[REVIEW] ai-data-privacy: add erasure propagation evidence gates

[shensz2017]

Skill Review ($25 potential bounty)

ai-data-privacy currently reviews AI privacy controls, but it does not explicitly require proof that erasure requests or consent withdrawals propagate beyond the source database into AI-derived stores.

Gap: source records can be deleted while embeddings, vector chunks, RAG metadata, prompt logs, analytics events, training snapshots, evaluation datasets, provider-retained objects, backups, or model artifacts remain retrievable or usable.

Suggested improvement: add an erasure propagation step requiring subject-to-artifact lineage, deletion receipts/tombstones, vector/log/dataset/provider reconciliation, training exclusion manifests, backup restore replay, and a documented retraining/unlearning/suppression/risk-acceptance decision for affected model lineage.

Preferred payment: GitHub Sponsors, if accepted.

[JamesJi79]

/attempt #2069

JamesJi79 will submit VALID GAP analysis for this [REVIEW] issue.

[JamesJi79]

/attempt #2069

VALID GAP — AI Data Privacy Erasure Propagation Gates

Why Valid (FP confirmed)

The ai-data-privacy skill reviews AI privacy controls appropriately for primary data stores. However, AI systems propagate data into derived stores (embeddings, vector chunks, RAG metadata, prompt logs, analytics events, training snapshots, evaluation datasets, provider-retained objects, backups, model artifacts) that are not covered by source-record deletion. A source record deleted from the primary database may remain retrievable or usable in AI-derived stores indefinitely. The gap between source deletion and AI-store deletion is operationally significant and currently uncovered.

Coverage Gaps

Gap 1 — Subject-to-artifact lineage for AI-derived stores — Without explicit mapping from a data subject to all AI artifacts derived from their data (embedding vectors, RAG chunks, prompt history, model-training slices), erasure requests cannot be scoped. The skill needs a subject-to-artifact lineage step that enumerates all derived AI stores for a given deletion target. Need gate: Subject-to-artifact lineage mapping across AI-derived stores.

Gap 2 — Vector, log, dataset, and provider reconciliation — After source deletion, embeddings in Pinecone/Weaviate/Qdrant, cached prompts, analytics events, training dataset slices, and provider-retained copies (OpenAI, Anthropic data retention) must be reconciled. Without deletion receipts or tombstones per derived store, erasure completeness is unverifiable. Need gate: Per-store deletion receipt/tombstone reconciliation with vector, log, dataset, and provider stores.

Gap 3 — Training exclusion and model artifact handling — If the data subject's data was included in a training run, removing it requires retraining, unlearning (where technically feasible), or a documented suppression/risk-acceptance decision for affected model artifacts. Backups that may contain the data must also be replayed and purged. Need gate: Training exclusion manifest, retraining/unlearning verification, and backup restore replay evidence.

Suggested Gates

1. AI-ERASE-01: Subject-to-artifact lineage mapping that enumerates all AI-derived stores (embeddings, RAG, prompts, training, backups).
2. AI-ERASE-02: Per-store deletion receipt/tombstone reconciliation across vector, log, dataset, and provider-retained stores.
3. AI-ERASE-03: Training exclusion manifest, retraining/unlearning verification, and backup restore replay evidence for model artifacts.

[Dolpme]

Submitted implementation PR: #2208

Scope: adds erasure propagation evidence gates to ai-data-privacy for subject-to-artifact lineage, deletion receipts/tombstones, vector/log/dataset/provider reconciliation, training exclusion manifests, backup restore replay, and model-lineage decisions.

Validation: git diff --check; frontmatter required-field check; index.yaml referenced-file existence check; markdown fence-balance check; target marker check; changed-file prompt-injection pattern check.

Payment details can be provided privately after maintainer acceptance.