BAT-017: Import provenance and sensitive-data policy

Profile: standard
Status: release-candidate
Included REQ: REQ-021
Source Discovery: dcy-014
Created At (KST): 2026-07-08 11:33 KST

Objective

Deliver the approved REQ-021 scope for normalized import provenance, raw_payload=minimize, masked filename + source hash, MCP provenance exposure levels, finance-agent privacy boundary, destructive migration guardrails, and baseline documentation.

Included Scope

Source-specific provenance envelope for KB Bank PDF, Toss Bank PDF, Toss Securities PDF, SeoulPay XLSX, and CSV preview/import surfaces.
transactions.raw_payload minimize policy using explicit allowlists and forbidden-field filtering.
import_batches.filename policy change away from full paths toward masked basename + source hash.
MCP/Streamlit provenance exposure levels: default minimal, operator operator-summary, debug debug-gated.
Sensitive-field tests/static checks for raw payload, full paths, password/token/secret, raw document text, and arbitrary CSV column leakage.
Baseline updates in docs/data-model.md, docs/project-structure.md, and docs/runtime-flows.md.

Excluded Scope

Existing operating DB sanitization migration; tracked separately in GitHub Project 4 Todo 기존 운영 DB import evidence sanitization preview 및 정리.
External legal/security audit.
Original source document vault/encryption system.
Public API auth/TLS design.
Kanban-based delivery execution.

Documents

Delivery Notes

User explicitly prohibited Kanban; delivery execution must use direct branch/PR or a dedicated non-Kanban worktree if delegated.
Implementation should be sliced to avoid the previous BAT-016 large-card failure pattern: provenance helpers first, source adapters second, MCP/Streamlit exposure third, tests/docs last.

Merge Evidence

PR: https://github.com/genichin/jarca-ledger-mcp/pull/2
Merge commit: d9182f28f286667fb7ff52115c33ab2e5003b269
Merged At: 2026-07-09 18:44 KST
GitHub Actions: contract-regression, dashboard-app-test, dashboard-http-smoke, db-safety-smoke, lint, pytest-regression all passed before merge.
Local post-merge verification: . .venv/bin/activate && python -m ruff check . pass; . .venv/bin/activate && python -m pytest -q pass (59 passed, 4 skipped).

2.4 KiB Raw Blame History