# Privacy Finality Reference v0.1.0

Runnable Python reference implementation of the execution-bound privacy architecture discussed in `draft-das-global-privacy-execution-enforcement-00`.

It demonstrates the invariant:

> An authenticated workload may compute a privacy-sensitive operation, but the protected external effect is not recorded by the Finality Sink unless the exact Candidate Act, purpose, minimum-data scope, recipient, destination, policy epoch, nonce, workload proof-of-possession, and sink binding all verify.

## What is implemented

- **Candidate Act** with deterministic canonical JSON and SHA-256 exact-act digest.
- **Non-Effective State** represented by the fact that the only effect-recording API is inside the Finality Sink.
- **Non-Joinable logical vaults**: Identity, Relationship, Data, Purpose, Jurisdiction, and Crypto/Policy state are separate objects; the PED requests predicates/minimum fields instead of exporting whole vault contents.
- **Protected Enforcement Domain (PED)** that conjunctively validates identity/resource relationship, purpose, requested data, recipient, destination, and current policy epoch.
- **Virtual Identity commitment** derived inside the Identity Vault. The raw VI is never returned to the application-facing grant.
- **Signed act-bound Validation Permit** using Ed25519.
- **Non-bearer behavior**: possession of the permit is insufficient; the bound workload must also produce an Ed25519 proof-of-possession for the permit and exact act.
- **Finality Sink** that independently verifies the act digest, permit signature, workload proof, scope, destination, recipient, epoch, nonce, expiry, and sink identity.
- **Atomic replay/effect store** using SQLite (`BEGIN IMMEDIATE` + unique JTI), modeling consume-and-effectuate at a single local finality boundary.
- **Fail-closed** behavior on missing, stale, mutated, replayed, mis-bound, or unverifiable state.
- Tests, example vectors, and a microbenchmark script.

## What this does NOT claim

This is a reference implementation, not a legal-compliance engine and not a production security product. It does not decide whether a purpose is legally legitimate, whether consent is valid, whether a transfer mechanism is lawful, or whether a controller satisfies GDPR/PIPL/DPDP/Australian Privacy Act obligations. It enforces machine-readable rules supplied to it.

The logical vault separation in this reference process demonstrates controlled joinability at the software architecture level. Stronger deployments can place vaults/PED/sink state in separate processes, TEEs, HSMs, confidential VMs, DPUs/SmartNICs, or independently administered services.

## Run

```bash
python -m venv .venv
. .venv/bin/activate
pip install -e '.[test]' --no-build-isolation
pytest
python -m privacy_finality.demo
python bench/benchmark.py
```

## SME demo

The built-in demo models a customer asking an SME AI support agent:

> "Where is order 81472?"

The permitted Candidate Act requests only `delivery_status` and `expected_delivery_date` for `CUSTOMER_SUPPORT`, addressed back to the authenticated customer session. Payment and marketing data remain outside the grant.

The demo then attempts purpose substitution (`TARGETED_MARKETING`), which is denied before a Finality Sink effect is recorded.

## Security model note

For a protected consequence, bypass paths must be unavailable. This reference package models the sink as the only effect-recording boundary. In a real deployment, network egress, database commit, payment submission, file export, tool invocation, or another consequence path must be mediated equivalently; otherwise the claimed finality property does not hold.

## Licensing

This repository is published for technical review, research, testing, interoperability discussion, citation, and standards-related evaluation.

Copyright in the source code and accompanying materials is reserved unless expressly stated otherwise.

**No patent license is granted by publication of this repository.** Accessing, downloading, running, testing, modifying, discussing, or citing this reference implementation does not, by itself, grant any express or implied license to practice, implement, manufacture, deploy, commercialize, sublicense, or otherwise exploit any patented invention associated with the demonstrated architecture.

The reference implementation may illustrate subject matter disclosed in associated patent applications and technical publications. Any patent implementation rights remain subject to separate authorization or licensing where applicable.

This software is provided as a research and reference implementation only. It is not represented as production-ready, legally compliant, secure for deployment, or free of third-party intellectual-property rights.

No warranty is provided.