mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

docs: reconcile catalog run history and fleet state

Browse Source
This commit is contained in:
Codex
2026-08-31 15:59:26 +02:00
parent ded66fde9c
commit b4b97436e1
7 changed files with 106 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/adr/0011-gate-source-samples-with-a-sensitive-data-flag.md
+11 -3
View File
@@ -5,9 +5,10 @@ status: accepted
# Gate source samples with a Sensitive Data Flag
Each Catalog Column has one human-set `sensitive` boolean, defaulting to `false`. An AI may prefill
draft suggestions from structural metadata only, but the user decides and only the boolean is
persisted; there is no rationale, history, audit ledger, fingerprint, review state, or retroactive
regeneration of existing descriptions.
draft suggestions from structural metadata only, but the user decides and the Catalog Column
persists only the current boolean. It stores no rationale, prior flag values, proposal fingerprint,
review state, or audit ledger, and changing the flag does not retroactively regenerate existing
descriptions.
The user starts a suggestion from an explicit selection at database, table, or column level. A
database request accepts exactly one selected database; a table or column request contains only the
@@ -16,6 +17,13 @@ metadata into deterministic model requests of at most ten columns, also bounded
size, and returns one combined draft for human review. No flag changes until the user saves the
reviewed draft.
Each started suggestion attempt persists a separate Sensitive Data Suggestion Run containing its
database, scope, selected model, lifecycle status, aggregate suggestion counts, timestamps,
sanitized error summary, and ordered sanitized events. It does not persist selected target IDs,
per-column proposals, prompts, raw provider output, or provider diagnostics. This is operational
history of the AI attempt, not an audit trail of human flag decisions; reloading discards an unsaved
proposal.
Description generation extends ADR-0010 by sending bounded real values when `sensitive` is false
and deterministic plausible synthetic values when it is true, without identifying the synthetic
values to the model. The false default deliberately favors the expected stable schemas and the