# Private Memory And PII Policy

This repository must not contain personal memory, private user projects, local
workspace data, real contact information, or provider/account-specific
credentials. Wall-E memory and CTM session context are runtime data, not source
artifacts.

## Keep Out Of Git

- Private journals, including `builder-journal.md`.
- CTM and Wall-E databases, WAL/SHM files, logs, screenshots, and JSONL
  transcripts.
- Personal project artifacts generated for one user, including A/B screenshots,
  review outputs, and generated site drafts.
- Real names, email addresses, phone numbers, home/work addresses, company names,
  private gateway hostnames, and local machine paths in source, tests, and docs.
- OAuth tokens, API keys, Portkey/custom gateway headers, and `.env` files.

## Use Safe Fixtures

Use generic fixture names such as `Test Owner`, `Student Example`, `Jordan
Example`, `ExampleCorp`, `example.com`, `gateway.example.internal`, and
`/Users/example/...`.

Do not use a real user's current personal project as a regression fixture. If a
regression needs that shape, reduce it to a generic minimal fixture and remove
the original names, paths, generated assets, and project-specific copy.

## Builder Journal

The builder journal is private memory. The canonical local copy lives outside
this repository:

```text
~/.codex/memories/builder-journal.md
```

If a copy appears in the repo, move or merge it into the private location, then
delete it from the Git worktree before committing.

## Pre-Commit Guard

Run:

```bash
node scripts/check-private-data.js
```

The scanner checks tracked files only. It also reads optional local denylist
files that are intentionally ignored by Git:

```text
.private-data-denylist
.private-data-denylist.local
~/.codex/private-data-denylist
~/.codex/memories/private-data-denylist
```

Put user-specific terms in one of those local files, one term per line. Do not
commit the denylist itself. The built-in scanner is intentionally
high-confidence to avoid blocking generic fixtures; user-specific names,
projects, domains, and private organizations belong in the local denylist.

## Git History

A forward cleanup removes the data from the current tree. Purging old commits is
a separate destructive operation because it rewrites history and changes commit
IDs. Use a dedicated history-rewrite plan, coordinate with all clones/remotes,
and validate that no needed private-only material is lost.
