# Privacy and data-minimization statement

This package is designed for a public, durable execution environment. In this
Base-only pilot, “privacy-preserving” means **data minimization and
commitments/references**; it does not mean that transactions are invisible,
private, anonymous, confidential, erasable, or withdrawn after publication.
Base transactions, calldata, events, addresses, and public commitments remain
public and durable.

## Data rules

- Do not put freeform PII, credentials, private keys, raw evidence, personal narratives, contact details, or secrets in calldata, events, public strings, issue titles, manifests, or proposal templates.
- Prefer the minimum necessary public reference: a versioned schema identifier, a content digest/commitment, a retention/purpose label, and a controlled off-chain evidence locator when approved.
- A hash is not automatically anonymous. Use a unique salt and assess linkability, dictionary-guessing risk, access control, and the authorization policy before publishing a commitment.
- Collect only fields needed for the stated integration, decision, audit, or dispute purpose. Do not reuse evidence for a new purpose without the applicable authorization and policy review.
- Keep public and private evidence paths subject to equivalent authorization, expiry, integrity, and dispute controls. A private transport does not waive consent or scope checks.
- Store off-chain evidence only in the approved system of record, with retention, access, deletion/return where legally/operationally applicable, and incident handling defined outside this package.

## No-surveillance and consent standard

Surveillance is never a condition of participation, pricing, support,
eligibility, dispute rights, or exit. Do not collect behavioral tracking,
biometrics, precise location, communications content, social graphs, or
cross-context profiles for this pilot. If a future use case proposes a new data
class, it is out of scope until separately reviewed and candidate-bound.

Consent, where it is the applicable basis, must be specific, informed,
affirmative, purpose-limited, recorded, and prospectively revocable where
applicable. Silence, pre-checked boxes, bundled acceptance, continued use, a
wallet address, or a public transaction is not consent. Contractual necessity
or another basis must not be mislabeled as consent. A named privacy reviewer
must approve the data map, legal basis, notices, retention, recipients,
subprocessors, transfers, access controls, and deletion/return procedure before
partner readiness can be claimed.

The package itself does not establish controller/processor roles, regulatory
compliance, or privacy approval. Those determinations and signoffs are external
human blockers.

## Accountability custody boundary

The Base V3 Accountability enforcement ABI does not accept free-form evidence,
evidence locators, narratives, scores, labels, or evaluator-supplied payout
amounts. Its only permitted factual payload is
`ObjectiveEvidence(address bond,uint256 chainId,uint256 bondId,bytes32
termsHash,bytes32 ruleHash,address canonicalSource,bytes32
canonicalSourceId,bytes32 obligationId,uint64 requiredBy,uint64
recordedAt,uint64 observedAt,uint96 nonce,uint64 signatureDeadline)`.
Pre-agreed independent attesters sign that exact payload. The closed rule treats
only an absent canonical record (`recordedAt == 0`) or a record strictly after
`requiredBy` as breach. The contract—not an evaluator—applies the pre-agreed
maximum slash.

Behavioral scoring, reputation, loyalty, flourishing, quality, belief,
biometric, profiling, and surveillance-derived input must not affect custody,
eligibility, pricing, slashing, access, settlement, or disputes. The fixed
`PRIVACY_EXCLUSIONS_HASH` commits that exclusion into every accepted rule.
Partnership settlement remains bilateral and has no attester/adjudicator
custody path.

## Template controls

All evidence, partner, role, and address fields are blank. The agent guide defaults to read-only retrieval and requires explicit authorization before any data submission. Proposal templates refer to an `evidenceReference` rather than containing evidence. Filling a field requires a documented purpose and an approved data classification.

## Prohibited claims

Do not represent a commitment as proof of identity, truth, independence, consent, or audit completion without the applicable verification. Do not claim that public-chain records are erasable.

Do not claim zero data collection, that belief text is never stored, that a
commitment is unlinked, or that a Base transaction is private. Whether a
specific off-chain system receives or retains data requires a separate approved
data map, retention rule, and counsel review; all are blank for this prepared
package.

## Exact-candidate unlinkability execution

Unlinkability evidence cannot be supplied by a general adapter. A future
candidate must use the single canonical implementation path and CLI interface
pinned by reviewed package policy and the exact selected module/route scope.
Candidate responses contain only a blinded content-derived request identifier
and opaque output bytes. They cannot contain pass/fail labels, relationship
labels, output digests, privacy predicates, or audit conclusions.

The trusted launcher recomputes output digests and pair relationships with an
independent oracle. It must run the exact Git blob in an operating-system
isolation boundary with an unshared network namespace, a bounded read-only
runtime closure, no ambient path, strict process/resource/time limits, and an
exact interpreter/isolation-provider identity. It atomically records launcher
and candidate argv, UTC and monotonic timing, exit status, captured output,
input/output/event digests, and a nonce, then signs the record with the
independently pinned execution key.

The checked-in execution trust policy is disabled because no genuine candidate,
execution authority, or reviewed toolchain closure is pinned. Therefore these
controls describe a fail-closed acceptance architecture; they do not claim that
a candidate execution, signature, privacy proof, partner acceptance, or audit
has occurred.

### Source-only runtime and transactional evidence

An enabled future execution policy must pin every executable or interpreted
byte: the sandbox binary, interpreter, source-only standard-library tree,
extension modules, and dynamic libraries. Bytecode caches and symlinks are
prohibited, the interpreter runs with `-I -B`, and every mounted byte is
digest-bound. The sandbox current directory and `PWD` are fixed at `/work`; the
environment is closed and host temporary paths are not exposed through
environment values.

Each execution publishes raw events and the signed receipt into one finalized,
locally read-only generation directory. Files and directories are synchronized,
checked for expected ownership/link/inode identity, and stripped of write bits
before an atomic version pointer may select that generation. The checker
rejects writable generations and resolves the pointer, raw-event digest,
receipt digest, generation identifier, and candidate/evidence commit as one
unit. These permissions are the strongest ordinary local policy enforced here;
they cannot make bytes immutable against the owning account or root. Signed,
candidate-bound, content-addressed verification is therefore authoritative, and
this package does not claim stronger machine immutability.

The verdict is a two-class classification check, not merely a false-link check.
Expected-linked pairs measure true positives and false negatives;
expected-unlinked pairs measure true negatives and false positives. Per-class
and combined conservative confidence bounds must all pass.
Unique-every-request and constant-every-request behavior therefore fail.
