Failure corpus and privacy
What gate and event records store, redaction order, tenant isolation, clustering, and current pooling status.
Corpus is tenant-scoped set of gate records, failure events, semantic clusters, clarification outcomes, and generated eval exports.
#What is stored
Gate records include tenant, session ID, redacted request/context, ambiguity and dimension scores, questions, intent-spec, experiment arm, policy values, and timestamp. Events include redacted detail, original request, actual meaning, signal/source/confidence, failure flag, cluster fields, experiment arm, and timestamp.
#Redaction order
Backend redacts request, nested context strings, clarification response, and event detail before scoring or storage.
| Mode | Replacements |
|---|---|
standard | Email, phone, card-like number, IBAN, street address. |
strict | Standard set plus IPv4 address. |
off | No server redaction. |
Replacements use <EMAIL>, <PHONE>, <CARD>, <IBAN>, <ADDRESS>, and <IP_ADDRESS>. Importer --redact adds local email/phone masking before network.
before SDK, send minimum context, and use opaque session IDs.
#Isolation and clustering
API key maps to tenant. Persisted gates/events carry tenant ID and queries filter it. Semantic clustering uses latest 30 days, requires minimum three events, and groups redacted failure text. Small groups remain uncategorized.
#Pooling status
No cross-customer or opt-in pooled corpus path exists in current backend, SDK, or importer. There is no pooling consent control. Current corpus, reports, clusters, and eval exports remain tenant-scoped.
backend/app/main.pybackend/app/redaction.pybackend/app/models.pybackend/app/reporting.py