feat: enforce import provenance exposure policy (#2)

Merge BAT-017 / REQ-021 implementation after delivery-runner implementation, independent QC, and passing GitHub Actions CI.

docs/runtime-flows.md

@@ -4,8 +4,8 @@
 - Baseline Seed: `.stage-pilot/bootstrap/baseline.yaml`
 - Status: draft
 - Owner: Jarca / project maintainer
-- Last Updated (KST): 2026-07-08
-- Source Discovery / Batch: bootstrap-baseline, BAT-006, BAT-007, BAT-008, BAT-010, BAT-012, BAT-013, BAT-014, dcy-013/BAT-015, dcy-012/REQ-020/BAT-016
+- Last Updated (KST): 2026-07-09
+- Source Discovery / Batch: bootstrap-baseline, BAT-006, BAT-007, BAT-008, BAT-010, BAT-012, BAT-013, BAT-014, dcy-013/BAT-015, dcy-012/REQ-020/BAT-016, REQ-021/BAT-017
 - Primary Runtime: mixed
 
 ## Project Summary
@@ -55,9 +55,14 @@
 2. MCP adapter forwards arguments to the matching callable exposed by `adapters/mcp/tool_contracts.py`.
 3. Service facade routes into the relevant application module.
 4. Application code opens SQLite through `infrastructure/sqlite` helpers, validates inputs, and performs the operation.
-5. Application returns a dictionary payload with success data or error information.
+5. Application returns a dictionary payload with success data or error information; import-related provenance is expected to be sanitized for the requested exposure level.
 6. Hermes surfaces the tool result to the user or uses it in a follow-up workflow.
 
+### MCP provenance exposure boundary
+- Default finance-agent/tool responses use `minimal` provenance exposure.
+- Operator-facing surfaces may request `operator-summary` when masked filename, source-hash prefix, or validation summary are needed for audit triage.
+- Debug details require an explicit debug-gated path and still exclude passwords, tokens/secrets, and full source document dumps by default.
+
 ## Flow: `Streamlit dashboard operation`
 1. Operator starts `streamlit run dashboard/app.py --server.address 0.0.0.0 --server.port 8501`.
 2. Dashboard reads the configured/default SQLite database.
@@ -84,8 +89,8 @@
 ## Flow: `Import preview and import`
 1. Operator chooses a supported source file: KB Bank PDF, Toss Bank PDF, Toss Securities PDF, SeoulPay XLSX, or CSV.
 2. Preview function routes through `imports_service.py`, which calls the parser seam under `infrastructure/parsers/*` and reports counts, sample rows, duplicate status, and classification preview.
-3. On explicit import, `imports_service.py` creates/fetches the target account, inserts non-duplicate transactions, writes provenance, and records an import batch.
-4. Reports and dashboard views read the inserted rows using shared category/cashflow semantics.
+3. On explicit import, `imports_service.py` creates/fetches the target account, inserts non-duplicate transactions, writes minimized/raw-payload-allowlisted provenance, and records an import batch with masked filename plus source-hash prefix instead of a full local path.
+4. Reports, MCP tools, and dashboard views read the inserted rows using shared category/cashflow semantics while returning normalized provenance metadata rather than raw document evidence by default.
 5. If an import is wrong, rollback uses import batch data and soft-deletes by default.
 
 ## Flow: `Categorization rule lifecycle`
@@ -155,6 +160,7 @@
 - Update this document when a batch changes the approved flow baseline.
 
 ## Change Log
+- 2026-07-09 KST: REQ-021/BAT-017 기준으로 import provenance exposure flow, operator-summary handling, and explicit debug gate requirement를 반영.
 - 2026-06-26 22:24 KST: Created by `bootstrap-baseline` from repository observation.
 - 2026-06-27 10:17 KST: BAT-002/REQ-002 기준으로 운영 backup/status/list/hash 및 restore 제한 flow 추가.
 - 2026-06-29 KST: REQ-003/BAT-003 기준으로 statement-unavailable 수동 잔액대조 flow 추가.