ThePirateRay/docs/data-handling.md

Data handling policy

Authoritative repositories

Classification	Repository	Examples
public	ThePirateRay	Code, tests, plans, schemas, sanitized analysis
private-sensitive	ThePirateRay-PrivateStash	Serial numbers, local usernames, license-related data, private source locators
private-third-party	ThePirateRay-PrivateStash	Vendor binaries, manuals, raw LightBurn/EZCAD files with unclear redistribution rights

Google Drive is a read-only acquisition source, not a project workspace. No project artifact is created, edited, renamed, or reorganized there.

Rules

• Preserve raw bytes. Analysis always produces a new file.
• Record SHA-256, byte size, media type, acquisition time, origin label, and classification for every acquired file.
• Keep exact Drive IDs, URLs, machine serials, usernames, and local paths only in the private manifest.
• Refer to private evidence publicly using artifact_id and sha256 only.
• Never commit LightBurn Support Data to the public repository.
• Do not execute software acquired from the installer stick during analysis.
• Run the public repository guard before each public push.

Redaction flow

1. Acquire the original into the private repository.
2. Generate and verify the private manifest.
3. Analyze the original without modifying it.
4. Create a sanitized derivative in the public repository.
5. Run automated guards and manually review the staged diff.
6. Commit and push the private evidence before the public claim that cites it.