feat(privacy): refuse blanket-masked scientific field grants

[seonghobae]

Summary

• ADR 0009 selective disclosure: purpose-bound field grants from origin/main.
• Scientific purpose keeps authorship, event-time, and membership linkage present on the source.
• Operational monitoring and scientific exports refuse direct identity and source text.
• Re-identification is the only identity/source-text grant.
• Blanket PII masking is not a disclosure authorization.
• Recovered field sets match known truth at a higher computed rate than a mask collapse.

Why this increment

#45 (0007) is MERGEABLE BLOCKED: exact-head required checks are green/queued, OpenCode CHANGES_REQUESTED on 190a08f is dismissed, and there is no qualifying independent APPROVE. Review wait and coverage-evidence queue are local. Do not empty-commit #45.

#93/prediction_contradiction remains draft; #94 already owns the observed-coverage successor. ESEM/DSEM is #49, VRAM/GPU is #51, encrypted mapping persistence waits for #45/0008. Selective disclosure was the remaining named ADR 0009 control not owned by an open PR.

Claim boundary

• In-memory closed field/purpose vocabulary only.
• Not persistence, encryption-at-rest, or a certification/attestation claim.
• Recovery is field-set agreement, not a generative psychometric study.

Test plan

• RED: stub disclose returned InvalidDisclosurePayload; six contract tests failed
• cargo test -p selective_disclosure --lib --tests
• cargo clippy -p selective_disclosure --all-targets -- -D warnings
• authored line coverage 55/55; nightly --branch 22/22
• workspace contract, docstring, Python 100% statement/branch, documentation validation
• Exact-head CI and independent review

Next action

Keep this PR draft. Prefer merge of #45 when exact-head required checks and a qualifying independent APPROVE exist.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8e3012f0-bba1-4aba-b1a6-99842df5c492

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}