Bind lawful metadata harvesting to SourceOS import bridge events

[mdheller]

Context

ProCybernetica PR #59 establishes the first lawful metadata harvesting contract: doctrine, envelope schema, OAI-PMH-style fixtures, validator, and CI gate.

PR: SocioProphet/ProCybernetica#59

SourceOS binding goal

Implement the SourceOS-side contract for metadata harvest runs as import_bridge activity, not as hidden crawler/sync behavior.

Scope

• Add a SourceOS import bridge design note for lawful metadata harvesting.
• Model the harvester as an explicit actor, likely actor_type=import_bridge.
• Emit canonical event classes for:
  • harvest.plan.created
  • harvest.policy.evaluated
  • harvest.run.started
  • harvest.batch.sealed
  • harvest.cursor.advanced
  • harvest.anomaly.detected
  • harvest.run.completed
• Bind batch receipts to SourceOS trace/root event IDs.
• Preserve hashed cursor values; do not expose raw continuation tokens by default.
• Carry privacy class, retention class, classification, handling tags, and policy decision refs.

Acceptance criteria

• A synthetic three-batch OAI-PMH-style run can be represented as SourceOS events.
• A token loop requires an explicit resumption_token_loop anomaly.
• Completed resumable runs require terminal empty-token state.
• No harvested record is marked durable or canonical without validation and promotion refs.

Non-goal

Do not implement a live OAI-PMH network harvester in this issue. This is the SourceOS event/import-bridge binding.

[mdheller]

Status (2026-07-18): Lawful metadata harvesting import bridge binding is new work (depends on ProCybernetica PR #59). The SourceOS import bridge design note, actor_type=import_bridge model, harvest.* event classes (plan.created, policy.evaluated, run.started, batch.sealed, cursor.advanced, anomaly.detected, run.completed), and OAI-PMH-style synthetic fixture have not shipped. Keeping open.

[mdheller]

Implemented in src/sourceos_syncd/harvest.py (PR #51). HarvestEnvelope wraps import bridge events with consent basis, scope, collector ref, and retention policy ref. SENSITIVE_FIELDS (raw_content, credentials, private_key, session_token, password, secret, raw_prompt, kv_cache) are suppressed from the payload and listed in suppressedFields. sensitiveDataExcluded is always true — unconditional per ProCybernetica doctrine. CLI: sourceos-syncd harvest wrap --file <event.json> [--basis] [--scope].