The Sanitisation Attestation, field by field

Classes outside the policy. The customer's policy enables, disables or retargets each of the thirteen sensitivity classes. Whatever it did not enable was not looked for, and the attestation says which.

Encodings outside the enumerated list. Recognisers search a finite, declared list of encodings; the attestation does not claim anything about an encoding outside it.

Binaries passed through, by name. A member that cannot be rewritten and was passed through under the policy is named here — and, by name, in the member list.

Structural inference. Subnet sizes, host counts, timing and port mix are not rewritten; the shape of the network is declared, not hidden.

Unknown formats, review overrides, truncation. Members of unrecognised type; anything a reviewer overrode; and, if a container was truncated or corrupt, how far it was read and how many bytes were not.

Job and tenant. One job is one bundle, one policy version, one output, one attestation. Keys, policies, maps and audit are per tenant.

Time source, declared. An air-gapped clock is unverified, so the attestation says where its time came from rather than pretending to a precision it does not have.

Input hashes and size. The input's SHA-256 is recorded before anything runs. Its filename is content too — it may carry a hostname or a site — so only its hash appears.

Inventory. Every job begins with an inventory of the members discovered — path hash, size, detected type, depth, container chain — before any transform runs. The attestation is checked against that inventory, so a member cannot vanish or appear unrecorded.

The policy — identifier, version, hash. The policy is the customer's: versioned, hashed and signed by the customer's policy author. The attestation pins the exact version that governed this job.

Versions of everything that decided the result. The engine, the bundle-family profile, each recogniser pack, the transform pack and the residual-leak catalogue — so a result can be reproduced, and so a later question ("which pack was in use that day?") has an answer.

Key identifier, never the key. The same tenant key gives the same replacement across bundles and across time; the attestation names the key by identifier only.

Output pool. The address space replacements were drawn into — by default the shared address space of RFC 6598 — so a recipient knows that anything in it is a replacement.

One entry per member, at any depth. The path is hashed, because paths are content. Each entry says what was done: rewritten, with the hash before and after and the count of substitutions per sensitivity class; dropped, with the rule that dropped it — here a database export dropped and declared under the policy’s member actions; passed through as a binary, which is why it also appears in the non-assertions by name; or passed through as allowlisted — a version file the per-bundle allowlist recognised.

Nothing is passed through silently. A member either has a rewrite record, a drop record or a declared pass-through. The before-and-after hashes let anyone confirm that the member in the output is the one the attestation describes.

Five scanners, run on the output. Verification is a separate stage with its own code path. The engine's own recognisers re-run on the output; the differential canary scan searches for every original value in every enumerated encoding across every member and every container-metadata field; two independent secret scanners, gitleaks and detect-secrets, run unmodified; the container-metadata scanner checks tar, gzip, zip and capture fields against the residual-leak catalogue; and the binary classifier lists every passed-through binary.

Versions and results, always. A scanner that did not run, or ran with an error, is a failed job: a job with a canary hit, an unresolved review item or a scanner error produces no downloadable output.

Review decisions. Ambiguous hits go to a review queue and are never silently masked or kept; every decision a reviewer took is counted here and appears among the non-assertions where it overrode the engine. Operator and reviewer are recorded.

Utility checks. The output is still worth sending: a structural diff of member counts and sizes, well-formedness of structured files after rewriting, referential integrity — every masked value appears exactly where the original did — and the survival of planted benign look-alikes.

Truncation. Null here; for a truncated or corrupt container, the offset and the unread byte count.

Signature. The canonical JSON is signed with the installation's Ed25519 key, compatible with common signing tools. The signature is over the whole body, so a changed count or a removed non-assertion invalidates it.