Dossier→presence seam: sanitization gate + permission protocol

[ojfbot]

Question

How do engagement artifacts flow to the public-presence surfaces: what sanitization gate (stranger-test lint reuse per adr:boundary-enforced-by-construction?), what Matthew-permission protocol (what needs explicit sign-off, defaults when refused), and what the sanitized case-study skeleton commits to up front?

Type

grilling (HITL, /grill-with-docs)

Context

Map: #344. Publication surfaces themselves are owned by fde-operating-presence (#319) — this ticket decides only the seam. Precedent: adr:employer-evidence-boundary (#321) solved the same shape for day-job material.

Blocked by

None — on the frontier.

Resolution (filled at close)

—

[ojfbot]

Resolution

Grilled via /grill-with-docs, four operator decisions (2026-08-01):

	Decision
Release model	Per-artifact clearance — each outbound artifact gets the client principal's sign-off naming its disclosure scope (name / metrics / screenshots / builder names). Category-level release and blanket-at-kickoff both rejected.
Cleared home	Never in public git. Public repos stay absolutely lint-clean: the client term-set joins the same gitignored denylist as adr:employer-evidence-boundary (stranger test, default form "a DFW restoration contractor", no exceptions). Cleared renders are authored in private fieldwork-1 and published by the operator directly to presence surfaces.
Refusal default	Refusal narrows, never erases — an item-level refusal drops the artifact to its de-identified render, which still publishes. Only outright documentation-refusal re-scopes the engagement (standing vault-brief ruling).
Skeleton	Committed at kickoff: G3 spine (discovery → prototype on their data → deploy → value in their numbers) with the before/after baseline table, G1 eval receipts embedded, G4 plumbing sidebar; blanks filled weekly; always publishable de-identified. Answers the audit's G1-vs-G3 open question by producing both.

Why per-artifact + absolute lint is coherent: #321 killed judgment-at-crossing for git because agents write to git and don't read policy before merging. Here the finer-grained judgment survives because cleared artifacts never touch public git — the only crossing (posting to a presence surface) is an act only the operator performs. The mechanical gate covers exactly the surface agents can breach; the human judgment step lives only where a human hand is already required.

Protocol defaults recorded with the ruling: sign-off = written words captured verbatim into a permission ledger in fieldwork-1 (a verbal yes is not clearance until echoed in writing); builder names additionally need that builder's own permission; agents never publish outward.

Landed — PR #360: map gist + ticket table + frontier updated; decisions/open-unknowns.md appended (3 deferred / 4 unvalidated / 3 not-covered, incl. screenshot EXIF/PII, third-party adjuster/insurer data, and revocation-after-publication).

For /adr new: one stub — engagement-disclosure-seam (Proposed), precedent-linked to adr:employer-evidence-boundary + adr:boundary-enforced-by-construction.

Coordinates: #356 executes the public-map scrub under this protocol (same term-set, describe-never-reproduce; history rewrite vs acceptance stays that ticket's operator call). #346's instrument carries the permission ask whose answer activates the ledger. The denylist lint remains a roadmap delivery (two-ledger rule), now carrying a second-term-set requirement.