NODEDC_MISSION_CORE/docs/03_ARTIFACT_POLICY.md

Artifact and secret policy

The experiment should be reproducible from Git without placing household credentials, spatial maps or device secrets into normal Git history.

Sensitive by default

• Wi-Fi SSID and PSK;
• full K1 serial, BLE UUID, MAC/IP addresses and router client lists;
• provisioning payloads, tokens, nonces, certificates and session keys;
• PCAP/PCAPNG, Bluetooth logs and extracted flows;
• K1 logs, project.json, .xbin, LAS/point clouds and trajectories;
• camera frames, previews, panoramas and mapped interiors;
• command lines or shell history containing a credential.

Private Git is still durable replicated storage. Git LFS changes storage and size behavior; it does not provide confidentiality.

Commit to normal Git

• source, tests and lock-file;
• immutable reference documents and their hashes;
• schemas, runbooks, ADRs and redacted reports;
• synthetic or explicitly redacted fixtures;
• redacted manifests and SHA-256 inventories;
• commands needed to reproduce analysis from a locally supplied artifact.

Keep outside normal Git

• .venv, local config and Keychain references;
• actual credentials;
• real captures and decoded output;
• complete K1 project copies;
• unredacted device and router metadata.

Session integrity

Every real session should record:

• schema version and unique session ID;
• tool Git commit;
• UTC start/end and Mac monotonic start/end;
• masked device/host/network identities;
• physical state timeline;
• exact capture filter and interface;
• artifact path, size and SHA-256;
• redaction status and storage location classification;
• operator notes and final GO/PAUSE/BLOCKED decision.

Raw artifacts are never silently deleted by code. That does not imply infinite retention: capacity, encryption, backup and deliberate deletion policy are an operator decision outside the capture command.

Future provisioning secret input

The Wi-Fi password must not be accepted as a normal CLI argument. A reviewed provisioner should use a hidden prompt, stdin/file descriptor with strict permissions, or macOS Keychain. Logs and manifests record only that a credential was supplied, never its value or unredacted payload bytes.