대시보드 폴드아웃/드릴다운 정리 + 페르소나 역린·misconduct 반응 + 게이트웨이 격리·RAG 비차단 수정
SSOT 대시보드:
- 한신대 기술분석 PDF(19쪽) 정합성 분석 + 이번 세션 발견 섹션 추가
- 섹션 폴드아웃(접기)·상단 목차(드릴다운)·모두 펼치기/접기 — 내용 보존, 레이아웃만 정리
페르소나 반응 강화('저항·반응 조절' 핵심 차별):
- PersonaCard.triggers(역린) 필드 + CCD 핵심상처 파생 역린 블록
- L0에 무례·모욕·조롱 시 현실적 동맹 균열 반응 지침
버그·성능 수정(라이브/E2E로 포착):
- 게이트웨이 페르소나 격리: --append-system-prompt를 --system-prompt(교체)로 + --exclude-dynamic-system-prompt-sections (내담자 캐릭터 붕괴·개발맥락 누출 차단)
- RAG: 임베더 동기 로드(약 7-13초)를 _warm_rag_caches 백그라운드 warm으로(세션 생성 블로킹 회귀 수정)
- voice TTS RMS 데드힌트 제거, init_state OpennessParams 파라미터객체화
- 한국어 PII(날짜·금액·주소) 마스킹 보강
- 레이아웃 시각 게이트: 폼 컨트롤 값 스크롤 오탐 제외(7/7)
검증: 백엔드 84/84, E2E 42(데스크톱 27·모바일 11·아바타 4), 시각 게이트 7/7
This commit is contained in:
Yun Chan
parent
cb2aebd76c
commit
085460b5e0
327 changed files with 31226 additions and 1829 deletions
152
docs/phase3/privacy-consent-audit.md
Normal file
152
docs/phase3/privacy-consent-audit.md
Normal file
|
|
@ -0,0 +1,152 @@
|
|||
# Phase 3 Privacy, Consent, and Withdrawal Audit
|
||||
|
||||
## Purpose
|
||||
|
||||
Provide an operator checklist for consent, withdrawal, privacy review, and evidence
|
||||
collection before and during the 20-person education pilot. This is an operational
|
||||
artifact, not legal advice.
|
||||
|
||||
Primary evidence files:
|
||||
|
||||
- `04-privacy/privacy_audit.md`
|
||||
- `04-privacy/withdrawal_log.csv`
|
||||
|
||||
## Pre-Pilot Privacy Gate
|
||||
|
||||
Copy this checklist into `04-privacy/privacy_audit.md` and complete it with reviewer
|
||||
names, dates, and evidence links.
|
||||
|
||||
```markdown
|
||||
# Phase 3 Privacy Audit
|
||||
|
||||
Pilot ID:
|
||||
Evidence root:
|
||||
Review date:
|
||||
Operator:
|
||||
Data steward:
|
||||
Legal/privacy reviewer:
|
||||
|
||||
## Scope
|
||||
- [ ] Intended use is education/training, not diagnosis, treatment, or emergency care.
|
||||
- [ ] Participant population and inclusion/exclusion criteria are approved.
|
||||
- [ ] Self-harm primary scenarios remain excluded unless separately approved.
|
||||
- [ ] Minor/source-case data use, if any, has documented lawful consent or approval.
|
||||
|
||||
## Consent
|
||||
- [ ] Consent form version is recorded.
|
||||
- [ ] Consent covers session storage, review, KPI reporting, and any dataset export use.
|
||||
- [ ] Consent explains third-party model or inference transfer, if applicable.
|
||||
- [ ] Consent explains withdrawal process and practical limits after anonymized export.
|
||||
- [ ] Consent receipt is captured before first session.
|
||||
|
||||
## Privacy Controls
|
||||
- [ ] Evidence files use pseudonymous participant IDs only.
|
||||
- [ ] Identity map location is restricted and not in the repository or export.
|
||||
- [ ] PII masking is active before external model calls.
|
||||
- [ ] Raw audio, raw source cases, and direct identifiers are excluded from Phase 3
|
||||
artifacts unless separately approved.
|
||||
- [ ] Retention and deletion schedule is documented.
|
||||
- [ ] RBAC and audit logging are enabled for instructor/admin views.
|
||||
- [ ] Export PII scan process is documented.
|
||||
|
||||
## Vendor and Transfer Review
|
||||
- [ ] Model providers and regions are listed.
|
||||
- [ ] Data sent to each provider is described at field level.
|
||||
- [ ] Secrets are not stored in evidence files.
|
||||
- [ ] Any overseas transfer, subprocessors, or institutional requirements have been
|
||||
reviewed by counsel or the designated privacy reviewer.
|
||||
|
||||
## Decision
|
||||
- [ ] Approved to start pilot.
|
||||
- [ ] Approved to generate KPI report.
|
||||
- [ ] Approved to generate anonymized export.
|
||||
- [ ] Blocked pending legal/privacy review.
|
||||
|
||||
Open issues:
|
||||
```
|
||||
|
||||
## Withdrawal Log
|
||||
|
||||
Evidence file: `04-privacy/withdrawal_log.csv`
|
||||
|
||||
Required header:
|
||||
|
||||
```csv
|
||||
participant_id,requested_at,effective_at,scope,status,attestation_path
|
||||
```
|
||||
|
||||
Allowed `scope` values:
|
||||
|
||||
- `future_sessions_only`
|
||||
- `exclude_from_analysis`
|
||||
- `exclude_from_export`
|
||||
- `delete_where_policy_allows`
|
||||
|
||||
Allowed `status` values:
|
||||
|
||||
- `received`
|
||||
- `in_progress`
|
||||
- `completed`
|
||||
- `rejected_by_policy`
|
||||
- `needs_legal_review`
|
||||
|
||||
## Withdrawal Runbook
|
||||
|
||||
1. Record the request in `withdrawal_log.csv` using only `participant_id`.
|
||||
2. Stop new sessions for that participant.
|
||||
3. Mark the roster `withdrawal_state`.
|
||||
4. Identify sessions, turns, measures, review records, and export rows in scope.
|
||||
5. Exclude the participant from future exports unless legal review states otherwise.
|
||||
6. Remove or anonymize records where the approved retention/deletion policy allows.
|
||||
7. Create an attestation note at the path listed in `attestation_path`.
|
||||
8. Re-run the artifact checker and KPI report.
|
||||
9. If an export was already produced, add a manifest limitation and create a replacement
|
||||
export if required by policy.
|
||||
|
||||
Attestation template:
|
||||
|
||||
```markdown
|
||||
# Withdrawal Attestation
|
||||
|
||||
Participant ID:
|
||||
Request received:
|
||||
Effective date:
|
||||
Scope:
|
||||
Operator:
|
||||
Reviewer:
|
||||
|
||||
Actions completed:
|
||||
- [ ] Account/session access stopped.
|
||||
- [ ] Roster updated.
|
||||
- [ ] KPI denominator/exclusion notes updated.
|
||||
- [ ] Export manifest updated or export blocked.
|
||||
- [ ] Deletion/anonymization completed where policy allows.
|
||||
|
||||
Records not changed and reason:
|
||||
|
||||
Reviewer decision:
|
||||
```
|
||||
|
||||
## Daily Operator Checklist During Pilot
|
||||
|
||||
- [ ] New sessions have consent receipts before start time.
|
||||
- [ ] No direct identifiers were added to evidence CSVs.
|
||||
- [ ] Instructor/admin access review entries are present for any manual review.
|
||||
- [ ] Withdrawal requests are processed before KPI/export generation.
|
||||
- [ ] Safety events are reviewed without copying sensitive free text into the roster.
|
||||
- [ ] Evidence root checker is run after each pilot day:
|
||||
|
||||
```powershell
|
||||
python scripts\check-phase3-artifacts.py --check --evidence-root $root
|
||||
```
|
||||
|
||||
## Exit Gate
|
||||
|
||||
The privacy gate is complete only when:
|
||||
|
||||
- `privacy_audit.md` is signed and has no unresolved high severity issue.
|
||||
- `withdrawal_log.csv` exists and all rows are terminal or explicitly marked
|
||||
`needs_legal_review`.
|
||||
- KPI and export artifacts use the same withdrawal/exclusion decisions.
|
||||
- Legal/privacy reviewer has approved real participant evidence handling.
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue