BAT-017 Planning: Import provenance and sensitive-data policy

Status: draft
Created At (KST): 2026-07-08 11:33 KST
Included REQ: REQ-021

Planning Summary

BAT-017 is a standard batch because REQ-021 affects data persistence policy, import adapters, MCP/Streamlit response contracts, tests, and baseline documentation.

Work Slices

Define provenance policy helpers
- masked basename helper
- source hash propagation helper
- raw payload minimization/filter helper
- exposure-level sanitizer for minimal, operator-summary, debug-gated
Apply policy to import write paths
- KB Bank PDF
- Toss Bank PDF
- Toss Securities PDF
- SeoulPay XLSX
- CSV preview/import boundary
Apply policy to read/response surfaces
- import batch listing
- preview responses
- MCP tool contracts/default output
- Streamlit/operator summary where applicable
Add regression checks
- source-specific import tests
- forbidden-field filtering tests
- default MCP response privacy checks
- fixture/log/static scan checks
Update baseline documents
- docs/data-model.md
- docs/project-structure.md
- docs/runtime-flows.md

Design Gate

Design is required. The batch changes persistence semantics and interface response boundaries, so design.md must be completed before implementation.

Risks

Over-sanitizing may weaken duplicate/rollback/audit traceability.
Under-sanitizing may leak file paths, raw financial evidence, or arbitrary CSV columns.
Existing operating DB rows may contain legacy data; this batch must avoid destructive cleanup and keep the follow-up Todo separate.

Verification Plan

python -m ruff check .
source-specific pytest for import provenance behavior
full python -m pytest -q
MCP contract/default privacy checks
dashboard/AppTest/HTTP smoke if affected
DB safety smoke if schema/migration changes are included
StagePilot doctor with current-batch findings separated from pre-existing debt

2.0 KiB Raw Blame History