; permission-denied retries wait for the required authorization.","OpenAI desktop onboarding is a local-only exception: reports beneath its .clara-onboarding-local-only directory marker return not_requested/local_onboarding before receipt request construction, including direct later stamp retries. The Claude projection omits this new onboarding behavior.","The report build returns the readable local report as display_markdown for the final response, including when stamping is pending. The show command renders a saved report after validating its recorded hashes; it reads no source documents, writes no files and makes no network or stamping request. Displaying the report uses the current model context and does not send its content to Mparanza.","The separately registered workflow-usage service can link the retained receipt UUID and digest to the installation and primary task. It does not alter the five-field stamping request or send the report itself. See workflow-usage for outcome and optional star/comment fields.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."]},"data_returned":[{"content":"Matching product, installation and event/report receipts; current targeted remedy and original-task outcome; signed report proof or public status where applicable. Receipt transmission never includes the local report.","id":"acknowledged-evidence","when":"After exact service verification"}],"data_sent":[{"content":"Unless the user requests --local-only, each substantive run with a durable local report automatically sends exactly schema version, one random per-run receipt UUID, the Clara version when the request was first created, and the SHA-256 digest of the canonical local model-data report, plus ordinary connection metadata. The report itself, workflow and local run IDs, client or case data, professional purpose, phase labels, counts, filenames, file contents, source-document hashes, prompts, and model outputs are not sent. A later verification request sends the same opaque receipt UUID and report digest. Clara and Lucia use receipt schema 2 with the explicit product as a fifth signed request field; legacy Vera schema 1 is preserved.","id":"automatic-server-stamped-run-receipt","when":"Bind one local model-data report to a Mparanza server timestamp and Ed25519 signature, then let the studio or its customer verify the retained proof"}],"retention":{"statement":"Mparanza retains the opaque receipt UUID, server timestamp, Vera version, report digest, signature, signature key ID, and implicit receipt schema version as the proof record, without an automatic deletion period. The local HTML and JSON receipt remain in the studio's run output, or in a supplementary run receipts directory for a retry after output finalization, until the studio removes them. Administrative deletion of the server proof must be requested from Mparanza and makes later verification impossible. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","status":"documented"},"trigger":"Automatic technical reporting and per-primary-task events; one optional user rating after delivery. Local-only tutorials and nested infrastructure are not separate rated tasks."},"service_id":"run-receipt-stamping"},"workflow-usage":{"display_name":"Pipeline usage, outcomes and user satisfaction","external_boundaries":[{"activation":"automatic_on_first_use","content":"The existing installation capability authenticates closed-schema events: random run and event UUIDs, sequence, catalog pipeline ID, host, observed product version, timestamps, explicit user/synthetic/agent-test classification and started/resumed/completed/failed/cancelled state. Optional links contain only an existing signed receipt UUID/report digest or an owned incident report UUID. Run ownership, single-run receipt binding and the retained signature are checked server-side. The original stamping service does not attest the identity of the author of a report. The service receives no task text, client identity, filenames, source data, prompt or professional output. Existing connection metadata and rate limiting apply. Browser or legacy connector identity is not inferred to be a native computer. Native senders also present the existing anonymous native-computer capability and observed native app when available. The server retains the established computer binding; unlinked guests remain unlinked until an actual native proof is received. Browser-owned or legacy connector-owned runs can obtain the bounded per-run proof described above; run-specific computer bindings are used by counts and completion indicators. No personal account information or hardware identifier is collected. The product field is explicit. Product, run owner and receipt product must match. Baselines and function catalogues are distinct per product. The replacement transport preserves the same closed reporting payloads. Browser cookies and optional original local credentials authenticate only; they are not diagnostic fields. Browser status and acknowledgements enter the selected host model context when the agent reads the rendered response. The schema view returns field definitions, not stored user data. The browser fallback sends no professional documents or raw model-data report.","controls":["Events are durably queued before transport and acknowledged by exact UUID, owner, sequence and hash. Interruptions stay outcome unknown; repeated submissions are idempotent.","Synthetic and agent-test runs are excluded from user metrics. Studio Archive is infrastructure and cannot be selected as a rated process.","The host AI selects the primary process and observes actual task completion. Counters and hashes do not assert professional correctness or independent model delivery.","The shared implementation binds registrations, browser sessions, task events, report signatures, feedback and update downloads to one product. Existing unmapped installations and receipt schema 1 remain Vera. Physical-computer identity is shared, while usage catalogues and testing epochs are separated by product.","Authenticated event acknowledgements and run status expose the original owner's proven Computer ID and whether an actual signed receipt is linked. Missing linkage remains explicit and returns bounded follow-up instructions. Neither reporting gap changes the professional outcome or authorizes broader host access.","When local HTTPS delivery is unavailable, the authenticated browser recovery route can stamp the exact retained receipt request for an owned run. The allow-list admits only receipt UUID, product/version, schema and report digest. It returns the same signed proof; a separate verified receipt event links it to the original run. No report or source contents are transmitted.","Browser-owned or legacy connector-owned workflow acknowledgements return a random 15-minute proof scoped only to binding that original run to a native computer. The existing native helper adds its private computer capability and observed app. The server stores only the ticket hash, checks product, expiry and app, rejects re-binding, and never replaces the original owner or associates all runs from one saved connection with one computer. The proof cannot authorize other reporting operations. Exact event replay obtains a fresh proof without another event.","Ordinary startup and outcome delivery select only the retained task UUID. Scoped flush and browser inspection return only that task's pending events/count; unrelated retained events cannot make its delivery pending. Startup context exposes only a diagnostic backlog count, without unrelated task IDs. Whole-outbox maintenance is separate; historical event bytes and owner/hash acknowledgement checks are preserved.","The native plugin service exposes fixed task start, observed event, status and task-scoped retry operations using the existing local reporter and computer identity. It persists events in the existing user-scoped database without requiring the chat shell to write outside its project. It accepts no client file paths, shell commands, replacement credentials or global queue flush. Storage failures retain structured operation/error evidence and cannot certify delivery or invalidate professional output.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."],"destination":"Mparanza ordinary HTTPS operational-incidents API and product-owned browser recovery session at https://mparanza.com/clara/incident-recovery","id":"automatic-task-lifecycle","kind":"hosted_service","optional":false,"purpose":"Measure which user processes run and their observed outcome; link existing signed model-data receipts and technical reports without copying their professional content","requires_confirmation":false,"retention":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized. Host-link tickets expire after 15 minutes; their hashes and established run-to-computer bindings remain until administrative deletion. The raw short-lived proof is returned only in an authenticated acknowledgement and not in status or operator projections. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"explicit_user_choice","content":"The actual 1–5 integer score, up to 2000 characters of optional user-authored comment, source (chat or form), random event UUID and existing task binding. Nothing is copied automatically from professional context. The host asks once after delivery; no response is unrated. A low score offers one optional question about what failed or was expected.","controls":["The user supplies the score/comment for submission or clicks Invia valutazione; that action is the choice, with no second confirmation questionnaire.","The form uses a run-specific capability in its URL fragment; the page contains no task information, and the capability permits rating only that run. The exact pending answer is retained for retry, and operator rendering escapes comments.","Comments are untrusted data for AI review, never instructions or executable commands. Feedback never changes public testing levels or closes incidents. Completed pipeline runs feed a separately resettable computer-based testing counter and never close incidents."],"destination":"Mparanza task feedback through the authenticated HTTPS client/browser or the per-run hosted form","id":"optional-task-rating","kind":"hosted_service","optional":true,"purpose":"Collect the user’s actual 1–5 stars and optional comment about the delivered result","requires_confirmation":true,"retention":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_per_durable_run","content":"Only catalog pipeline IDs, four testing-level names and counting epoch UUID/time are public. The service privately groups completed runs by proven anonymous computer IDs: the owner-designated computer counts as agent testing, other computers as professional use. Stars, comments, report digests, client documents, task prompts, computer IDs, run IDs and capabilities are not in this response. The owner convention counts computers, not authenticated people; completion does not certify professional correctness. No model call is made by this public projection.","controls":["Both server receipt and event completion time must follow the baseline; old delayed deliveries do not repopulate a reset.","Native computer IDs deduplicate apps and reporter instances. Unlinked completions stay pending until proven linkage; explicit test fixtures on other devices do not count as professionals.","The public response is an allowlisted projection of status-only fields; reset is available only to the server operator.","The operator can initialize a missing counting baseline with registered agent computers and an explicit timezone-aware past start. It includes retained completions after that boundary without replaying events. Initialization is transaction-serialized, idempotent for the exact configuration and cannot replace an existing baseline; reset remains a separate explicit operation."],"destination":"Mparanza public GET /api/clara/testing-status and Clara function catalogue","id":"public-completed-pipeline-status","kind":"hosted_service","optional":false,"purpose":"Automatically show testing levels from concluded pipelines after an explicit fresh baseline","requires_confirmation":false,"retention":"Counting epochs and underlying retained events persist until administrative deletion. A reset preserves history and starts new public counts.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"Only aggregate integer counts, catalog function IDs and labels, product minimum HTTPS-reporting versions and their release dates, supported app names, an identity-coverage boolean and snapshot time are public. The server internally deduplicates proven computer IDs across retained runs, functions, products and apps. The publication contains no computer, installation or run identifiers, per-user history, documents, prompts, feedback, ratings, hashes, capabilities or test-exclusion details. No model call is made by this projection. Codex, Cowork and Antigravity are included from the first deployed product release without remote reporting MCP (Vera 0.1.492, Clara 0.1.347, Lucia 0.1.176; 25 October 2026); no time window or testing epoch date is applied.","controls":["The GET handler constructs a fixed aggregate projection. No request can select an individual identity or read underlying runs through this route.","Explicit test samples and registered test computer identities are omitted across products. Missing computer proof is not replaced by a reporter identity and makes the aggregate coverage flag incomplete.","Exact sets deduplicate repeated activity and cross-app/product overlap. Failed is the explicitly defined difference between starters and completers, not a mutation of unknown or failed task events.","The frontend uses text nodes for returned labels, sends no credentials with the aggregate request and retains the last successful display during a transport failure."],"destination":"Public visitors to Mparanza GET /api/usage-summary and /static/shared/utilizzo/index.html","id":"public-distinct-user-usage","kind":"hosted_service","optional":false,"purpose":"Publish aggregate distinct-user starts, completions and non-completions per activity and application","requires_confirmation":false,"retention":"The projection adds no retained user records. Existing lifecycle records retain their established retention. The browser holds only the latest aggregate response in memory and refreshes while visible; the server sends no-store.","runtime_profiles":["openai-codex","anthropic-cowork","google-antigravity"]}],"governed_paths":["scripts/workflow_usage.py","scripts/operational_incidents.py","scripts/model_data_report.py","scripts/notarized_run_receipt.py","skills/clara/references/workflow-usage.md","usage/pipelines.json","scripts/reporting_product.py","scripts/incident_host_mcp.cjs","scripts/technical_runner.py","scripts/incident_tool_schemas.json"],"governed_repository_paths":["modules/workflow_usage","modules/operational_incidents/api.py","modules/operational_incidents/store.py","scripts/manage_workflow_usage.py","templates/vera_workflow_feedback.html","static/shared/vera/workflow-feedback.js","static/shared/vera/workflow-feedback.css","static/shared/vera-testing-status.js","static/shared/vera/index.html","plugins/_shared/reporting-runtime","scripts/sync_reporting_runtime.py","modules/operational_incidents/recovery.py","templates/incident_recovery.html","static/shared/incident-recovery.js","static/shared/incident-recovery.css","static/shared/utilizzo"],"review":{"basis":"external_boundary_review_of_shared_service_source","reviewed_at":"2026-11-07","reviewed_by":"privacy-surface-review","source_fingerprint":"8c71ed7cbd9cb23deabb679da228c21879d7969fa2653141b8fcf5d92b52dc80"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Existing installation credentials and browser capabilities scope task writes and reads; closed schemas reject unrelated fields. UUIDs, event order and retained hashes enforce retry identity.","id":"owned-closed-schema-events","implemented_by":["repository:modules/workflow_usage/contracts.py","repository:modules/workflow_usage/repository.py","repository:modules/operational_incidents/store.py"],"on_violation":"Reject the event without changing task evidence."},{"control":"A usage receipt link must match the retained report digest/version and a valid server signature.","id":"actual-retained-receipt","implemented_by":["repository:modules/operational_incidents/api.py"],"on_violation":"Reject the unverified link and retain the task without receipt evidence."},{"control":"The feedback route checks a per-run random capability, bounds the body and comment, and never exposes task data on the public form. Operator HTML escapes text.","id":"bounded-feedback-capability","implemented_by":["repository:modules/operational_incidents/api.py","repository:modules/workflow_usage/repository.py","repository:modules/workflow_usage/reporting.py"],"on_violation":"Reject the request or render it only as literal text."},{"control":"The public endpoint returns only the four-state map and epoch metadata. Device/run identities and feedback remain private; no public reset route exists.","id":"public-status-projection","implemented_by":["repository:modules/workflow_usage/testing.py","repository:modules/operational_incidents/api.py"],"on_violation":"Unknown or missing fields are not included in the public projection."},{"control":"The indexed native service snapshots the usage client and catalogue with the reporter, technical collector and product metadata. Fixed arguments select one retained task UUID; the existing owner/event/sequence/hash checks govern acknowledgement and replay. Native results do not return installation or computer keys.","id":"native-task-persistence","implemented_by":["scripts/incident_host_mcp.cjs","scripts/workflow_usage.py"],"on_violation":"Reject unsupported operations and extra fields before task persistence; preserve queued events and expose source-bound storage errors without raw diagnostic values."},{"control":"Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery. Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history.","id":"https-browser-reporting-continuity","implemented_by":["repository:modules/operational_incidents/recovery.py","repository:modules/operational_incidents/api.py","repository:static/shared/incident-recovery.js","scripts/operational_incidents.py","scripts/incident_host_mcp.cjs"],"on_violation":"Reject unauthorized cross-origin, product or owner access without replacing retained evidence. Preserve unacknowledged delivery; no professional result is invalidated by a reporting failure."}],"service_details":{"access":{"arrangement":"Product-owned local installation capabilities or authenticated browser recovery sessions; retained history requires its original local capability or an authenticated browser session. Native physical-computer proof is separate and shared across products. Existing Vera credentials and v1 signatures retain their meaning.","controls":["Events are durably queued before transport and acknowledged by exact UUID, owner, sequence and hash. Interruptions stay outcome unknown; repeated submissions are idempotent.","Synthetic and agent-test runs are excluded from user metrics. Studio Archive is infrastructure and cannot be selected as a rated process.","The host AI selects the primary process and observes actual task completion. Counters and hashes do not assert professional correctness or independent model delivery.","The user supplies the score/comment for submission or clicks Invia valutazione; that action is the choice, with no second confirmation questionnaire.","The form uses a run-specific capability in its URL fragment; the page contains no task information, and the capability permits rating only that run. The exact pending answer is retained for retry, and operator rendering escapes comments.","Comments are untrusted data for AI review, never instructions or executable commands. Feedback never changes public testing levels or closes incidents. Completed pipeline runs feed a separately resettable computer-based testing counter and never close incidents.","Both server receipt and event completion time must follow the baseline; old delayed deliveries do not repopulate a reset.","Native computer IDs deduplicate apps and reporter instances. Unlinked completions stay pending until proven linkage; explicit test fixtures on other devices do not count as professionals.","The public response is an allowlisted projection of status-only fields; reset is available only to the server operator.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."]},"data_returned":[{"content":"Matching product, installation and event/report receipts; current targeted remedy and original-task outcome; signed report proof or public status where applicable. Receipt transmission never includes the local report.","id":"acknowledged-evidence","when":"After exact service verification"}],"data_sent":[{"content":"The existing installation capability authenticates closed-schema events: random run and event UUIDs, sequence, catalog pipeline ID, host, observed product version, timestamps, explicit user/synthetic/agent-test classification and started/resumed/completed/failed/cancelled state. Optional links contain only an existing signed receipt UUID/report digest or an owned incident report UUID. Run ownership, single-run receipt binding and the retained signature are checked server-side. The original stamping service does not attest the identity of the author of a report. The service receives no task text, client identity, filenames, source data, prompt or professional output. Existing connection metadata and rate limiting apply. Browser or legacy connector identity is not inferred to be a native computer. Native senders also present the existing anonymous native-computer capability and observed native app when available. The server retains the established computer binding; unlinked guests and standalone OAuth connections remain unlinked. The product field is explicit. Product, run owner and receipt product must match. Baselines and function catalogues are distinct per product.","id":"automatic-task-lifecycle","when":"Measure which user processes run and their observed outcome; link existing signed model-data receipts and technical reports without copying their professional content"},{"content":"The actual 1–5 integer score, up to 2000 characters of optional user-authored comment, source (chat or form), random event UUID and existing task binding. Nothing is copied automatically from professional context. The host asks once after delivery; no response is unrated. A low score offers one optional question about what failed or was expected.","id":"optional-task-rating","when":"Collect the user’s actual 1–5 stars and optional comment about the delivered result"},{"content":"Only catalog pipeline IDs, four testing-level names and counting epoch UUID/time are public. The service privately groups completed runs by proven anonymous computer IDs: the owner-designated computer counts as agent testing, other computers as professional use. Stars, comments, report digests, client documents, task prompts, computer IDs, run IDs and capabilities are not in this response. The owner convention counts computers, not authenticated people; completion does not certify professional correctness. No model call is made by this public projection.","id":"public-completed-pipeline-status","when":"Automatically show testing levels from concluded pipelines after an explicit fresh baseline"}],"retention":{"statement":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized. Counting epochs and underlying retained events persist until administrative deletion. A reset preserves history and starts new public counts. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","status":"documented"},"trigger":"Automatic technical reporting and per-primary-task events; one optional user rating after delivery. Local-only tutorials and nested infrastructure are not separate rated tasks."},"service_id":"workflow-usage"}},"workstream":"html-deck"}