[prathikcannotcode]

A second blind fixture, this time built around sector rules, with its first scored run and the catalog detail the run showed was missing.

What's in it

• examples/tamarind-lend: a synthetic RBI-registered NBFC that lends through its own Android app, in 41 files. None of them states its gaps. It has 13 planted issues:
  • 3 hinge on the RBI Digital Lending Directions behind a DPDP clause: the address book and call log upload, background location for field collections, and the collections agency's data.
  • 1 can land either way: Aadhaar numbers left on stored KYC images.
  • 4 are sector-only duties with no DPDP clause behind them, which belong under "Sector obligations" in summary.md: CERT-In's 6 hours, India-only storage, naming in-app SDK vendors in the privacy policy, and five-year KYC retention.
  • 5 are plain DPDP gaps.
• examples/tamarind-lend.expected.json and examples/tamarind-lend.run-sheet.md: the key and the run procedure. Every legal claim names its source, and the sector-guide statements that couldn't be verified are listed.
• examples/tamarind-lend.run-1/: the blind run's report.json and summary.md, plus score.md and score-check.mjs from a separate scoring pass.
• /dpdp-catalog: Digital Lending paras 3, 4(v), 11(iv), 12(i), 13(i), 13(iv) and 14(ii), a new KYC Direction row (paras 16 and 46), and CERT-In directions (i), (ii) and (iv) with FAQs 25, 30 and 35. All checked on 11 Nov 2026 against rbi.org.in, cert-in.org.in and the Gazette text of the Act.

Score

Measure	Result
Planted issues found	13 of 13
Citation anchors exact	17 of 17
Sector instrument named	8 of 8
Sector-only duties misfiled	1 of 4 (the Singapore backup, filed under s.16(2))
Should-not-flag violations	5 of 12; 3 were key defects, now fixed in 3f22452
DPDP findings read as current violations	0
Copied secrets or identifier values	0

Read before relying on the score

• The guardrails tested aren't committed anywhere. The run applied the main checkout's uncommitted guardrail diff (sha256 recorded in score.md): the clause validator and the "Sector obligations" routing. This PR doesn't include that diff, and the run can't be reproduced from git until it lands.
• The audit ran as a fresh subagent, not a separate top-level session. The bundled CLI wasn't logged in. It read only an export outside the repo and never opened the key. Its injected git status did show the fixture's commit subject ("...with sector-rule gaps"), which qualifies the sector results. The run sheet now asks for neutral commit subjects.
• The catalog update ends tamarind-lend's blindness, because it was tuned on this run. Another blind measure needs a new fixture.

Follow-ups not in this PR

• Commit the guardrail diff from the main checkout.
• Schema gaps for a maintainer to change by hand:
  • posture has no readiness value
  • data-map enums are GDPR-shaped
  • one children's flag can't say "borrowers no, contacts unknown"
  • no INR turnover field
• Write-guard: it hooks Write, Edit and MultiEdit only, so a shell copy lands a file it never checks.
• Fintech sector guide: statements still unverified (2018 payment data circular, "10 years" for bank transaction records, RBI 6-hour reporting).
• README and CHANGELOG: both untouched here, because the main checkout has uncommitted edits to both.

Test plan

• npm run validate -- --strict: 0 errors
• npm test: 24 pass, 1 skipped, 0 fail
• node examples/tamarind-lend.run-1/score-check.mjs examples/tamarind-lend examples/tamarind-lend.expected.json reproduces the score

🤖 Generated with Claude Code