ruvnet--RuView/docs/adr/ADR-299-csi-data-incident-repo-controls.md

ADR-299: Repository CSI data-incident controls — ignore rules and a pre-commit/CI policy check

• Status: Accepted — controls implemented; tree remediation gated on owner sign-off
• Date: 2026-08-11
• Deciders: ruv
• Tags: privacy, data-governance, ci, security, incident

Context

The external review found ~64.6 MB of tracked raw CSI recordings under data/recordings/ and v2/data/recordings/ (largest an ~61.8 MB overnight capture). CLAUDE.md explicitly prohibits committing CSI or person data. The .gitignore rule pointed only at a pre-rename path (rust-port/wifi-densepose-rs/data/recordings/) and did not cover the active directories, which is how the captures were committed. Raw CSI is person data (it encodes breathing, movement, presence), so this is a data incident, not a formatting nit.

Decision

Implemented now (mechanical, no data-ownership judgment):

• Fix .gitignore to cover data/recordings/, v2/data/recordings/, the legacy path, and *.csi.jsonl / *.csi.meta.json globs (done in this PR).
• Add a policy check (pre-commit hook + CI job) that fails when CSI-format files (*.csi.jsonl, *.csi.meta.json) or large JSONL captures are staged or present as tracked files, with a message pointing here. Tests may use only synthetic or expressly-consented minimal fixtures.

Explicitly gated on data-owner sign-off (NOT done autonomously):

• Removing the existing recordings from the tree, and any history rewrite, are outward-facing/destructive and require the data owner to first establish provenance, consent, purpose, retention authority, and redistribution rights. The review is correct that rewriting origin does not erase forks and clones; coordination is required. This ADR records the controls and the required follow-up; it does not delete the data.

Consequences

• No new CSI captures can be committed (ignore + policy check).
• The existing tracked recordings remain until the owner decides; the incident is documented and the guard prevents worsening it.
• CI gains one fast policy job; contributors get a local pre-commit check.

Validation

• Policy-check unit tests: a staged *.csi.jsonl fails; a synthetic fixture under an allowed test path passes; the check is deterministic and offline.
• Manual confirmation that the new ignore globs cover both active directories.