feat: enforce import provenance exposure policy (#2)

Merge BAT-017 / REQ-021 implementation after delivery-runner implementation, independent QC, and passing GitHub Actions CI.

docs/data-model.md

@@ -4,8 +4,8 @@
 - Baseline Seed: `.stage-pilot/bootstrap/baseline.yaml`
 - Status: draft
 - Owner: Jarca / project maintainer
-- Last Updated (KST): 2026-07-01
-- Source Discovery / Batch: bootstrap-baseline, BAT-008, BAT-009
+- Last Updated (KST): 2026-07-09
+- Source Discovery / Batch: bootstrap-baseline, BAT-008, BAT-009, REQ-021/BAT-017
 
 ## Project Summary
 - Jarca 가계부 전용 MCP 서버와 Streamlit 대시보드로 계좌/카드 거래, 예산, 분류 규칙, import, 현금흐름 분석을 SQLite에 저장하고 운영한다.
@@ -107,6 +107,7 @@
   - `category` / `subcategory` :: text :: household classification
   - `merchant`, `counterparty`, `description`, `payment_method` :: text :: evidence and display fields
   - `source`, `external_id`, `import_batch_id`, `raw_summary`, `raw_payload` :: text :: provenance and audit fields
+  - `raw_payload` write policy is `minimize`: only source-specific allowlisted normalized keys may be persisted; raw document dumps, full file paths, passwords, tokens/secrets, and arbitrary parser columns are excluded.
   - `memo` :: text :: operator notes and reconciliation tags
   - `status` :: text :: active/deleted/review lifecycle state where used
 - Relationships:
@@ -160,13 +161,15 @@
 - Key Fields:
   - `id` :: text :: import batch identifier
   - `source` :: text :: source kind
-  - `file_path` / source metadata where stored
+  - `filename` :: text :: masked basename plus source-hash prefix for operator correlation; full local source paths must not be stored on new writes
+  - `memo` :: text/json :: compact batch metadata such as source hash, validation summary, or source-specific sheet/page references used for read-time provenance shaping
   - `inserted_count`, `skipped_duplicate_count`, `created_at`, `rolled_back_at`
 - Relationships:
   - Transaction rows reference `import_batch_id`.
 - State Rules:
   - Rollback should soft-delete by default.
   - Duplicate imports with `skip_duplicates=True` may insert zero rows; that is not automatically an error.
+  - Read surfaces should expose sanitized provenance envelopes: default `minimal`, explicit operator-facing `operator-summary`, and explicit debug-gated diagnostics without full document/path leakage.
 
 ## Entity: Budget
 - Source of Truth: budget table/service functions
@@ -224,7 +227,7 @@
 - Operational backup/status evidence may include only path, size, mtime, checksum, integrity, row counts, and aggregate totals.
 - Validation DB copies should live outside the repository and should be selected explicitly via `JARCA_LEDGER_DB_PATH` when used.
 - Passwords for encrypted imports are runtime-only inputs and are not part of the persisted model.
-- Raw payloads may contain sensitive financial evidence and should not be committed to git.
+- Raw payloads may contain sensitive financial evidence and should not be committed to git; BAT-017 constrains new writes to minimized allowlisted payloads only and leaves legacy row cleanup to a separate approved follow-up.
 - ReviewDecision `target_payload` is sanitized to omit `raw_payload`, passwords, tokens, secrets, and file paths before persistence.
 
 ## Current Gaps / Planned Changes
@@ -234,6 +237,7 @@
 - BAT-009 implements manual asset CRUD mutation and month-end snapshot preview/close/correction service/MCP/dashboard workflow. Future work may add automatic market/real-estate valuation or scheduled month-end close.
 
 ## Change Log
+- 2026-07-09 KST: REQ-021/BAT-017 기준으로 import provenance exposure policy, `transactions.raw_payload=minimize`, `import_batches.filename` masked-basename persistence, and explicit debug gate expectations를 반영.
 - 2026-06-26 22:24 KST: Created by `bootstrap-baseline` from repository observation.
 - 2026-06-27 10:17 KST: BAT-002/REQ-002 기준으로 LedgerBackupArtifact와 metadata-only evidence 정책 추가.
 - 2026-06-29 KST: REQ-003/BAT-003 기준으로 `accounts.statement_status`와 수동 잔액대조 preview 모델 추가.