docs: confirm import provenance req and batch

2026-07-08 11:34:37 +09:00
parent 7c50298c4e
commit c9231c2685
10 changed files with 421 additions and 25 deletions
@@ -0,0 +1,57 @@
+# BAT-017 Planning: Import provenance and sensitive-data policy
+
+- Status: draft
+- Created At (KST): 2026-07-08 11:33 KST
+- Included REQ: REQ-021
+
+## Planning Summary
+
+BAT-017 is a standard batch because REQ-021 affects data persistence policy, import adapters, MCP/Streamlit response contracts, tests, and baseline documentation.
+
+## Work Slices
+
+1. Define provenance policy helpers
+   - masked basename helper
+   - source hash propagation helper
+   - raw payload minimization/filter helper
+   - exposure-level sanitizer for `minimal`, `operator-summary`, `debug-gated`
+2. Apply policy to import write paths
+   - KB Bank PDF
+   - Toss Bank PDF
+   - Toss Securities PDF
+   - SeoulPay XLSX
+   - CSV preview/import boundary
+3. Apply policy to read/response surfaces
+   - import batch listing
+   - preview responses
+   - MCP tool contracts/default output
+   - Streamlit/operator summary where applicable
+4. Add regression checks
+   - source-specific import tests
+   - forbidden-field filtering tests
+   - default MCP response privacy checks
+   - fixture/log/static scan checks
+5. Update baseline documents
+   - `docs/data-model.md`
+   - `docs/project-structure.md`
+   - `docs/runtime-flows.md`
+
+## Design Gate
+
+Design is required. The batch changes persistence semantics and interface response boundaries, so `design.md` must be completed before implementation.
+
+## Risks
+
+- Over-sanitizing may weaken duplicate/rollback/audit traceability.
+- Under-sanitizing may leak file paths, raw financial evidence, or arbitrary CSV columns.
+- Existing operating DB rows may contain legacy data; this batch must avoid destructive cleanup and keep the follow-up Todo separate.
+
+## Verification Plan
+
+- `python -m ruff check .`
+- source-specific pytest for import provenance behavior
+- full `python -m pytest -q`
+- MCP contract/default privacy checks
+- dashboard/AppTest/HTTP smoke if affected
+- DB safety smoke if schema/migration changes are included
+- StagePilot doctor with current-batch findings separated from pre-existing debt