I3432 — The UI and Cockpit snapshots pass both privacy gates after they are placed and before anything is published, on CI and from a terminal

✕BLOCKED wave 0 · p1 · implementation profile · parallel safe

Part of a-prompt-reaches-the-work-it-serves — A captured prompt is matched to its existing intent and recorded on the task that follows, joined to its outcome and evidence, shown on /ui and the Cockpit, read only on its own machine and never published.

Objective

In .github/workflows/pages.yml, after the steps that place every snapshot at its mount and before the publish step, run scripts/ci/local-never-published --no-probe and scripts/ci/prompt-privacy over the composed site/public tree. Run the same two gates in scripts/site-deploy before it pushes, including under --skip-build. Extend case 181 to assert the order.

Why

The owner's 2026-10-19 Cognitive Fabric pack (campaigns/prismatic-way-cognitive-fabric-prompt-pack/prompts/05_SURFACES.md, contracts/ARCHITECTURE.md) requires that no public Pages byte carries .ai/local, raw prompts or private runtime data. So does verification/ACCEPTANCE.md, in its row on private .ai/local data and the negative fixture of a public view that serialises .ai/local/prompts.

Current state

.github/workflows/pages.yml:479-481 runs scripts/pages check, whose cmd_check runs local-never-published (scripts/pages:264-276). The snapshots are placed afterwards (pages.yml:489-517) and published (pages.yml:520) with no further privacy check. scripts/site-deploy runs only scripts/site-check (scripts/site-deploy:182), and nothing under --skip-build. scripts/ci/prompt-privacy scans the docs and site trees in the structure job (scripts/ci/prompt-privacy:40-41), where no snapshot is placed.

Desired state

Every byte that reaches gh-pages, snapshots included, has passed both privacy gates in the run that publishes it.

Scope

• .github/workflows/pages.yml
• scripts/site-deploy
• test/cases/181_local_is_never_published.sh

Out of scope

• Changing what either gate looks for
• The declared reading lists (I3433, I3435)

Dependencies

None. This issue is a root of the graph.

What waits on this

• I3408✕BLOCKED A captured prompt is answered, on this machine only, with the existing intents and issues it matches or with no match, and the answer carries identities and never the prompt's text
• I3433✕BLOCKED A UI snapshot page renders only the readings its subject declares publishable, and a page that reads any other reading, or a capability that refuses remote callers, is withheld with a link to the live page

Acceptance criteria

• Case 181 fails when the privacy step is moved before the snapshot steps or removed
• scripts/site-deploy --skip-build refuses a fixture snapshot that holds a file byte-identical to a record under .ai/local

Validation

• MJ_TEST_JOBS=4 bash test/run.sh 181_local_is_never_published
• scripts/ci/local-never-published --no-probe
• scripts/ci/prompt-privacy
• majordomus shell check

Evidence required

• local_is_never_published_after_the_snapshots
• the added step's duration from the first Pages run after landing, reported and not asserted

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3432.yaml. Read it back with majordomus plan show I3432.