Selected Redaction Worker Local Evidence

Date: 2026-06-20
Timezone: America/St_Johns

Scope

Added and tested tools/redact_selected_artifacts.py, a private-lane worker for operator-selected raw artifacts. The worker was tested with local fixtures only; it did not reconnect to Zenbook, copy raw Zenbook files, mount raw survey folders into Explorer, mutate production CT 121, or change public routes.

Worker Contract

The worker reads:

• --source-root: private raw/redaction root,
• --selection: JSON file with explicit item selections,
• --out: sanitized output directory.

It writes:

• manifest.json,
• redaction-report.json,
• catalog-import.json,
• artifacts/*.md.

Generated outputs are review-required and non-publishable:

• raw_content_included=false,
• raw_source_path_included=false,
• raw_source_hash_included=false,
• public_publishable=false,
• human_visible=false,
• ai_visible=false,
• review_required=true.

Local Verification

python tests\test_redact_selected_artifacts.py
python -m unittest discover -s tests -v

Results:

• focused worker tests passed: 2 tests,
• full local unittest discovery passed: 14 tests.

The fixture confirmed:

• fake OpenAI-style keys are redacted,
• bearer tokens are redacted,
• database URLs are redacted,
• useful approved prose survives redaction,
• raw source filenames are not copied into generated outputs,
• generated catalog candidates are not human-visible, AI-visible, or publishable,
• path traversal selections are rejected before reading source material.

This proves the selected-redaction worker can create a review queue from explicit private selections. It does not prove that any real Zenbook, MacBook, Devine, or Cadence material is ready for publication.