Phased implementation plan

Each phase has an explicit exit condition. Later phases do not force infrastructure into the initial data plane. Indigenous governance is a prerequisite for relevant data use, not a final engineering phase.

Phase 0 — Design approval (this repository baseline)Copy Anchor Link

Deliver architecture and ADRs; OpenAPI and canonical schemas; policy, detector, and manifest contracts; Australian taxonomy/evidence; persistence; conformance and benchmarking; Indigenous governance requirements; threat model; research index; and this plan.

Exit when architecture owners review proposed ADR 0004, product/risk owners triage OD-001–OD-013 and OD-016–OD-022, and governance sponsors initiate OD-014/OD-015. Draft API contracts remain changeable until a separate freeze decision.

Phase 1 — Foundation and end-to-end vertical sliceCopy Anchor Link

Implement:

• Go module and guardrailsd composition root;
• Gin router behind configured net/http.Server with limits, timeouts, health, capabilities, graceful shutdown, and safe structured telemetry;
• canonical /v1/evaluate and authenticated trusted-context binding;
• domain event/result/finding/coverage/span types;
• canonical and Portkey adapters with golden fixtures and full replacements;
• detector/protocol/adapter/policy/audit registries;
• built-in detector interface and one harmless deterministic example check;
• PostgreSQL migration baseline for correlation definitions, context terms, field aliases, calibration/provenance, approvals, and snapshot lineage;
• deterministic compilation of approved correlation rows into the immutable snapshot, with no synchronous database lookup in /v1/evaluate;
• filesystem-loaded, schema-validated immutable policy snapshot;
• constrained CEL match predicates;
• bounded concurrent orchestration, cancellation, deny-wins composition, and explicit required/optional/on-error behavior;
• deterministic code-point span transformation;
• contract, unit, race, fuzz, property, and conformance tests.

No database dependency on the evaluation hot path, streaming, external plugin runtime, or raw-content telemetry.

Exit when the vertical slice passes schemas and conformance, Portkey input/output goldens, race/fuzz suites, safe-log canaries, and agreed non-production latency characterization.

Phase 2 — Australian primitives and measured observe modeCopy Anchor Link

Implement separate validated-structured and context-bound-structured detector classes. Begin with published ABN, Medicare, IHI, HPI-I, and HPI-O structural validators and the approved sourced inventory; retain required context gates for CRN, USI, ImmiCard, VIN, and collision-prone formats. Context-bound TFN, director ID, passport, driver licence, DVA, professional, jurisdictional screening, and other inventory checks require exact label/field and jurisdiction evidence. Add phone, BSB/account, address candidates and secrets checks using prefixes/shape/entropy/context/allowlists, with candidate/probable/validated states.

Build synthetic Australian and hard-negative corpora, calibrate by category, and deploy in observe mode. Do not claim controlled validity (for example DVS or ATO) without an approved source/contract. Do not add community-derived First Nations material without the governance prerequisite.

Exit when OD-004/OD-006/OD-019 define release criteria, privacy review approves telemetry, and observed results meet agreed slice-level gates. Enforcement is a separate owner-approved rollout.

Phase 3 — Policy supply chain and control planeCopy Anchor Link

Implement full import-DAG compilation, typed overrides, lockfiles, canonical JSON, OCI publication, digest/signature/provenance verification, shadow evaluation, deterministic sticky canary, atomic promote/rollback, and authenticated deployment bindings. Expand the foundational PostgreSQL schema for dynamic multi-tenant bindings, approvals, activation history, detector registry, and searchable safe audit metadata.

Exit when OD-011–OD-013 are decided, authorization and threat models pass review, tamper/partial-activation/rollback drills pass, and evaluators remain correct during control-plane/database outages.

Phase 4 — Address reference and richer correlationCopy Anchor Link

After OD-016/OD-017, build a separately versioned G-NAF PostgreSQL/PostGIS store, licence/attribution controls, atomic dataset promotion, structured address matching, and pg_trgm candidate retrieval. Compile/cache hot correlation data where practical. Benchmark lexical/structured quality before considering pgvector.

Exit when legal/data owners approve the dataset lifecycle, version rollback works, and address quality/latency gates pass without postcode-only classification.

Phase 5 — External detector executionCopy Anchor Link

Freeze the protobuf v1 and manifest after built-in contract experience. Add a first-party supervised local gRPC process adapter, then remote gRPC with mTLS, tenant destination controls and circuit breaking, then a minimal wazero ABI with capabilities denied by default. Add signed OCI distribution, SBOM/provenance, trust tiers, conformance, canary, drain, rollback, and revocation.

Exit each tier separately after its phase-specific threat model, fault isolation, resource limits, sensitive-data controls, and common conformance suite pass. Do not ship an execution tier merely because the semantic interface exists.

Phase 6 — Advanced enforcementCopy Anchor Link

Only after buffered correctness, design and implement SSE reconstruction, bounded streaming buffers, incremental Unicode handling, cross-chunk matching/redaction, partial-disclosure controls, tool-call withholding, session-aware detectors, and possibly richer obligations if product need is demonstrated. Add adaptive adversarial testing and governed incident-derived corpus rotation.

Exit when streaming-specific threat and conformance work proves that protected bytes/tool calls are not released before a policy decision and cancellation/failure postures match owner-approved risk requirements.

Work that spans every phaseCopy Anchor Link

• Keep contracts versioned and backward-compatibility changes explicit.
• Update the threat model and research/licence register when boundaries change.
• Measure benign pass rate alongside security detection.
• Preserve unjudged coverage and reproducibility metadata.
• Use observe → tune → limited canary → enforce, with rollback.
• Keep raw sensitive values out of ordinary telemetry and fixtures.
• Apply Indigenous governance approval, veto, and stop-use wherever relevant; do not defer it to Phase 6.