feat: establish a private graph-native protection runtime

[binaryaaron]

Summary

This PR establishes a private graph-native protection runtime through Phase 6. It now
compiles target-anchored mentions from exact source offsets, resolves semantic subjects only
from explicit typed evidence, carries versioned structural role results, and qualifies a
mention-keyed local Redact profile through exact reconstruction and atomic release checks.

The implementation keeps the existing public DataFrame APIs and
NddAdapter.run_workflow() boundary compatible. It does not publish a graph API or add
production Intake or OpenShell integration.

Material changes

• Adds private, non-serializable graph values and pure admission before invocation effects.
• Adds hierarchical task, datum, dependency, atomic-group, stage, and invocation accounting
  with explicit task predecessors, fixed-point withholding, and fail-closed release.
• Seals the target/context execution contract against a typed, retention-disabled backend
  capability and rechecks it immediately before execution.
• Lowers target and context into separate temporary workframes with opaque invocation-local
  identities and immutable original-text provenance.
• Reconciles every compiled context binding exactly once and rejects missing, duplicate,
  contradictory, or foreign evidence.
• Finalizes mentions only from current candidate lineage, exact Python character offsets,
  source-slice equality, supported provenance, and exactly one explicit validator decision.
• Resolves mentions with a closed same_subject | distinct_subject evidence grammar,
  target-only endpoint scopes, deterministic union-find clusters, and transitive
  contradiction rejection. Text and detector labels never act as identity.
• Freezes the structural phase6-role-result/v1 grammar with an intentionally empty,
  fail-closed Redact role mapping; Phase 7 role vocabulary is not invented here.
• Builds sealed mention-keyed Redact manifests, binds fresh invocation-private patch tokens,
  applies patches once to authoritative source intervals, and verifies returned output by
  exact reconstruction.
• Requires cleanup confirmation before release. Cleanup failure or unconfirmed evidence
  applies a global release embargo.
• Adds a standard-library-only Phase 6 reference model with 21 canonical symbolic cases, a
  published event alphabet and independence relation, a maximum event count of 45, and a
  frozen SHA-256 manifest digest.
• Retains the Phase 5 independent event oracle covering 2,198 traces and 35,138 events.

Scope and non-goals

This branch qualifies private admission, context framing, terminal accounting, anchored
mention finalization, explicit-evidence clustering, structural role results, local Redact,
cleanup, and release behavior. It does not:

• expose a public graph, session, streaming, or async API;
• add production support for Intake, OpenShell, ATIF, OTLP, OCSF, or Sandbox formats;
• qualify private Annotate, Hash, Substitute, grouped Rewrite, evaluation, or repair;
• begin Phase 7 stable substitution, replacement-slot planning, or coherence enforcement;
• move source codecs, persistence, retries, deduplication, retention, or delivery into
  Anonymizer; or
• claim exhaustive PII detection or provider-side deletion.

The checked-in Intake and OpenShell adapters remain test-only characterization and dated
adopter evidence.

Validation

• make test — 3,862 passed, 11 skipped, one dependency deprecation warning
• Execution-layer suite — 2,454 passed
• Focused Phase 6 mention, resolution, role, Redact, runtime, and reference suite — 58 passed
• make format-check — passed
• make typecheck — passed
• git diff --check — passed
• Post-implementation ownership and scope review — zero remaining Critical or Warning
  findings
• Phase 6 commit is DCO-signed and has a valid ED25519 Git signature

The 11 opt-in Intake dogfood tests remain skipped unless their external operator-owned
environment is enabled.

Reviewer guide

1. Start with docs/development/phase-6-anchored-mention-resolution-design.md and
   docs/development/graph-native-anonymizer-sdk-technical-proposal.md for scope and
   promotion gates.
2. Review mention_admission.py and mention_resolution.py for anchoring, lineage,
   endpoint scope, evidence validation, and deterministic clustering.
3. Review role_policy.py and phase6_redact_role_policy.json for the structural role
   contract and fail-closed Redact mapping.
4. Review redact_patches.py for manifest sealing, patch-token bijection, source-interval
   application, and exact verification.
5. Review phase6_plan.py, phase6_runtime.py, accounting_plan.py, and
   accounting_ledger.py for task readiness, component isolation, lifecycle handling,
   cleanup, and release propagation.
6. Review phase6_reference_model.py, its manifest, and the Phase 6 test modules for the
   independent oracle and adversarial boundary coverage.

The PR remains draft. Phase 7 and any public or production integration require separate
design and operator authorization.

[greptile-apps]

Greptile Summary

The PR introduces a private graph-native protection runtime while preserving the existing DataFrame-oriented public API.

• Adds immutable graph values, independent-datum compilation, pandas lowering, and Redact-only outcome qualification.
• Adds exhaustive terminal accounting, opaque invocation-local correlation, and private artifact and telemetry isolation.
• Maps verifier-boundary pipeline failures to a canonical cause-free public workflow error.
• Adds focused graph-runtime tests and test-only structured workload adapters and evidence.

Confidence Score: 5/5

The PR appears safe to merge because the previously reported Redact release failure is closed and no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/anonymizer/engine/execution/protection_service.py	Qualifies Redact outcomes using exhaustive application accounting, source-span validation, terminal status, and opaque datum correlation; the previously reported release gap is fixed.
src/anonymizer/engine/execution/graph.py	Defines immutable private graph values and rejects unsupported relationships, context, coherence, and atomicity rather than flattening them.
src/anonymizer/engine/execution/graph_runtime.py	Compiles and lowers the supported independent-datum graph profile through the private pandas execution seam.
src/anonymizer/engine/execution/pandas_runtime.py	Coordinates existing pandas workflows and returns verified invocation-local execution results for graph hydration.
src/anonymizer/interface/_protection.py	Integrates private graph execution with the compatibility facade and reconciles outcomes through opaque datum identities.
src/anonymizer/engine/ndd/adapter.py	Adds invocation-scoped artifact and telemetry isolation while retaining run_workflow as the DataDesigner execution boundary.
src/anonymizer/interface/anonymizer.py	Routes public run and preview calls through the extracted execution flow and applies canonical cause-free workflow-error mapping.
src/anonymizer/measurement/session.py	Supports context-local measurement suppression for private execution without changing ordinary measurement behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Public DataFrame API] --> B[Compile invocation]
  B --> C[Private ProtectionGraph]
  C --> D[Lower to temporary DataFrame]
  D --> E[Existing pandas workflows]
  E --> F[NddAdapter.run_workflow]
  F --> G[Verify terminal accounting]
  G --> H{Redact release qualified?}
  H -->|Yes| I[Hydrate graph outcomes]
  H -->|No| J[Withhold output]
  I --> K[Public DataFrame result]

Loading

_{Reviews (2): Last reviewed commit: "fix: fail closed on incomplete graph red..." | Re-trigger Greptile}

[greptile-apps]

Release checks the wrong value

When augmentation returns different casing for a matched entity, Redact skips the span because the stored value no longer exactly matches the source slice, while this case-sensitive release check still approves the unchanged output, causing a successful graph outcome to expose detected sensitive text.

How this was verified: Augmentation stores case-insensitively matched values verbatim, replacement skips exact-value mismatches, and this release predicate checks only the mismatched value.

Knowledge Base Used: Engine: shared plumbing for the anonymization pipeline

[binaryaaron]

Fixed in 702f43a. The release gate now validates accepted spans against the authoritative input, rejects malformed or overlapping spans, requires complete all-applied/zero-skipped replacement accounting, and verifies that authoritative source slices are absent from released output.

The Alice / alice regression returned _GraphProtectionSucceeded before the fix and now returns a datum-scoped release failure. Added challenge coverage includes forged success accounting, malformed spans and accounting, exact-case Redact success, and unchanged no-detection success.

Validation: 76 focused tests passed; the full suite passed with 1,433 passed and 11 skipped.