feat(api): purpose-bound provider payloads refuse identity mappings

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `tepp_api` purpose-bound provider-payload minimization: time-bounded `PurposeGrant` evaluation, fail-closed expired/not-yet-valid/inverted/cross-tenant/impossible-calendar denial, semantic UTC calendar validation, refusal to copy identity mappings into model-provider payloads or ordinary logs, preservation of opaque analytical identifiers and membership roles (no blanket PII mask), a separately authorized scientific re-identification path, and an internally bound FIPS 180-4 SHA-256 audit digest appended through `ReidentificationAuditSink` before disclosure.
 - `persistence_postgres` retention/deletion/legal-hold (migration `0007`): policy rows, legal holds that block completed deletion, evidence tombstones without raw-source restore, analysis exclusion only for `logical_revocation`/`identity_tombstone` (not `cache_export_removal`), and deletion requests bound to the cited retention policy's tenant/class/purpose.
 - `persistence_postgres` backup/restore integrity: restored snapshots stay unusable until tenant, canonical `SHA-256`, knowledge-cutoff eligibility, temporal window order, and append-only triggers revalidate; SQL probes raise `restore integrity failed` (ADR 0013).
 - `persistence_postgres` concurrent document-write stress: atomic revise `DO` block that requires exactly one open `system_to` close, SQLSTATE mapping onto `ConcurrentWriteConflict` / `DuplicateDocumentRecord`, and live multi-session insert/revise/append-only proofs. No new migration number.

DOCUMENTATION.md

@@ -34,6 +34,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Actions workflow fleet audit | [`docs/operations/ACTIONS_WORKFLOW_FLEET.md`](docs/operations/ACTIONS_WORKFLOW_FLEET.md) |
 | Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) |
 | Retention/deletion/legal-hold doctoring | [`docs/research/retention-deletion-legal-hold.md`](docs/research/retention-deletion-legal-hold.md) |
+| Provider-payload minimization doctoring | [`docs/research/provider-payload-minimization.md`](docs/research/provider-payload-minimization.md) |
 | Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |
 

crates/persistence_postgres/src/artifact_sql.rs

@@ -226,6 +226,7 @@ mod tests {
             assert_source_artifact_matches_sql(&with_ref).expect("referenced assertion");
         assert!(referenced_assertion.contains("s3://tepp/object"));
         assert!(referenced_assertion.contains("IS NOT DISTINCT FROM 's3://tepp/object'"));
+        assert!(referenced_assertion.contains("protected_object_ref IS NOT DISTINCT FROM"));
 
         assert_eq!(
             insert_source_artifact_sql(&SourceArtifactRecord {

crates/persistence_postgres/tests/source_artifact_sql_contract.rs

@@ -177,4 +177,11 @@ fn assert_sql_requires_every_stored_field_to_match() {
     assert!(sql.contains("protected_object_ref IS NOT DISTINCT FROM"));
     assert!(sql.contains("system_time"));
     assert!(sql.contains("available_time"));
+    assert!(sql.contains("NULL"));
+
+    let mut with_ref = artifact();
+    with_ref.protected_object_ref = Some("s3://tepp/evidence/object".into());
+    let referenced = assert_source_artifact_matches_sql(&with_ref).expect("assert-ref");
+    assert!(referenced.contains("s3://tepp/evidence/object"));
+    assert!(referenced.contains("protected_object_ref IS NOT DISTINCT FROM"));
 }

crates/tepp_api/Cargo.toml

@@ -16,6 +16,8 @@ publish = false
 [dependencies]
 serde = { workspace = true }
 serde_json = { workspace = true }
+sha2 = { workspace = true }
+temporal_core = { path = "../temporal_core", version = "0.1.0" }
 
 [lints]
 workspace = true

crates/tepp_api/src/lib.rs

@@ -15,6 +15,7 @@ mod envelope;
 mod error;
 mod export;
 mod naruon_http;
+mod provider_payload;
 mod wire;
 
 /// Analysis-run contract version constant.
@@ -66,3 +67,25 @@ pub use naruon_http::naruon_analysis_run_exchange_with_headers;
 pub use naruon_http::naruon_export_exchange;
 /// Refuse lexical heuristics as TEPP inference claims.
 pub use naruon_http::naruon_may_claim_tepp_inference;
+/// Elevated re-identification result.
+pub use provider_payload::DisclosedIdentityMapping;
+/// Separately protected identity mapping.
+pub use provider_payload::IdentityMappingRecord;
+/// Minimized provider payload without direct identity.
+pub use provider_payload::MinimizedProviderPayload;
+/// Log-safe provider disclosure record.
+pub use provider_payload::ProviderDisclosureLog;
+/// Evidence offered to a model provider.
+pub use provider_payload::ProviderEvidenceOffer;
+/// Time-bounded purpose grant.
+pub use provider_payload::PurposeGrant;
+/// Redacted re-identification decision outcome.
+pub use provider_payload::ReidentificationAuditOutcome;
+/// Redacted append-only re-identification audit record.
+pub use provider_payload::ReidentificationAuditRecord;
+/// Append-only persistence port for re-identification audit evidence.
+pub use provider_payload::ReidentificationAuditSink;
+/// Disclose a mapping on the elevated scientific path.
+pub use provider_payload::disclose_identity_mapping;
+/// Minimize evidence for a model provider.
+pub use provider_payload::minimize_provider_payload;