Semantic Airgap Spec

Version: v0.2 Status: Review Owners: Foundation / FMIE Last Updated: 2026-03-25 Change Type: additive Migration Required: yes Depends On: Media Passport, External Cognition Gateway Supersedes: none Superseded By: none

Purpose

Prevent raw or over-disclosing internal data from leaving Foundation when calling frontier models.

Problem Statement

Foundation-V2 already has governed publishing, but its outbound frontier-model path can still send raw prompts and rich internal evidence directly to Anthropic. The Semantic Airgap is the mandatory boundary that converts private internal state into policy-compliant external task packets.

Ownership

• FMIE: emits transform-ready derived views and passport metadata
• Foundation: owns disclosure policy, transform compilation, task-packet assembly, outbound validation, and receipt handling
• Cortex: observes aggregate policy outcomes and disclosure-risk metrics only
• Frontend: renders disclosure mode, receipts, trust state, and approval workflows

Core Objects

DisclosurePolicy

Fields: - policy_id - tenant_id - classification - allowed_modalities - allowed_providers - allowed_tasks - default_mode - retention_policy - approval_profile - effective_from - effective_to

DisclosureTransform

Fields: - transform_id - source_passport_id - source_asset_ids - modality - transform_kind - redaction_rules - surrogate_mode - derived_fields - quality_floor - content_commitment

SurrogateRegistry

Maps protected entities to stable session-scoped or task-scoped surrogate IDs.

TaskPacket

Fields: - task_packet_id - policy_id - transform_id - provider - model - task_type - payload_class - payload_commitment - requested_output_schema - expiration_at

ExternalInferenceReceipt

Fields: - receipt_id - task_packet_id - provider - model - status - request_commitment - response_commitment - started_at - completed_at - retention_class - disclosure_mode

ReasoningImport

Fields: - reasoning_import_id - receipt_id - trust_status - trust_score - contradiction_flags - local_crosscheck_status - surrogate_outputs

DisclosureException

Fields: - exception_id - policy_id - approver_id - reason - scope - expires_at - audit_ref

Policy Modes

• deny
• public_research_only
• abstract_reasoning_only
• approved_raw_exception

Required Flow

1. classify source sensitivity
2. resolve DisclosurePolicy
3. compile DisclosureTransform
4. replace protected entities with surrogates where required
5. validate outbound packet against policy
6. anchor commitments through Media Passport / Midnight
7. call provider through External Cognition Gateway
8. store ExternalInferenceReceipt
9. import result as ReasoningImport
10. locally resolve real entities and perform final confidential synthesis

Transform Rules By Modality

Text

• redact names, IDs, contact details, deal terms, and policy-restricted spans
• replace protected entities with surrogates under abstract_reasoning_only
• preserve semantic roles and argument structure where possible

Audio

• transcript-first by default
• raw waveform disallowed unless approved_raw_exception
• speaker labels become surrogates when needed

Documents

• export OCR, tables, charts, headings, anchors, and extracted figures first
• raw PDF / PPTX / DOCX export only under exception

Images

• export crops, OCR spans, scene graph, and masked regions first
• blur or remove protected faces, IDs, and logos when policy requires

Video

• export keyframes, storyboard, transcript windows, event spans, and tracks first
• raw video export only under exception

Enforcement

• outbound prompt firewall must reject packets with disallowed fields
• transforms must be reproducible and versioned
• all packets and receipts require commitments
• imported reasoning must carry a trust label before downstream use

Telemetry

Required counters and rates: - packet count by disclosure mode - denied export count - raw exception count - provider/model distribution - average trust score - contradiction rate on imported reasoning - transform failure count

Foundation-V2 Gap Closed

This spec closes the gap between existing publication governance and missing outbound disclosure governance.

Open Questions

• whether embeddings can ever leave Foundation under abstract_reasoning_only
• whether surrogate IDs are session-scoped, tenant-scoped, or task-scoped by default
• what quality floor blocks export of over-redacted unusable packets

Change Log

• v0.2: expanded to implementation-grade contract
• v0.1: initial seed