37 lines
1.7 KiB
Markdown
37 lines
1.7 KiB
Markdown
# Data handling policy
|
|
|
|
## Authoritative repositories
|
|
|
|
| Classification | Repository | Examples |
|
|
| --- | --- | --- |
|
|
| `public` | `ThePirateRay` | Code, tests, plans, schemas, sanitized analysis |
|
|
| `private-sensitive` | `ThePirateRay-PrivateStash` | Serial numbers, local usernames, license-related data, private source locators |
|
|
| `private-third-party` | `ThePirateRay-PrivateStash` | Vendor binaries, manuals, raw LightBurn/EZCAD files with unclear redistribution rights |
|
|
|
|
Google Drive is a read-only acquisition source, not a project workspace. No
|
|
project artifact is created, edited, renamed, or reorganized there.
|
|
|
|
## Rules
|
|
|
|
- Preserve raw bytes. Analysis always produces a new file.
|
|
- Record SHA-256, byte size, media type, acquisition time, origin label, and
|
|
classification for every acquired file.
|
|
- Keep exact Drive IDs, URLs, machine serials, usernames, and local paths only
|
|
in the private manifest.
|
|
- Refer to private evidence publicly using `artifact_id` and `sha256` only.
|
|
- Never commit LightBurn Support Data to the public repository.
|
|
- Do not execute software acquired from the installer stick during analysis.
|
|
- Run the public repository guard before each public push.
|
|
|
|
## Redaction flow
|
|
|
|
1. Acquire the original into the private repository.
|
|
2. Generate and verify the private manifest.
|
|
3. Analyze the original without modifying it.
|
|
4. Create a sanitized derivative in the public repository.
|
|
5. Run automated guards and manually review the staged diff.
|
|
6. Commit and push the private evidence before the public claim that cites it.
|
|
|
|
During Drive acquisition, authenticated download references are ephemeral and
|
|
must be passed to the bounded materializer over standard input. They must not be
|
|
written to scripts, manifests, command history, or Git.
|