audit(privacy): define perception, retention and disclosure boundaries

[adrianwedd]

Parent: #169

Inventory what SPARK can perceive through Frigate, Home Assistant, microphone, camera, sonar, calendar and location-related state; what derived records are written; how long they persist; and which surfaces can expose them.

Produce a versioned data-flow/retention contract and tests for the important boundaries. Prefer derived observations over retaining raw media where the feature does not require raw media.

Acceptance: each perception source has documented collection purpose, derived fields, persistence/retention, consumers, and disclosure surface.

[adrianwedd]

Grooming 2026-08-26 — still valid, un-started, and the surface has grown since filing

No docs/ retention contract exists. Meanwhile three new perception/derived-data
sources landed that this contract will have to cover, and they arrived after
the issue enumerated its scope:

• state/people-{persona}.jsonl (feat(memory): person-memory writer — deterministic, evidence-minimal, firewalled #297–feat(memory): person-fact retrieval into exactly two prompts #299) — structured, durable facts
  about named humans including a child, with expiry semantics. This is the single
  most privacy-sensitive store SPARK has ever had, and it is new since filing.
  It has provenance and expiry, which is most of the work — what it lacks is a
  documented disclosure answer: which surfaces can read it, and whether
  anything reaches /api/v1/public/*.
• state/memories-spark.jsonl — nightly consolidation distilling 24h of
  thoughts into durable records.
• state/thought-images/ — retained 30 days, cleaned hourly. Currently the
  only source with an explicit retention period, and it is in code rather than
  in a contract.

Two boundaries are already enforced and should be documented here rather than
re-derived: the reflection-prompt allowlist (mind._REFLECTION_AWARENESS_KEYS,
which excludes findmyhub, ha_presence and health after a denylist leaked
raw GPS twice), and the message_obi redaction that keeps private DMs out of
thoughts-spark.jsonl and therefore out of the public endpoint and Bluesky.
Those are the two best worked examples of what this contract is for.

Also newly relevant: #191 shows a perception source can vanish for four days
with nothing recording that it did. A retention contract that documents
collection purpose and consumers should also say what "unavailable" looks like
for each source — otherwise the contract describes a system that is only
sometimes running.

Nothing here changes the ask. The acceptance criterion — per source: collection
purpose, derived fields, persistence/retention, consumers, disclosure surface —
is unchanged and is the right shape. It just has more rows now.