[nick-developer]

Requested by Cod3r · project thread

What and why

Roadmap T17: give customers' privacy, legal and audit teams the evidence they need to approve a relsynth release. New folder docs/assurance/:

• Claim register claims.yaml (60 claims) and checker tools/claims_check.py, run in the CI job lint. Every claim-like sentence of docs/privacy.md, docs/dp.md, docs/security.md and docs/governance/guide.md is bound to its quote and to propositions (by label, numbered as LaTeX prints them), checks, pytest nodes or measured reports. CI fails when a quote leaves its document, evidence disappears, a new claim is unregistered, a Prop. N anywhere in the docs names an undefined proposition, or a range runs backwards.
• Assurance case: top claim, sub-claims (structure, measured privacy, DP, governance, traceability), assumptions A1–A5 and defeaters, every leaf citing a register id or proposition (also checked).
• Regulation mapping against the primary texts: EDPB Guidelines 02/2026 v1.0 (paragraphs), CJEU C-413/23 P (paragraphs), AI Act Art. 10 as amended by Regulation (EU) 2026/1744 (Art. 10(5) moved to Art. 4a), 45 CFR 164.514 and the HHS 2012 guidance, NIST SP 800-226 and SP 800-188. ISO/IEC 27559 and 20889 are mapped by topic only (texts are sold by ISO). Rows a lawyer must decide are marked Lawyer.
• DPIA template (GDPR Art. 35(7)) and release guidance for internal, partner and public recipients (Five Safes, approval checklist).
• docs/assurance/evidence/: aggregate result files of T06 and T07 that claims cite (scores and intervals only, no rows or person labels; datasets all marked allowed).

Registering the claims found statements in docs/security.md that 2.0 made false (no formal DP, "privacy checks run by default", five core dependencies, one subprocess, no network access). The guide now says what the code does. A new test confines network access to the service modules that the guide names.

README: one row in the documentation map. The README claims join the register after the 2.0.0 release PR lands, because that PR rewrites the README.

How it was tested

• ruff check src tests tools bench: all checks passed; python tools/check_spdx.py: ok
• python tools/claims_check.py: ok: 60 claims traced, 4 documents in scope, 152 propositions
• pytest tests/unit/test_assurance.py tests/unit/test_security.py: 57 passed. test_assurance covers the register, LaTeX counter numbering (including save-and-restore sections), each kind of drift, citations in the assurance documents, and network confinement
• Trial merge with the 2.0.0 release branch: the checker reports one real problem there (Props. 951–902 in docs/testing.md), and the coordinator has been told
• Live servers, science suite and real-database regressions: not affected (no change under src/); CI runs them

Statistics and privacy

• No new statistical or privacy claim. The documents cite existing propositions and checks.
• Synthetic draws for the same seed are unchanged (no code change under src/)

Checklist

• Every commit follows Conventional Commits and is signed off (git commit -s)
• CHANGELOG.md has entries under Unreleased
• Documentation updated (docs/assurance/, docs/security.md, docs/privacy.md, README documentation map)
• No data, credentials or synthetic data fitted to restricted data is committed (evidence files are aggregates)
• No new dependencies

---

Generated by Claude Code

[nick-developer]

The unit jobs failed on every platform with one test: tests/unit/test_settings.py::test_settings_reference_is_up_to_date. The failure doesn't come from this PR. This PR doesn't touch settings, and the same test fails locally on main (a6c4357), because docs/settings-reference.md is missing the five runtime.* settings. Commit 49662bb regenerates the file with python -m relsynth.settings > docs/settings-reference.md, and tests/unit/test_settings.py now passes 34/34. The 2.0.0 release branch regenerates the same file, so whichever PR merges second may need the file regenerated again.

---

Generated by Claude Code

[nick-developer]

After the settings fix, unit (macos-latest, 3.12) failed in a different test, tests/unit/service/test_service_api.py::test_no_source_row_is_persisted. That test is not part of this PR's change, which touches no service code.

The cause is a false positive in the test. Line 120 scans every raw file under the data folder for the 3-byte marker b"Qzx", and that includes the encrypted artefacts (*.enc). Ciphertext is effectively random bytes, so a file of n bytes contains a given 3-byte string with probability of about n / 2²⁴. For artefacts of a few hundred kilobytes, that is a few percent per run. In this run the match was in art_….enc. The decrypted check on line 117 passed.

Proposed fix (not pushed here, because it belongs to the service tests). Line 117 already checks the decrypted content, so skip the ciphertext in the raw scan:

for f in Path(settings.data_dir).rglob("*"):
    if f.is_file() and f.suffix != ".enc":      # ciphertext is checked decrypted above
        assert SECRET_MARK.encode() not in f.read_bytes(), f

A second option is a marker of 16 or more bytes, which removes the chance collision. I can't re-run the job from here, so a maintainer re-run should go green. I'll keep watching this PR.

---

Generated by Claude Code