V37 Gate 7: Conversation persistence privacy

Adds package-owned ConversationPersistencePrivacyRedaction canon source and generated artifact.

Redacts conversation message content, attachment metadata, and execution payloads before durable storage.

Wires source-safe persistence privacy UI, tests, docs, and gate/canon workflow validation.

Author: geraldarthurdavis

.bitcode/v37-conversation-persistence-privacy-redaction.json

@@ -124,6 +124,9 @@ jobs:
               if [ -f scripts/check-v37-gate6-conversation-terminal-handoff.mjs ]; then
                 node scripts/check-v37-gate6-conversation-terminal-handoff.mjs --skip-branch-check
               fi
+              if [ -f scripts/check-v37-gate7-conversation-persistence-privacy-redaction.mjs ]; then
+                node scripts/check-v37-gate7-conversation-persistence-privacy-redaction.mjs --skip-branch-check
+              fi
             fi
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2

.github/workflows/bitcode-canon-quality.yml

@@ -253,6 +253,9 @@ jobs:
               if [ -f scripts/check-v37-gate6-conversation-terminal-handoff.mjs ]; then
                 node scripts/check-v37-gate6-conversation-terminal-handoff.mjs --skip-branch-check
               fi
+              if [ -f scripts/check-v37-gate7-conversation-persistence-privacy-redaction.mjs ]; then
+                node scripts/check-v37-gate7-conversation-persistence-privacy-redaction.mjs --skip-branch-check
+              fi
             fi
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2
@@ -325,7 +328,7 @@ jobs:
           pnpm --filter @bitcode/pipeline-hosts exec jest --config jest.config.cjs --runTestsByPath src/__tests__/distributed-execution-runtime-receipt.test.ts --runInBand --forceExit
           pnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --runTestsByPath src/__tests__/reading-pipeline-observability.test.ts src/__tests__/reading-pipeline-contract.test.ts src/__tests__/v32-reading-pipeline-proof-coverage.test.ts --runInBand --forceExit
           pnpm --filter @bitcode/pipeline-asset-pack exec jest --config jest.config.cjs --runTestsByPath src/__tests__/asset-pack-disclosure.test.ts src/__tests__/postprocess.test.ts src/__tests__/read-need.test.ts --runInBand --forceExit
-          pnpm --filter @bitcode/api exec jest --config jest.config.cjs --runTestsByPath src/conversations/__tests__/stream-events.test.ts --runInBand --forceExit
+          pnpm --filter @bitcode/api exec jest --config jest.config.cjs --runTestsByPath src/conversations/__tests__/stream-events.test.ts src/conversations/__tests__/privacy.test.ts --runInBand --forceExit
           pnpm --filter @bitcode/protocol test
 
       - name: Test staged Reading route and Terminal harness contracts
@@ -343,6 +346,8 @@ jobs:
             tests/api/conversationStreamEventContract.test.ts \
             tests/conversationStreamPipelineLog.test.tsx \
             tests/conversationTerminalHandoff.test.tsx \
+            tests/api/conversationPersistencePrivacyRedaction.test.ts \
+            tests/conversationPersistencePrivacyPanel.test.tsx \
             tests/conversationSourceSelector.test.tsx \
             tests/conversationWritingWorkspace.test.tsx \
             tests/auxillariesExternalsPane.test.tsx \

.github/workflows/bitcode-gate-quality.yml

@@ -3,12 +3,12 @@
 ## Status
 
 - Version: `V37`
-- V37 state: draft implementation; Gate 6 closes ConversationTerminalHandoff transaction handoff over active V36 Exchange canon
+- V37 state: draft implementation; Gate 7 closes ConversationPersistencePrivacyRedaction durable storage privacy over active V36 Exchange canon
 - Current canonical/latest target: `V36`
 - Prior canonical anchor: `BITCODE_SPEC_V36.md`
 - Prior generated proof appendix: `BITCODE_SPEC_V36_PROVEN.md`
-- Generated structured artifact inventory: draft `.bitcode/v37-spec-family-report.json`, `.bitcode/v37-canonical-input-report.json`, `.bitcode/v37-canon-posture-drift-report.json`, `.bitcode/v37-conversation-session-route-history.json`, `.bitcode/v37-conversation-stream-event-contract.json`, `.bitcode/v37-conversation-writing-workspace.json`, `.bitcode/v37-conversation-source-selector.json`, and `.bitcode/v37-conversation-terminal-handoff.json`
-- Source parity state: V37 source parity includes Gate 1 spec family, roadmap, docs, workflow, and checker posture, Gate 2 package-owned ConversationSession route-history contracts, Gate 3 package-owned ConversationStreamEvent stream UI/event contracts, Gate 4 package-owned ConversationWritingWorkspace fullscreen writing contracts, Gate 5 package-owned ConversationSourceSelector source/context policy contracts, and Gate 6 package-owned ConversationTerminalHandoff transaction handoff contracts
+- Generated structured artifact inventory: draft `.bitcode/v37-spec-family-report.json`, `.bitcode/v37-canonical-input-report.json`, `.bitcode/v37-canon-posture-drift-report.json`, `.bitcode/v37-conversation-session-route-history.json`, `.bitcode/v37-conversation-stream-event-contract.json`, `.bitcode/v37-conversation-writing-workspace.json`, `.bitcode/v37-conversation-source-selector.json`, `.bitcode/v37-conversation-terminal-handoff.json`, and `.bitcode/v37-conversation-persistence-privacy-redaction.json`
+- Source parity state: V37 source parity includes Gate 1 spec family, roadmap, docs, workflow, and checker posture, Gate 2 package-owned ConversationSession route-history contracts, Gate 3 package-owned ConversationStreamEvent stream UI/event contracts, Gate 4 package-owned ConversationWritingWorkspace fullscreen writing contracts, Gate 5 package-owned ConversationSourceSelector source/context policy contracts, Gate 6 package-owned ConversationTerminalHandoff transaction handoff contracts, and Gate 7 package-owned ConversationPersistencePrivacyRedaction durable storage privacy contracts
 - Active canonical pointer during draft opening: `BITCODE_SPEC.txt` -> `V36`
 - Notes companion: `BITCODE_SPEC_V37_NOTES.md`
 - Delta companion: `BITCODE_SPEC_V37_DELTA.md`
@@ -35,6 +35,7 @@ V37 adds Website Conversations product contracts over inherited V36 canon:
 - `ConversationWritingWorkspace`: fullscreen writing mode for drafting Read Requests, Need feedback, AssetPack review notes, and Terminal handoff summaries without source leakage.
 - `ConversationSourceSelector`: repository, branch, commit, deposit, BTD range, AssetPack preview, document, and prior conversation source selectors governed by policy, rights, and disclosure posture.
 - `ConversationTerminalHandoff`: source-safe handoff from conversation context into `/terminal` transactions for Depositing, Reading, Finding Fits, Exchange, settlement, and delivery workflows.
+- `ConversationPersistencePrivacyRedaction`: durable conversation storage, visibility tier separation, export, delete, retention, replay, and incident repair posture for source-safe persisted history.
 
 V37 does not replace the V28 ChatGPT App, V33 interface contracts, V35 telemetry/docs, or V36 Exchange law.
 It turns the website conversation surface into a route-owned user experience that consumes those contracts and emits proof-rooted source-safe telemetry.
@@ -189,6 +190,43 @@ source, generated artifact freshness, package tests, UI tests, Terminal route
 tests, docs, workflow wiring, workflow coverage, authority boundaries,
 proof roots, event ids, and source-safe handoff metadata.
 
+## V37 Gate 7 ConversationPersistencePrivacyRedaction canon
+
+Gate 7 implements `ConversationPersistencePrivacyRedaction` as the
+package-owned durable storage privacy and redaction contract for Website
+Conversations. It owns the visibility tier separation for public,
+user-visible, organization-visible, buyer-visible, reviewer-visible, and
+operator-only data. It emits
+`.bitcode/v37-conversation-persistence-privacy-redaction.json` with
+`source-safe-conversation-persistence-privacy-redaction-metadata`,
+deterministic row roots, deterministic detail roots, operation ids, visibility
+tier ids, retention postures, required field ids, proof roots, event ids,
+source evidence roots, and source-safe disclosure limits.
+
+Conversation persistence is durable route-local projection state, not global
+ledger truth. The persisted write path may store source-safe message content,
+source context references, redaction posture, retention posture, proof roots,
+and event ids. It must redact or block protected prompts, protected model
+responses with source, protected source payloads, provider tokens, wallet
+private material, settlement private payloads, private payment credentials,
+operator private notes, unpaid AssetPack source, ledger write authority, and
+wallet signing authority before durable storage, telemetry, export, replay, or
+incident repair.
+
+Gate 7 covers seven persistence operations: persist message, restore history,
+export history, delete history, retain history, replay history, and incident
+repair. Export may only include source-safe data visible to the requesting
+principal. Delete leaves only a source-safe tombstone proof. Retention applies
+the correct visibility tier without escalating disclosure. Replay reconstructs
+prompt template ids and parsed result shapes, never raw protected prompts or
+raw protected model responses. Incident repair may inspect proof roots and
+redaction verdicts but cannot expose protected source or private wallet
+material. `check:v37-gate7` validates package source, generated artifact
+freshness, package tests, API storage redaction tests, UI tests, docs,
+workflow wiring, visibility tier coverage, retention posture coverage, export
+posture, delete posture, replay posture, incident repair posture, proof roots,
+event ids, and source-safe persisted metadata.
+
 ## Inherited V36 Exchange canon
 
 The promoted V36 sections below remain inherited canonical law for Exchange.

BITCODE_SPEC_V37.md

@@ -159,6 +159,16 @@ UI tests, Terminal route tests, workflow wiring, and `check:v37-gate6`.
 
 Gate 7 defines durable storage and privacy controls.
 
+Gate 7 closure adds package-backed `ConversationPersistencePrivacyRedaction`
+source, `.bitcode/v37-conversation-persistence-privacy-redaction.json`,
+`source-safe-conversation-persistence-privacy-redaction-metadata`, public,
+user-visible, organization-visible, buyer-visible, reviewer-visible, and
+operator-only visibility tier separation, persist/restore/export/delete/
+retention/replay/incident repair operation rows, API storage redaction for
+messages, attachment metadata, execution input, and execution metadata,
+source-safe UI preview controls, package tests, API tests, UI tests, workflow
+wiring, and `check:v37-gate7`.
+
 Closure acceptance:
 
 - conversation persistence separates public, user-visible, organization-visible, buyer-visible, reviewer-visible, and operator-only data;

BITCODE_SPEC_V37_DELTA.md

@@ -122,6 +122,20 @@ material, settlement private payloads, unpaid AssetPack source, ledger write
 authority, wallet signing authority, or a Terminal authority bypass. The
 Terminal remains the transaction cockpit.
 
+Gate 7 adds `ConversationPersistencePrivacyRedaction` so durable conversation
+storage has a precise visibility tier boundary. Public, user-visible,
+organization-visible, buyer-visible, reviewer-visible, and operator-only data
+are separated before persistence, export, delete, retention, replay, and
+incident repair. Message content, attachment metadata, execution input, and
+execution metadata pass through redaction before storage. Protected prompts,
+protected model responses, protected source payloads, secrets, provider
+tokens, wallet private material, settlement private payloads, unpaid AssetPack
+source, ledger write authority, and wallet signing authority are blocked or
+redacted. Export is source-safe, delete leaves only a tombstone proof,
+retention never escalates visibility, replay uses prompt template ids and
+parsed result shapes, and incident repair operates over proof roots and
+redaction verdicts.
+
 ## V37 gate plan
 
 - Gate 1: V37 Conversations Roadmap And Spec Opening