Prepare private review evidence

Review evidence tests a package against stored page content. For authenticated sites, that content can contain private account data. A sanitizer does not prove that a fixture is safe to share.

Capture authority and storage

An explicit request to create or repair an authenticated feed authorizes local capture of the requested URL. If the request does not give this authority, get authorization before capture. Keep valid authorization for the same action and scope. Do not request it again without a relevant change.

Keep raw authenticated HTML, screenshots, WARC data, cookies, authorization headers, and browser profiles on the capture machine. Do not upload or commit them. The CLI and MCP store authoring artifacts under FRUITFUL_AUTHORING_DATA_ROOT, which defaults to ~/.fruitful. The MCP tool-call ledger stays under prototypes/agent-capture/runs.

Tool results and model disclosure

Local file storage does not prove that model inference is local. An agent host can send tool results to its configured model provider. Inspection results and bounded HTML slices can contain private page content.

Before you use content-bearing tools, identify the host's data destination and the user's authorized scope. Tell the user which selected content will enter the agent conversation. Tell the user where its model runs. If the destination or permission is unclear, resolve it before you send that content. If the user specifies local-only processing, use a host and model that meet that requirement. Do not infer permission to send raw captures from permission to capture locally.

Use assess_capture and coverage reports before you request page content. Prefer focused inspect_capture, inspect_entries, and inspect_nodes results when structure is necessary. Use bounded read_capture slices only when the focused tools omit required structure. Keep capture content out of logs. Logs can contain capture IDs, paths, byte counts, digests, durations, and typed outcomes.

For login or browser session import, follow Capture a page behind a login.

Prepare a local candidate

Prefer prepare_fixture_candidate with representative indexes from the coverage report. It creates a sanitized candidate and an evidence sidecar without captured content. Use full-capture sanitization only when necessary:

yarn fruitful plugin sanitize-fixture <capture.html> \
  --out <local-candidate.html> --redactions <redactions.json> --json

Keep the candidate outside the package until approval. The sanitizer removes executable elements, DOM event handlers, form state, and email addresses. It also applies literal replacements:

{
  "replacements": [
    { "find": "Real Person", "replace": "Example Author" },
    { "find": "real-person", "replace": "example-author" }
  ]
}

Examine the complete candidate. Search for names, handles, email addresses, private URLs, message text, account identifiers, and authentication or session vocabulary. Search for the original values in the redaction list. Remove each sanitizer finding or give a reason for it before approval. If private content has no safe deterministic replacement, keep the evidence private. Use an approved existing fixture or a smaller representative candidate instead.

Get approval for the exact bytes

Get the user's approval for the exact sanitized candidate before it enters the package or Git. Approval of capture does not give approval for a fixture. If the candidate bytes change after approval, get approval for the new bytes.

After approval, add the fixture and its evidence sidecar to the private review tree. Declare the case in review/review-evidence.json:

{
  "id": "newsfeed-capture",
  "displayName": "Newsfeed",
  "format": "html",
  "fixture": "review/fixtures/newsfeed.html",
  "url": "https://www.linkedin.com/feed/",
  "binding": "newsfeed",
  "expectation": "review/expectations/newsfeed.json",
  "provenance": { "kind": "sanitized-capture", "evidence": "review/evidence/newsfeed.json" }
}

A case also declares presentationExamples when required by its presentation. Use synthetic provenance only for synthetic evidence. Use sanitized-capture provenance and its sidecar for evidence from a capture.

The sidecar's sourceCaptureDigest records the raw capture's SHA-256 for lineage. It does not prove equality between raw and sanitized bytes. Make sure sanitizedFixtureDigest matches the exact committed fixture bytes. Publication compares those digests.

Validate the stored evidence

Follow Validate the package and its coverage after you add the approved case. Examine generated expectations for correct values, identities, and relationships.

Review evidence belongs in review/. Never add it to a runtime manifest. Release inspection tests separation of the runtime and review artifacts and their bound digests.