Date: 2026-09-15 Scope: Eve assistant data minimization, redaction, secret
detection, sensitive-data detection, and exfiltration resistance Machine record:
docs/audits/eve-sota-sensitive-data-boundaries/2026-09-15.json
Result#
The candidate defines one bounded guard contract for all ten Task 14.3 boundaries: ingress, prompt assembly, tool result, trace/log, screenshot, audio, video, artifact, eval evidence, and egress. The machine record binds each boundary to its implementation and regression tests. A semantic verifier checks the exact inventory, source tokens, test tokens, media completeness requirements, ephemeral keyed receipt binding, and eval scanner version.
The shared guard detects credential shapes without depending on a registered-secret list, direct personal-data patterns, recursively encoded disclosures, secret-named structured fields, unsafe object graphs, incomplete media extraction, and incomplete or oversized archives. Findings contain category and structural ordinals only. Receipts bind input and output using a process-ephemeral HMAC-SHA-256 key so retained metadata cannot become a dictionary oracle for low-entropy identifiers.
The browser screenshot path uses a real DOM renderer. Private regions, form values, assistant UI, script/style/template content, embedded media, CSS image content, custom-element content, and shadow content are omitted. Complete bounded text from the sanitized DOM is inspected before the image is admitted to the reviewed vision route. Desktop and mobile Playwright runs verify visible chart pixels survive while private pixels and values do not.
Adversarial coverage#
The candidate exercises structured secret fields and keys; Base64, hexadecimal, percent, and nested encodings; image/OCR extraction; complete and incomplete archives; provider-delta splitting; and encoded tool-result-to-tool-argument smuggling. Size, depth, node, candidate, media-extraction, and archive-enumeration exhaustion fail closed.
Eval evidence is scanned over complete artifact bytes with
eval-data-sensitive-v2, which adds direct personal data plus recursively
encoded sensitive content to the existing credential and email checks. Existing
Task 12.5 governance evidence is regenerated whenever this scanner or its bound
registry changes.
Exact limitations#
- Raw server-STT audio reaches only a Task 14.2-admitted speech provider before the returned transcript can be inspected. No local pre-provider ASR claim is made.
- Screenshot admission is limited to sanitized DOM rendering plus complete bounded DOM text. Non-DOM media is hidden, not classified by pixel OCR.
- Video admission scans structured provider payloads and requires a complete clean delivered transcript; it does not perform frame-by-frame OCR over arbitrary video pixels.
- This task establishes data-boundary inspection and minimization, not the attachment/generated-artifact retention, sharing, export, deletion, or backup lifecycle owned by Task 14.8.
- The Playwright vision endpoint is a deterministic provider double. It proves the real browser, screenshot, client-tool, BFF, privacy, and cancellation boundaries, not a live external model call or provider quality.
Phase 14 and G16 remain open after this task; Tasks 14.4 through 14.8 own the remaining rights, retention/access, legal-applicability, media-rights, and artifact-lifecycle work.