# BAT-017: Import provenance and sensitive-data policy

- Profile: standard
- Status: release-candidate
- Included REQ: REQ-021
- Source Discovery: dcy-014
- Created At (KST): 2026-07-08 11:33 KST

## Objective
Deliver the approved REQ-021 scope for normalized import provenance, `raw_payload=minimize`, masked filename + source hash, MCP provenance exposure levels, finance-agent privacy boundary, destructive migration guardrails, and baseline documentation.

## Included Scope
- Source-specific provenance envelope for KB Bank PDF, Toss Bank PDF, Toss Securities PDF, SeoulPay XLSX, and CSV preview/import surfaces.
- `transactions.raw_payload` minimize policy using explicit allowlists and forbidden-field filtering.
- `import_batches.filename` policy change away from full paths toward masked basename + source hash.
- MCP/Streamlit provenance exposure levels: default `minimal`, operator `operator-summary`, debug `debug-gated`.
- Sensitive-field tests/static checks for raw payload, full paths, password/token/secret, raw document text, and arbitrary CSV column leakage.
- Baseline updates in `docs/data-model.md`, `docs/project-structure.md`, and `docs/runtime-flows.md`.

## Excluded Scope
- Existing operating DB sanitization migration; tracked separately in GitHub Project 4 Todo `기존 운영 DB import evidence sanitization preview 및 정리`.
- External legal/security audit.
- Original source document vault/encryption system.
- Public API auth/TLS design.
- Kanban-based delivery execution.

## Documents
- [planning.md](planning.md)
- [design.md](design.md)
- [implementation.md](implementation.md)
- [verification.md](verification.md)

## Delivery Notes
- User explicitly prohibited Kanban; delivery execution must use direct branch/PR or a dedicated non-Kanban worktree if delegated.
- Implementation should be sliced to avoid the previous BAT-016 large-card failure pattern: provenance helpers first, source adapters second, MCP/Streamlit exposure third, tests/docs last.


## Merge Evidence
- PR: https://github.com/genichin/jarca-ledger-mcp/pull/2
- Merge commit: `d9182f28f286667fb7ff52115c33ab2e5003b269`
- Merged At: 2026-07-09 18:44 KST
- GitHub Actions: contract-regression, dashboard-app-test, dashboard-http-smoke, db-safety-smoke, lint, pytest-regression all passed before merge.
- Local post-merge verification: `. .venv/bin/activate && python -m ruff check .` pass; `. .venv/bin/activate && python -m pytest -q` pass (`59 passed, 4 skipped`).