Files Changed: enforce provenance privacy and serializer policy

Acceptance Criteria

• Every receipt and evidence field is classified as allow, redact, or deny for the UI, sharing, export, telemetry, logs, and error responses.
• Context capabilities, canonical paths, raw hashes, baselines, and redaction decisions are denied from every client and egress serializer.
• Display-safe projections expose only the evidence necessary for the authorized Files Changed view.
• External detail responses are authenticated, no-store, and omit evidence when policy or expiry denies it.
• Generated-artifact sentinels cannot reach transcripts, ordinary session metadata, shares, exports, telemetry, or logs.
• Serializer coverage fails when a new receipt or evidence field lacks an exposure classification.

Testing Decisions

• Extend sharing, export, telemetry, HTTP, browser-relay, and error-serialization tests with field and sentinel matrices.
• Add schema tests that require an explicit exposure decision for new fields.

Key Decisions

• Privacy is a schema contract, not a convention in individual callers.
• Host-only evidence and display-safe projections are distinct representations.

Constraints & Invariants

• No serializer can infer permission from a UI request alone.
• Legacy session sharing behavior remains unchanged until the capability-gated rollout.

Prior Art

• Parent Files Changed: full session-lineage mutation ledger #972
• Existing external-diff no-store and sharing safeguards

Deliberation Resolution

• The exposure matrix has explicit columns for Files Changed projection, browser relay, transcript, ordinary session metadata, export, share, telemetry, log, error, and external-detail response.
• allow permits the original typed value, redact replaces it with a stable policy-safe marker, and deny omits it entirely. The schema enumerates receipt, assessment, evidence, context, and derived-field inventories; nested and derived values inherit the strictest source classification.
• An external detail request requires an authenticated session viewer, an authorized display-safe receipt reference, and a current evidence policy decision. Success includes no-store headers; denial, expiry, and redirect responses include no evidence bytes or sensitive metadata.
• Legacy serialization is selected only when capability discovery returns legacy. Fixtures assert unchanged legacy payloads and separately assert full-mode projections.

Source

Part of #972. Blocked by #1076 and #1077.