privacy/workstreams/reporting-engine.json

{"display_name":"Reporting Engine","external_boundaries":[{"content":"Shared published package names and version constraints plus ordinary package-index request metadata. Client files, prompts, case data and generated work are not included in installer requests. Workflow arguments stay in the local child process.","controls":["Only published shared requirements are installed, never requirements derived from client material or prompts.","One fixed environment outside plugin source and client folders is reused across products and modules. Explicitly approved OCR is retained in the same environment.","A reader lease prevents setup from modifying packages while managed workflows run. Setup validates dependencies before writing the readiness receipt. Failed updates leave execution unavailable until repair.","Older plugin policies cannot downgrade an environment created by a newer shared policy revision."],"destination":"Python Package Index (PyPI)","id":"declared-python-dependency-retrieval","kind":"public_research","optional":true,"purpose":"Prepare the published shared Vera, Clara and Lucia core dependencies, and validate the selected workflow, in one user-scoped Python 3.12 environment per operating-system host.","requires_confirmation":false,"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Shared published package names and version constraints plus ordinary package-index request metadata. Client files, prompts, case data and generated work are not included in installer requests. Workflow arguments stay in the local child process.","controls":["Only published shared requirements are installed, never requirements derived from client material or prompts.","One fixed environment outside plugin source and client folders is reused across products and modules. Explicitly approved OCR is retained in the same environment.","A reader lease prevents setup from modifying packages while managed workflows run. Setup validates dependencies before writing the readiness receipt. Failed updates leave execution unavailable until repair.","Older plugin policies cannot downgrade an environment created by a newer shared policy revision."],"destination":"Python Package Index (PyPI) or the index selected by the user's Python configuration","id":"direct-cli-python-dependency-setup","kind":"public_research","optional":false,"purpose":"Prepare the published shared Vera, Clara and Lucia core dependencies, and validate the selected workflow, in one user-scoped Python 3.12 environment per operating-system host.","requires_confirmation":false,"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"The fixed CPython 3.12 version request, operating-system and architecture selection, and ordinary download request metadata. Setup does not read client files or add prompts, case material or generated reports to this request.","controls":["Use an installed CPython 3.12 when available; otherwise use uv or automatically download the published uv 0.12.10 wheel, verify its pinned SHA-256, and provision private CPython 3.12 without changing system Python or shell profiles.","Probe the selected interpreter before creating the dependency environment; never fall back to executing workflows with another Python minor version.","A failed download or interpreter probe stops setup; existing environments and client files remain intact."],"destination":"Astral python-build-standalone CPython distributions on GitHub, or the Python download mirror explicitly configured in uv","id":"declared-python312-retrieval","kind":"public_research","optional":false,"purpose":"Provision the declared CPython 3.12 workflow interpreter when absent, automatically bootstrapping uv if needed","requires_confirmation":false,"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"The host uploads the complete rendered HTML: entity, all compiled financial comparisons including hidden views, forecast basis, coverage and limitations, metric-linked commentary and optional customer, supplier and service labels. Raw export populations, original files, local paths and the full pack JSON are not copied into dist. The local preparation helper makes no network request. Sites manages hosting and visitor access; retention and deletion are not enforced by the plugin.","controls":["An explicit Sites publication request selects this route; host-required action approvals still apply. Invitations need authorized recipients.","Source replay must equal the persisted pack. The audience must match the reviewed recipe. Blocked or unsupported budget reports cannot be prepared. A fresh output folder preserves prior versions.","All compiled HTML views remain delivered; selection controls do not redact hidden values. No automatic anonymization occurs.","Verify deployment and visitor access. Refresh requires new source review and explicit publication using the existing Site ID."],"destination":"OpenAI Sites through the selected host Sites connector","id":"budget-sites-report","kind":"send_or_publish","optional":true,"purpose":"Publish the reviewed budget and forecast report for the selected readers","requires_confirmation":true,"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":["requirements.txt","hooks/cowork-hooks.json","scripts/bootstrap_python_dependencies.py","scripts/check_dependencies.py","skills/clara/references/cowork-runtime.md","skills/reporting-engine/SKILL.md","contracts/reporting_evidence_handoff_receipt.v1.schema.json","scripts/record_reporting_contribution.py","modules/reporting-engine/README.md","modules/reporting-engine/references","modules/reporting-engine/requirements.txt","modules/reporting-engine/scripts","scripts/self_relaunch.py","scripts/managed_python_runtime.py","scripts/_managed_python_runtime.py","components.json","scripts/_shared_python_runtime.py","requirements-shared-core.txt","requirements-shared-ocr.txt","constraints-shared-macos-py312.txt","scripts/_python_bootstrap.py","scripts/bounded_process.py","scripts/artifact_publication.py","scripts/case_store.py","modules/reporting-engine/catalog","scripts/report_mcp.py","scripts/report_mcp.cjs","ui/report.html"],"governed_repository_paths":["plugins/management-control-pack/scripts","plugins/management-control-pack/assets/budget-report.css","plugins/management-control-pack/assets/budget-report.js","plugins/_shared/vendor/modules/reporting_table.py","plugins/distribution-analysis/scripts/distribution_core.py","plugins/distribution-analysis/skills/distribution-analysis/SKILL.md","plugins/distribution-analysis/.codex-plugin/plugin.json","plugins/management-control-pack/assets/management-report-copy.json","scripts/vera_ui_theme.py","plugins/vera/ui/InstrumentSans-Regular.ttf"],"model_context":{"classes":[{"content":"CSV, XLSX, or Parquet fields and values; dataset identity; metrics, dimensions, periods, identifiers, members, source notes, and compatibility evidence A short descriptive summary can use already available local tools without a semantic project or reporting run; the supplied values and calculated summary may still enter Codex context. This does not create a reviewed execution or downstream calculation receipt.","id":"business-dataset","purpose":"Summarize, profile, interpret, validate, and visualize the user's business data","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Dataset profiles, intake receipts, semantic layers, evidence, reviewed Sales/Discount/COGS mapping states, role bindings, snapshot attachments, analysis policies, chart plans, exact input and output byte hashes, effective recipe records, rendered charts, authoritative calculation and report validation results, model-authored interpretations, and calculation evidence receipts with stable claim identifiers, dependency edges, verification runs, and shared case-register bindings Explicitly reviewed whole-population scope may have no period column. Nonfinancial metric definitions and units, all-records scope receipts and disclosed legacy Date/Period adapter placeholders can enter model context; those placeholders do not establish source time coverage. These changes add no hosted request.","id":"semantic-and-reporting-artifacts","purpose":"Author reusable dataset semantics and choose a source-backed analysis","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Source-role inspection includes filenames, columns/types and up to 10 preview rows per table. The model/professional authors mappings, audience and forecast assumptions. After local calculations, model_context.json includes all metric IDs and values, controls and coverage, source hashes, up to 60 calculated rows per section and 60 budget comparison rows with total counts. Raw export populations, original filenames and full pack JSON are excluded from this default post-calculation projection. Directly opening source files adds their read content to model context. The report contains all compiled views and optionally customer, supplier or service names. Clara reuses the management-control core through Reporting Engine with its ordinary project/output scope; it does not require Vera Studio Archive. No automatic redaction is applied. The native local report app verifies the explicitly selected dashboard against its execution receipt and exact bundled presentation script. Entire compiled HTML is sent to the app through app-only tool metadata; the model receives only ready/error status from the opener, not the report HTML. Period controls switch precomputed views in a sandboxed frame without same-origin permission. Refresh rejects changed reports or receipts and requires explicit reopening. No loopback preview server or automatic publication is used. Direct source/model-context reads and requested Sites publication retain their separate declared boundaries; unavailable native app support leaves visual review pending. The app applies its shared typography to the isolated verified preview without changing the saved report or its receipt.","id":"budget-report-context","purpose":"Prepare and interpret a reviewed Actual/Budget/Forecast report","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Explicit sheet/CSV parser settings, source hashes, reviewed execution context, generated recipes, output tables/charts, current-generation pointer, retained prior output snapshots, failed staging files and process logs (which may include local paths and business values) can be read by Codex. Normalized temporary CSV input is removed by the managed temporary-directory scope; failed stages, logs and published generations persist until separately removed. No automatic anonymisation is applied. Unsupported distribution mapping names are returned in a local validation error before report artifacts are written; the requested binding names may enter Codex context. The rejection introduces no external destination or additional retained source content. Explicit reporting delivery export creates an additional local copy of the complete reviewed source dataset and source notes, profile, semantic layer, acceptance receipt, current published generation and generated outputs. Its portable descriptor retains relative input paths and receipt hashes; the original execution receipt retains original absolute paths. These copies persist at the selected delivery location. The export itself performs no upload; a separately chosen Cowork or sharing route processes or transfers the selected bundle under that route.","id":"parser-and-attempt-evidence","purpose":"Verify reviewed parsing/execution and inspect failed or published analytical results","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"content":"Selected costing sources, reviewed classifications, objects, drivers and decision assumptions may be read during case preparation. The default calculated projection includes the decision question, scope, metrics, controls, limitations and up to 60 rows per section; raw costing workpapers and source locators remain outside that projection. Prior model reads are not undone. The costing CLI requires an actual Studio Archive context and source hashes; ordinary Clara budget_report.py routing is unchanged and does not establish that archive binding. No new external recipient or automatic anonymization is introduced.","id":"embedded-costing-component","purpose":"Describe the separately invoked costing code bundled with the shared reporting component","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"policy":"real_case_data_may_enter_selected_runtime_model_context"},"packaged_for_runtime":"openai-codex","public_explanations":{"clara-data-analysis":{"copy":{"de":["Der Code profiliert und berechnet ausgewählte Dateien; das Modell erhält Kontext zur Bestimmung von Bedeutung, Analyse und Erläuterung.","Es kann Geschäftsfrage, Spaltennamen und -typen, Datensatzprofil, relevante Werte und Elemente, mögliche Zeiträume, Kennzahlen und Dimensionen, Definitionen und Nachweise der semantischen Ebene, für die Interpretation nötige Zeilen oder Spalten, Aggregate, Tabellen, Diagramme, Annahmen und Prüfungen erhalten. Öffnet Codex eine Quelldatei direkt, gelangt auch der daraus gelesene Inhalt in den Modellkontext.","Lokale Skripte verarbeiten den ausgewählten Datensatz für Profiling, Kompatibilität, Berechnungen und Rendering; sie entscheiden nicht allein über geschäftliche Bedeutung oder das endgültige Diagramm. Der Ablauf nutzt keine FastAPI-Upload-Route, und die Hilfsskripte rufen keine Modell-API auf. Die Veröffentlichung eines Berichts oder Dashboards ist ein getrennter, ausdrücklich angeforderter Schritt.","Die angeforderte Sites-Veröffentlichung überträgt das gesamte HTML einschließlich ausgeblendeter Finanzdaten, Prognoseannahmen, Kommentare und Namen in optionalen Tabellen. Originalexporte, vollständige Quelldaten und Paket-JSON werden nicht in die öffentliche Seite kopiert. Zugriff, Speicherung und Löschung hängen von Sites ab. Quellen werden vor jeder Veröffentlichung erneut geprüft; keine automatische Überwachung."],"en":["Code profiles and calculates across selected files; the model receives context needed to define meaning, analysis, and explanation.","It may receive the business question, column names and types, dataset profile, relevant values and members, candidate periods, metrics and dimensions, definitions and evidence used for the semantic layer, rows or columns needed for interpretation, aggregates, tables, charts, assumptions, and checks. If Codex opens a source file directly, the content it reads from that file also enters model context.","Local scripts process the selected dataset for profiling, compatibility, calculations, and rendering; they do not decide commercial meaning or the final chart by themselves. The workflow uses no FastAPI upload route, and helper scripts make no model API call. Publishing a report or dashboard is a separate, explicitly requested step.","Requested Sites publication transfers the entire HTML, including financial data in hidden views, forecast assumptions, commentary and names in optional tables. Original exports, complete source populations and pack JSON are not copied into the public page. Access, retention and deletion depend on Sites. Sources are checked again before each new publication; this is not automatic monitoring."],"es":["El código perfila y calcula sobre los archivos seleccionados; el modelo recibe el contexto necesario para definir significado, análisis y explicación.","Puede recibir la pregunta de negocio, nombres y tipos de columnas, perfil del dataset, valores y miembros relevantes, periodos, métricas y dimensiones candidatos, definiciones y evidencias de la capa semántica, filas o columnas necesarias para interpretar, agregados, tablas, gráficos, supuestos y controles. Si Codex abre directamente un archivo fuente, el contenido que lea de ese archivo también entra en el contexto del modelo.","Los scripts locales procesan el dataset seleccionado para perfilado, compatibilidad, cálculos y renderizado; no deciden por sí solos el significado comercial ni el gráfico final. El flujo no usa una ruta FastAPI de carga y los scripts no llaman a una API de modelo. Publicar un informe o panel es un paso separado solicitado explícitamente.","La publicación solicitada con Sites transfiere todo el HTML, incluidos datos en vistas ocultas, supuestos de previsión, comentarios y nombres en tablas opcionales. Los archivos originales, poblaciones completas y JSON del paquete no se copian en la página pública. Acceso, conservación y eliminación dependen de Sites. Las fuentes se comprueban antes de cada publicación; no hay seguimiento automático."],"fr":["Le code profile et calcule sur les fichiers sélectionnés ; le modèle reçoit le contexte nécessaire pour définir sens, analyse et explication.","Il peut recevoir la question métier, noms et types des colonnes, profil du dataset, valeurs et membres pertinents, périodes, métriques et dimensions candidates, définitions et preuves du niveau sémantique, lignes ou colonnes nécessaires à l'interprétation, agrégats, tableaux, graphiques, hypothèses et contrôles. Si Codex ouvre directement un fichier source, le contenu lu dans ce fichier entre aussi dans le contexte du modèle.","Les scripts locaux traitent le dataset sélectionné pour profilage, compatibilité, calculs et rendu ; ils ne décident pas seuls du sens commercial ni du graphique final. Le flux n'utilise aucune route FastAPI d'upload et les scripts n'appellent pas d'API de modèle. Publier un rapport ou un tableau de bord est une étape séparée demandée explicitement.","La publication demandée avec Sites transfère tout le HTML, y compris les données des vues masquées, hypothèses de prévision, commentaires et noms des tableaux optionnels. Les exports originaux, populations sources complètes et JSON du dossier ne sont pas copiés dans la page publique. Accès, conservation et suppression dépendent de Sites. Les sources sont revérifiées avant chaque publication ; aucun suivi automatique."],"it":["Il codice profila e calcola sui file selezionati; il modello riceve il contesto necessario a definire significato, analisi e spiegazione.","Possono arrivare domanda di business, nomi e tipi delle colonne, profilo del dataset, valori e membri rilevanti, periodi, metriche e dimensioni candidate, definizioni ed evidenze usate per il livello semantico, righe o colonne necessarie all'interpretazione, risultati aggregati, tabelle, grafici, assunzioni e controlli. Se Codex apre direttamente un file sorgente, anche il contenuto letto di quel file entra nel contesto del modello.","Gli script locali elaborano il dataset selezionato per profiling, compatibilità, calcoli e rendering; non scelgono da soli il significato commerciale o il grafico finale. Il flusso non usa una route FastAPI di upload e gli script non effettuano chiamate a un'API del modello. Pubblicare un report o un dashboard è un passaggio separato richiesto esplicitamente.","La pubblicazione richiesta con Sites trasferisce l’intero HTML, inclusi dati finanziari nelle viste nascoste, ipotesi del forecast, commenti e nomi presenti nelle tabelle opzionali. Gli export originali, le popolazioni complete e il JSON del pacchetto non sono copiati nella pagina pubblica. Accesso, conservazione ed eliminazione dipendono da Sites. Le fonti vengono ricontrollate prima di ogni nuova pubblicazione; non è un monitoraggio automatico."]},"status":"relevant"}},"repository_source_review":{"path":"privacy/repository-source-reviews/workstream-reporting-engine.json","scope":"reviewed_repository_declaration_not_hosted_runtime","service_id":"workstream-reporting-engine"},"review":{"basis":"external_boundary_review_of_workflow_source","fingerprint_scope":"installed_client_and_repository_review_declaration","reviewed_at":"2026-11-04","reviewed_by":"privacy-surface-review","source_fingerprint":"9211b35f503c9d6ae8ee6780419afdbd2f4f9b41584fc3c4b3422a44cb4ca104"},"role":"workflow","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":3,"security_controls":[{"control":"The optional stdlib budget preview binds only 127.0.0.1 and serves one opaque route for the selected native dashboard. It checks its exact byte count and SHA-256 against the adjacent execution receipt, permits only the current bundled presentation script, rejects active embeds and event attributes, and pins both report and receipt for the server lifetime. Its CSP blocks external resources and forms, retains an opaque sandbox origin and permits the known script plus print dialogs. Other routes and changed files are rejected. It writes no access logs, does not serve input files or receipts, and makes no upload. Loopback and the opaque URL are not authentication against other local processes; opening the report in Codex remains ordinary native model processing.","id":"local-budget-preview"}],"service_ids":["managed-python-runtime","operational-incidents","run-receipt-stamping","workflow-usage"],"source_contract_sha256":"8e41a09c8147055365c46203e5f9dbe81c42f1233d6578f163867239dc622478","workstream":"reporting-engine"}