public-private-routing

name	public-private-routing
description	Enforces the firewall between a public knowledge store and per-client private stores by checking declared visibility, abstracting client/project identifiers by default, and running an independent publish-time grep against a maintained identifier list. Use before committing or publishing any page, and as a pre-commit/CI gate.
license	CC-BY-4.0
compatibility	Requires a maintained identifier deny-list and pages declaring visibility/client frontmatter; wires into pre-commit + CI
metadata	{"version":"1.0","enforcement_level":"L3","status":"template","incident_refs":"B-screening,subagent-overclaim","params":"target:str"}

public-private-routing

Template skill (doc 08, doc 07 §1/§4). The leak vector is not file copying — it is agents writing about private material. This skill is the machine-checked contract that catches it.

Trigger

/route-visibility <path-or-diff>

Preconditions

• A maintained identifier list exists: client names, project codes, internal path/host patterns, API-key shapes, personal-data patterns.
• Every page declares visibility: public|private (+ optional client:).

Steps

1. Declare-and-check visibility. Read visibility: from frontmatter. Derived data from vendor-licensed/confidential sources MUST route private; only genuinely public-domain material routes public. Mismatch → block.
2. Abstraction by default. In any public-routed (or shared) page, client and project names are abstracted unless the fact is publicly verifiable. A concrete name in a public page without public corroboration → block.
3. Publish-time grep. Before content crosses the boundary, grep the actual content against the identifier list. Do NOT delegate this to the agent that produced the content — run it independently (a subagent once declared its own output clean while it contained client folder names).
4. Raw-source firewall. Assert no raw licensed/confidential source file is being committed — only derived parts plus opaque public source tokens or public-safe provenance bundle references.
5. ACE wave-1 JSON/config/code-derived output. Before any text, config, or code-doc candidate routes public_llm_wiki, require affirmative public clearance and the #63 public-output canary over the exact surface. Without clearance, demote to private_sidecar, metadata_only, or excluded_no_ingest.

Verification

• Pre-commit hook + CI deny-list scan must pass (L3); a hit blocks the commit/merge.
• The grep is run by the gate, not self-reported by the producing agent.
• For ACE-derived public outputs, run uv run python scripts/validate_ace_public_artifacts.py --scan-public-path <surface> --issue-comment-body-file <planned-comment.md> over the exact docs, skill, workflow, review artifact, mkdocs.yml, llm-wiki, GitHub-public summary, issue closeout summary, or external publication surfaces before they cross the boundary.
• For this repo, run bash scripts/legal/legal-sanity-scan.sh --all-tracked-public-surfaces before publishing or closing public-surface work; use --diff-only for local staged/unstaged closeout checks.

Cleanup

• n/a (gate).

Incident appendix

Rule	Why
Independent publish-time grep	Producing agent overclaimed "no confidential identifiers"
Abstraction by default	Names leak via generated prose, not file copies
Machine-checked visibility	Routing is a contract, not a convention