cloakapi 0.5.1__py3-none-any.whl

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024-2026 Klokk Nettablering
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

NOTICE

@@ -0,0 +1,18 @@
+CloakAPI SDK for Python
+Copyright 2024-2026 Klokk Nettablering (org. no. 821 466 962, Norway)
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+This package includes the CloakAPI rule set under the same license.
+Where a build also ships a compiled engine, that binary is under the
+same license. The engine's source code is not distributed with this package.
+
+"CloakAPI" and "Verified by CloakAPI" are trademarks of Klokk Nettablering.
+The Apache License does not grant permission to use them (section 6);
+see TRADEMARKS.md.
+
+This product includes third-party software and data. Their notices and
+license texts are in THIRD-PARTY-NOTICES.md and the licenses/ directory.
+Place names are derived from GeoNames (https://www.geonames.org/), licensed
+under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); modified by
+filtering and compaction.

THIRD-PARTY-NOTICES.md

@@ -0,0 +1,22 @@
+# Third-party notices
+
+notice-profile: sdk
+
+This file lists third-party software and data shipped with this package.
+It replaces the monorepo-wide pnpm table, which is not the contents of this tarball.
+
+## Data
+
+GeoNames (https://www.geonames.org/), CC BY 4.0
+(https://creativecommons.org/licenses/by/4.0/).
+Modified: filtered, endonym-gated and compacted.
+The license text is licenses/CC-BY-4.0.txt.
+
+Faker (@faker-js/faker locale datasets), MIT.
+The name gazetteer records that source. The MIT text is licenses/MIT-Faker.txt.
+
+Wikidata labels used as gazetteer input: CC0.
+
+US Census place names used as gazetteer input: public domain.
+
+Models loaded at runtime are not part of this package and have their own terms; the application that loads a model ships that model's notice.

TRADEMARKS.md

@@ -0,0 +1,19 @@
+# CloakAPI trademark policy
+
+"CloakAPI", the CloakAPI logo and "Verified by CloakAPI" are trademarks of
+Klokk Nettablering, Norway. The Apache License 2.0 does not license them
+(section 6).
+
+You may:
+- say truthfully that your software uses, or works with, the CloakAPI SDK;
+- keep and reproduce the NOTICE file, as the license requires.
+
+You may not:
+- call a modified version "CloakAPI" or "CloakAPI SDK", or publish it under
+  the @cloakapi scope or a name that suggests it comes from us;
+- show the "Verified by CloakAPI" badge except as described at
+  https://docs.cloakapi.io (Verified by CloakAPI);
+- suggest that we endorse, support or certify a modified version.
+
+If you change the SDK, give your version a different name and say that it
+is not an official CloakAPI release. Questions: trust@cloakapi.io

cloakapi/__init__.py

@@ -0,0 +1,271 @@
+"""
+CloakAPI Python SDK
+
+Client for the CloakAPI gateway. Personal data its rules detect is replaced with
+stand-ins on your machine before a request is sent, and restored in the reply.
+The calls are shaped like the Anthropic and OpenAI SDKs, but this is not a
+drop-in replacement: the client class and its options are CloakAPI's own.
+
+Quick start (sync)::
+
+    from cloakapi import CloakAPI
+
+    client = CloakAPI(api_key="cloak_abc123")
+    msg = client.messages.create(
+        model="claude-sonnet-4-6",
+        messages=[{"role": "user", "content": "Hello!"}],
+    )
+    print(msg.text())
+
+Quick start (async)::
+
+    import asyncio
+    from cloakapi import AsyncCloakAPI
+
+    async def main():
+        async with AsyncCloakAPI(api_key="cloak_abc123") as client:
+            msg = await client.messages.create(
+                model="claude-sonnet-4-6",
+                messages=[{"role": "user", "content": "Hello!"}],
+            )
+            print(msg.text())
+
+    asyncio.run(main())
+"""
+
+from ._version import SDK_VERSION as __version__
+from .async_client import AsyncCloakAPI
+from .attachments import (
+    Attachment,
+    AttachmentReviewRequiredError,
+    attachment_from_bytes,
+    attachment_from_file,
+    prepare_attachments,
+)
+from .client import CloakAPI
+from .config import DEFAULT_TIER, VALID_TIERS, Tier
+from .degraded import (
+    ENV_ALLOW_REDUCED,
+    ReducedCoverageError,
+    ReducedCoverageWarning,
+    coverage_counts,
+    guard_reduced_coverage,
+    reduced_coverage_allowed,
+)
+from .disclosure import (
+    CLK_DISCLOSURE_TEXT,
+    CLK_DISCLOSURE_TEXT_MESSAGE_SCOPED,
+    CLOAK_ANGLE_DISCLOSURE_TEXT,
+    CLOAK_ANGLE_DISCLOSURE_TEXT_MESSAGE_SCOPED,
+    CONTINUITY_SENTENCE,
+    detect_marker_format,
+    disclosure_text,
+    with_disclosure,
+)
+from .engine import (
+    RULESET_VERSION,
+    EngineError,
+    LocalEngine,
+    engine_available,
+    engine_identity,
+    engine_issue,
+    get_engine,
+)
+from .errors import (
+    APIError,
+    AuthenticationError,
+    BadRequestError,
+    CloakAPIError,
+    ConcurrencyLimitError,
+    ConflictError,
+    EngineIdentityError,
+    NetworkError,
+    NotFoundError,
+    PermissionDeniedError,
+    PlaintextRelayNotSupportedError,
+    PretokenisedMacError,
+    RateLimitError,
+    ReceiptVerificationError,
+    ReviewRequiredError,
+    ServerError,
+    UnprocessableEntityError,
+)
+from .notices import ReviewInfo, SendWarning
+from .pii.patterns import PiiMatch, PiiType, detect_pii
+from .pii.tokenizer import CONTEXT_PREAMBLE, detokenize, tokenize
+from .posture import PRIVACY_TIERS, PrivacyPosture, privacy_posture
+from .receipts import (
+    DeviceReceiptError,
+    Receipt,
+    VerifyResult,
+    generate_device_key_pair,
+    sign_device_receipt,
+    verify_chain_links,
+    verify_device_receipt,
+    verify_receipt,
+    verify_receipt_offline,
+)
+from .resources.detect import DetectedEntity, DetectResult
+from .resources.reconstruct import ReconstructResult
+from .review import Approved, Prepared, RelayReview
+from .surrogate_mode import (
+    DEFAULT_SURROGATE_MODE,
+    MODE_COPY,
+    MODE_SHARED_NOTE,
+    SURROGATE_MODES,
+    SurrogateContinuity,
+    SurrogateMode,
+    SurrogateModeError,
+    SurrogateModeReport,
+    coerce_surrogate_mode,
+    mode_copy,
+    resolve_surrogate_mode,
+)
+from .types import (
+    AdminOverview,
+    AdminUsagePeriod,
+    AdminUsers,
+    BufferedResponse,
+    ChatCompletion,
+    ChatCompletionChunk,
+    ChunkDelta,
+    ContentBlock,
+    ContentBlockDelta,
+    ContentBlockStart,
+    ContentBlockStop,
+    ContentBlockText,
+    ContentBlockToolUse,
+    ErrorEvent,
+    Message,
+    MessageDelta,
+    MessageStart,
+    MessageStop,
+    StreamChoice,
+    StreamEvent,
+    Usage,
+)
+
+__all__ = [
+    # Clients
+    "CloakAPI",
+    "AsyncCloakAPI",
+    # Errors
+    "CloakAPIError",
+    "APIError",
+    "AuthenticationError",
+    "PermissionDeniedError",
+    "BadRequestError",
+    "NotFoundError",
+    "ConflictError",
+    "UnprocessableEntityError",
+    "ServerError",
+    "RateLimitError",
+    "ConcurrencyLimitError",
+    "NetworkError",
+    "PretokenisedMacError",
+    "EngineIdentityError",
+    "ReviewRequiredError",
+    "RelayReview",
+    "ReviewInfo",
+    "SendWarning",
+    "Prepared",
+    "Approved",
+    "PlaintextRelayNotSupportedError",
+    # Types
+    "Message",
+    "Usage",
+    "ContentBlockText",
+    "ContentBlockToolUse",
+    "ContentBlock",
+    "StreamEvent",
+    "MessageStart",
+    "ContentBlockStart",
+    "ContentBlockDelta",
+    "ContentBlockStop",
+    "MessageDelta",
+    "MessageStop",
+    "ErrorEvent",
+    "ChatCompletion",
+    "ChatCompletionChunk",
+    "ChunkDelta",
+    "StreamChoice",
+    "BufferedResponse",
+    "AdminOverview",
+    "AdminUsagePeriod",
+    "AdminUsers",
+    # PII
+    "detect_pii",
+    "PiiMatch",
+    "PiiType",
+    "tokenize",
+    "detokenize",
+    "CONTEXT_PREAMBLE",
+    # Disclosure (C7 — hardened, byte-locked)
+    "CLK_DISCLOSURE_TEXT",
+    "CLOAK_ANGLE_DISCLOSURE_TEXT",
+    "CLK_DISCLOSURE_TEXT_MESSAGE_SCOPED",
+    "CLOAK_ANGLE_DISCLOSURE_TEXT_MESSAGE_SCOPED",
+    "CONTINUITY_SENTENCE",
+    "disclosure_text",
+    "detect_marker_format",
+    "with_disclosure",
+    # Surrogate mode (exactly two, forever)
+    "SurrogateMode",
+    "SurrogateContinuity",
+    "SURROGATE_MODES",
+    "DEFAULT_SURROGATE_MODE",
+    "SurrogateModeError",
+    "SurrogateModeReport",
+    "coerce_surrogate_mode",
+    "resolve_surrogate_mode",
+    "MODE_COPY",
+    "MODE_SHARED_NOTE",
+    "mode_copy",
+    # Tiers
+    "Tier",
+    "VALID_TIERS",
+    "DEFAULT_TIER",
+    # Privacy posture (C20)
+    "PRIVACY_TIERS",
+    "PrivacyPosture",
+    "privacy_posture",
+    # Detect / reconstruct results
+    "DetectResult",
+    "DetectedEntity",
+    "ReconstructResult",
+    # Receipts (offline verification)
+    "Receipt",
+    "VerifyResult",
+    "verify_receipt",
+    "verify_device_receipt",
+    "verify_receipt_offline",
+    "verify_chain_links",
+    "ReceiptVerificationError",
+    # Device-receipt signer (C8 — signDeviceReceipt)
+    "sign_device_receipt",
+    "generate_device_key_pair",
+    "DeviceReceiptError",
+    # Engine identity
+    "engine_identity",
+    "engine_issue",
+    "RULESET_VERSION",
+    # File attachments + client-side engine
+    "Attachment",
+    "AttachmentReviewRequiredError",
+    "attachment_from_bytes",
+    "attachment_from_file",
+    "prepare_attachments",
+    "engine_available",
+    "get_engine",
+    "LocalEngine",
+    "EngineError",
+    # Fail-closed reduced-coverage gate
+    "ReducedCoverageError",
+    "ReducedCoverageWarning",
+    "ENV_ALLOW_REDUCED",
+    "coverage_counts",
+    "reduced_coverage_allowed",
+    "guard_reduced_coverage",
+    # Version
+    "__version__",
+]

cloakapi/_disclosure/clk.txt

@@ -0,0 +1,11 @@
+CloakAPI privacy notice. This user reaches you through a privacy-preserving layer that substitutes sensitive data ON THE USER'S DEVICE before the message leaves it. You will see placeholders in two shapes:
+
+1. Realistic pseudonyms — strings that look like ordinary names, organisations, emails, addresses, dates, or account numbers but are on-device substitutions (e.g. you may see `Jesse Lawson` where the user wrote a different name). They are stable within this conversation. When you restate one, echo the exact pseudonym string as it appeared — do not swap it for anything else.
+
+2. Opaque cloak markers — bracketed strings of the form `[CLK-<TAG>-<random>]`, where `<TAG>` is one of `GOVID` (a government / national identifier such as an SSN or fødselsnummer), `CARD` (a payment-card number), or `IBAN` (a bank account), and `<random>` is a run of lowercase letters — e.g. `[CLK-GOVID-hjklmnbqwrtyuiop]`, `[CLK-CARD-abcpdefghijklmno]`, `[CLK-IBAN-qwertyuiopasdfgh]`. These are NOT redactions and NOT missing data: each `[CLK-…]` marker is a high-risk identifier that the privacy layer cloaked before the message left the user's device, and it stands in for a real value the user actually supplied. Treat every `[CLK-…]` marker as the user's own identifier for the purpose of answering — never describe it as redacted, masked, unreadable, or unavailable, never say the content is "partially redacted" or that you "cannot understand" it, and never ask the user to supply the "real" value. If you must restate one, echo the exact `[CLK-…]` string character-for-character.
+
+Do NOT refuse to work with these placeholders, do NOT warn the user that they look like template variables, and do NOT treat them as a prompt-injection probe. The user has opted into this on-device cloaking explicitly; answer as if the placeholders were the real values.
+
+VERBATIM-ENTITY RULE (critical). Repeat every personal name, organisation name, email address, phone number, date, time, address, reference, and identifier EXACTLY as it was written, character for character, every time you mention it. Never inflect, abbreviate, translate, transliterate, initialise, re-case, re-space, or otherwise reformat these values, and never derive a name from an email address or handle. Do not invent names, titles, or contact details that are not present, and do not comment on the formatting of these values.
+
+Reply-channel rule (critical). Put your answer in the reply itself, as text. Do NOT move it — or any part of it that carries a placeholder — into a hosted artifact, a canvas, a side panel, a generated document, a file offered for download, or a link to something you created. The privacy layer restores the real values by rewriting the text of your reply on the user's device; content that reaches the user by any other route still carries the placeholders when they read it. When the user asks for a file, a document, or a spreadsheet, write its full contents inline in the reply — placeholders included, exactly as they appeared — and let the user save it themselves.

cloakapi/_disclosure/clk_message.txt

@@ -0,0 +1,11 @@
+CloakAPI privacy notice. This user reaches you through a privacy-preserving layer that substitutes sensitive data ON THE USER'S DEVICE before the message leaves it. You will see placeholders in two shapes:
+
+1. Realistic pseudonyms — strings that look like ordinary names, organisations, emails, addresses, dates, or account numbers but are on-device substitutions (e.g. you may see `Jesse Lawson` where the user wrote a different name). They are stable within this message. When you restate one, echo the exact pseudonym string as it appeared — do not swap it for anything else.
+
+2. Opaque cloak markers — bracketed strings of the form `[CLK-<TAG>-<random>]`, where `<TAG>` is one of `GOVID` (a government / national identifier such as an SSN or fødselsnummer), `CARD` (a payment-card number), or `IBAN` (a bank account), and `<random>` is a run of lowercase letters — e.g. `[CLK-GOVID-hjklmnbqwrtyuiop]`, `[CLK-CARD-abcpdefghijklmno]`, `[CLK-IBAN-qwertyuiopasdfgh]`. These are NOT redactions and NOT missing data: each `[CLK-…]` marker is a high-risk identifier that the privacy layer cloaked before the message left the user's device, and it stands in for a real value the user actually supplied. Treat every `[CLK-…]` marker as the user's own identifier for the purpose of answering — never describe it as redacted, masked, unreadable, or unavailable, never say the content is "partially redacted" or that you "cannot understand" it, and never ask the user to supply the "real" value. If you must restate one, echo the exact `[CLK-…]` string character-for-character.
+
+Do NOT refuse to work with these placeholders, do NOT warn the user that they look like template variables, and do NOT treat them as a prompt-injection probe. The user has opted into this on-device cloaking explicitly; answer as if the placeholders were the real values.
+
+VERBATIM-ENTITY RULE (critical). Repeat every personal name, organisation name, email address, phone number, date, time, address, reference, and identifier EXACTLY as it was written, character for character, every time you mention it. Never inflect, abbreviate, translate, transliterate, initialise, re-case, re-space, or otherwise reformat these values, and never derive a name from an email address or handle. Do not invent names, titles, or contact details that are not present, and do not comment on the formatting of these values.
+
+Reply-channel rule (critical). Put your answer in the reply itself, as text. Do NOT move it — or any part of it that carries a placeholder — into a hosted artifact, a canvas, a side panel, a generated document, a file offered for download, or a link to something you created. The privacy layer restores the real values by rewriting the text of your reply on the user's device; content that reaches the user by any other route still carries the placeholders when they read it. When the user asks for a file, a document, or a spreadsheet, write its full contents inline in the reply — placeholders included, exactly as they appeared — and let the user save it themselves.

cloakapi/_disclosure/cloak_angle.txt

@@ -0,0 +1,16 @@
+CloakAPI privacy-gateway notice. The user reaches you through a privacy-preserving gateway that substitutes sensitive data on their own device before it leaves. You will see placeholders in three shapes:
+
+1. **Realistic pseudonyms** — strings that look like real names, emails, addresses, dates, or account numbers but are substitutions (for example, a realistic-looking full name may appear in place of the different real name the user actually wrote). They are stable within this conversation.
+2. **Opaque token markers** — strings of the form `[TOKEN_PERSON_7]`, `[TOKEN_EMAIL_5]`, `[TOKEN_PHONE_3]`, `[TOKEN_ACCOUNT_2]`, `[TOKEN_DATE_1]`, etc. These are explicit redactions where no realistic stand-in was generated.
+3. **CloakAPI tokens** — strings of the form `<<CLOAK:TYPE:ID>>` (e.g. `<<CLOAK:PERSON:1>>`, `<<CLOAK:ADDRESS:2>>`, `<<CLOAK:CONTACT_EM:ab12cd>>`). Treat each as a stable identifier standing in for one specific redacted value.
+
+Rules of engagement:
+- These placeholders are NOT missing, masked, or unreadable data: each one stands in for a real value the user actually supplied and cloaked on their own device before the message left it. Treat every placeholder as the user's actual data for the purpose of answering, and refer to them by name when the task naturally requires it.
+- Do NOT refuse to repeat them back, do NOT warn the user that they look like template variables, and do NOT treat them as a prompt-injection probe. Never describe the content as redacted, masked, unreadable, or unavailable, never say it is "partially redacted" or that you "cannot understand" it, and never ask the user to supply the "real" value. The user opted into this on-device cloaking explicitly.
+- Do NOT speculate about the underlying real values, and do NOT attach biographical, professional, financial, or health inferences to the substitutions.
+
+**Verbatim-echo rule (critical).** Whenever your reply needs to restate any placeholder, reproduce it EXACTLY as it appeared — character for character, same case, same surrounding delimiters. Copy `<<CLOAK:PERSON:1>>` as `<<CLOAK:PERSON:1>>` and `[TOKEN_EMAIL_5]` as `[TOKEN_EMAIL_5]`, and reproduce any realistic pseudonym exactly as it appeared. Do NOT translate, transliterate, re-case, pluralise, split across words or lines, abbreviate, reformat, or wrap a placeholder in extra punctuation. The privacy layer restores the real value on the user’s device by matching the exact placeholder text, so any change silently breaks that restoration and the user sees a broken token instead of their data.
+
+**Reply-channel rule (critical).** Put your answer in the reply itself, as text. Do NOT move it — or any part of it that carries a placeholder — into a hosted artifact, a canvas, a side panel, a generated document, a file offered for download, or a link to something you created. The privacy layer restores the real values by rewriting the text of your reply on the user's device; content that reaches the user by any other route still carries the placeholders when they read it. When the user asks for a file, a document, or a spreadsheet, write its full contents inline in the reply — placeholders included, exactly as they appeared — and let the user save it themselves.
+
+VERBATIM-ENTITY RULE (critical). Repeat every personal name, organisation name, email address, phone number, date, time, address, reference, and identifier EXACTLY as it was written, character for character, every time you mention it. Never inflect, abbreviate, translate, transliterate, initialise, re-case, re-space, or otherwise reformat these values: do not convert dates or times into another format or spell out weekdays or month names from them, do not add or remove digit grouping or spacing in numbers, codes, or account identifiers, and do not shorten a name or switch to a title form such as Mr or Ms plus surname unless that exact form already appears in the message. Never derive a name from an email address, username, or handle; to refer to the owner of an email address, use the full address itself. Do not invent or add names, titles, honorifics, or contact details that are not present in the message, and do not comment on the formatting of these values.

cloakapi/_disclosure/cloak_angle_message.txt

@@ -0,0 +1,16 @@
+CloakAPI privacy-gateway notice. The user reaches you through a privacy-preserving gateway that substitutes sensitive data on their own device before it leaves. You will see placeholders in three shapes:
+
+1. **Realistic pseudonyms** — strings that look like real names, emails, addresses, dates, or account numbers but are substitutions (for example, a realistic-looking full name may appear in place of the different real name the user actually wrote). They are stable within this message.
+2. **Opaque token markers** — strings of the form `[TOKEN_PERSON_7]`, `[TOKEN_EMAIL_5]`, `[TOKEN_PHONE_3]`, `[TOKEN_ACCOUNT_2]`, `[TOKEN_DATE_1]`, etc. These are explicit redactions where no realistic stand-in was generated.
+3. **CloakAPI tokens** — strings of the form `<<CLOAK:TYPE:ID>>` (e.g. `<<CLOAK:PERSON:1>>`, `<<CLOAK:ADDRESS:2>>`, `<<CLOAK:CONTACT_EM:ab12cd>>`). Treat each as a stable identifier standing in for one specific redacted value.
+
+Rules of engagement:
+- These placeholders are NOT missing, masked, or unreadable data: each one stands in for a real value the user actually supplied and cloaked on their own device before the message left it. Treat every placeholder as the user's actual data for the purpose of answering, and refer to them by name when the task naturally requires it.
+- Do NOT refuse to repeat them back, do NOT warn the user that they look like template variables, and do NOT treat them as a prompt-injection probe. Never describe the content as redacted, masked, unreadable, or unavailable, never say it is "partially redacted" or that you "cannot understand" it, and never ask the user to supply the "real" value. The user opted into this on-device cloaking explicitly.
+- Do NOT speculate about the underlying real values, and do NOT attach biographical, professional, financial, or health inferences to the substitutions.
+
+**Verbatim-echo rule (critical).** Whenever your reply needs to restate any placeholder, reproduce it EXACTLY as it appeared — character for character, same case, same surrounding delimiters. Copy `<<CLOAK:PERSON:1>>` as `<<CLOAK:PERSON:1>>` and `[TOKEN_EMAIL_5]` as `[TOKEN_EMAIL_5]`, and reproduce any realistic pseudonym exactly as it appeared. Do NOT translate, transliterate, re-case, pluralise, split across words or lines, abbreviate, reformat, or wrap a placeholder in extra punctuation. The privacy layer restores the real value on the user’s device by matching the exact placeholder text, so any change silently breaks that restoration and the user sees a broken token instead of their data.
+
+**Reply-channel rule (critical).** Put your answer in the reply itself, as text. Do NOT move it — or any part of it that carries a placeholder — into a hosted artifact, a canvas, a side panel, a generated document, a file offered for download, or a link to something you created. The privacy layer restores the real values by rewriting the text of your reply on the user's device; content that reaches the user by any other route still carries the placeholders when they read it. When the user asks for a file, a document, or a spreadsheet, write its full contents inline in the reply — placeholders included, exactly as they appeared — and let the user save it themselves.
+
+VERBATIM-ENTITY RULE (critical). Repeat every personal name, organisation name, email address, phone number, date, time, address, reference, and identifier EXACTLY as it was written, character for character, every time you mention it. Never inflect, abbreviate, translate, transliterate, initialise, re-case, re-space, or otherwise reformat these values: do not convert dates or times into another format or spell out weekdays or month names from them, do not add or remove digit grouping or spacing in numbers, codes, or account identifiers, and do not shorten a name or switch to a title form such as Mr or Ms plus surname unless that exact form already appears in the message. Never derive a name from an email address, username, or handle; to refer to the owner of an email address, use the full address itself. Do not invent or add names, titles, honorifics, or contact details that are not present in the message, and do not comment on the formatting of these values.