# v0.12.14 - Policy Binding + Privacy-Aware Verification

**Status:** DRAFT (pending release). Release date, tag hash, and GitHub Release URL are filled in at tag time by the release-prep PR.

Typed document binding for terms and policy, with privacy-aware verification defaults and deployment guidance for privacy-sensitive environments.

## Summary

PEAC Protocol v0.12.14 strengthens policy and terms binding while improving privacy-aware verification for sensitive deployment environments. This release adds typed document binding for policy and referenced terms, clarifies verifier output behavior, and introduces documentation and defaults around data minimization, retention, deletion, and redaction for reference verifier deployments.

## Highlights

- **Typed document binding for terms and policy.** `@peac/protocol` exports four new helpers: `computeJsonDocumentDigestJcs` (RFC 8785 JCS + SHA-256 for JSON), `computeTextDocumentDigestUtf8` (minimal `\n` + NFC normalization + SHA-256 for markdown or plaintext), `computeDocumentDigest` (dispatcher), and `checkDocumentBinding` (three-state check). The legacy `computePolicyDigestJcs` and `checkPolicyBinding` exports delegate with byte-identical output. Normative spec: [`docs/specs/DOCUMENT-BINDING.md`](../specs/DOCUMENT-BINDING.md).
- **Optional verifier `bindings` field.** The verifier report gains an optional top-level `bindings` object carrying `policy`, `terms`, and `documents` results under the same three-state semantics. The legacy top-level `policy_binding` field is preserved as a byte-stable mirror. `bindings` is report-only and is not stamped into the emitted record, envelope, or artifact shape.
- **Publisher-supplied `canonical_digest`.** Each representation envelope (`uri`, `markdown`, `plaintext`, `json`) has its own binding identity. Cross-representation comparison is `failed` by design. Publishers may optionally attach a canonical JSON-form digest (`canonical_digest`); verifiers may compare it when present and must never synthesize it from non-JSON content. Absence is `unavailable`, not `failed`.
- **x402 PR-1986 terms helper.** `@peac/adapter-x402` adds `computeX402TermsDigest` as a thin convenience over the dispatcher for the four x402 `terms` representations.
- **`peac.txt` policy-only convergence.** `@peac/disc` narrows to policy-document parsing; legacy `verify` / `public_keys` / `jwks` fields emit a structured `PEAC_LEGACY_PEAC_TXT_KEY_FIELD` deprecation warning. `@peac/pref` becomes a deprecated facade over `@peac/mappings-content-signals` with no in-package network I/O, full-length SHA-256 digests, and a one-shot `PEAC_DEPRECATED_PREF` deprecation warning.
- **Privacy-aware deployment guidance.** Five new boundary-first documents under [`docs/privacy/`](../privacy/README.md): data classification, retention and deletion, deployment roles, data-subject rights, and DPIA starter. Each document leads with "What PEAC does / What PEAC does not do / What deployers still own." The receipt-side normative privacy profile ([`docs/specs/PRIVACY-PROFILE.md`](../specs/PRIVACY-PROFILE.md)) cross-links the new deployment-side guidance.
- **Verifier privacy defaults.** The reference verifier ships two new operator-controllable knobs:
  - JWKS cache retention caps via `PEAC_JWKS_CACHE_TTL_MS` (default `300000` ms / 5 minutes) and `PEAC_JWKS_CACHE_MAX_ENTRIES` (default `1000`). Malformed values are ignored and the built-in default applies; the resolver never silently uncaches itself because of operator typos.
  - `PEAC_NO_RAW_PERSONAL_DATA` (set to `true` or `1`) enables the `no_raw_personal_data` minimization mode on the verifier report. The redactor pseudonymises `claims.sub` and `claims.actor.{id,email,name,display_name,handle,sub}` to `sha256:<32 hex>` (128 bits of visible digest, deterministic per input), walks `claims.extensions` recursively, and elides every string leaf that is not a short structured identifier (ASCII printable, no whitespace, 1..16 chars). Numbers, booleans, null, and nested object/array structure pass through. Protocol metadata (`iss`, `iat`, `exp`, `nbf`, `jti`, `kind`, `type`, `typ`, `alg`, `kid`, `cty`, `pillars`, `wire_version`, `version`, `policy`, `policy_binding`, `bindings`) is unchanged. This is a minimization posture, not a legal guarantee that all personal data has been removed; operators with broader claim payloads MUST add their own redaction layer. With the env var unset (the default), the report body is byte-identical to v0.12.13. The byte-stability lock test in `apps/api/tests/report-format.test.ts` and the recursive-walk regression tests in the same file enforce these contracts. Deletion hooks for any operator-maintained report index, and request-log redaction, remain operator-owned per `docs/privacy/RETENTION-AND-DELETION.md` §5.

## Privacy-sensitive and GDPR-aligned deployments

This release adds guidance and safer defaults that support privacy-sensitive and GDPR-aligned deployments, including data minimization, retention and deletion guidance, deployment-role boundaries, and handling guidance for immutable signed evidence versus mutable report / index metadata. PEAC remains a records layer and does not replace operator legal review, lawful-basis decisions, or controller obligations.

Hashes, opaque IDs, and pseudonymous identifiers may still be personal data depending on deployment context. The guidance in [`docs/privacy/`](../privacy/README.md) is designed to reduce unnecessary raw data exposure; it does not redefine legal scope.

## API additions (additive; API contract snapshot updated)

`@peac/protocol` exports four new symbols:

- `checkDocumentBinding`
- `computeDocumentDigest`
- `computeJsonDocumentDigestJcs`
- `computeTextDocumentDigestUtf8`

`@peac/adapter-x402` exports `computeX402TermsDigest` and helper type aliases.

## Compatibility

- No wire-format change. `peac-receipt/0.1` envelope and `interaction-record+jwt` JOSE `typ` are unchanged.
- No new public package. No new signing envelope.
- Verifier HTTP response bodies remain byte-identical to v0.12.13 when callers do not supply `bindings.terms` or a non-empty `bindings.documents`.
- `@peac/disc` and `@peac/pref` are deprecated facades. Legacy consumers continue to work; warnings are structured and suppressible via standard Node `process` channels. Final classification of both packages is owned by the next cleanup release.

## Links

- [Document-binding spec](../specs/DOCUMENT-BINDING.md)
- [Verification report format](../specs/VERIFICATION-REPORT-FORMAT.md)
- [x402 profile](../specs/X402-PROFILE.md)
- [Privacy deployment guidance index](../privacy/README.md)
- [Privacy profile (receipt side, normative)](../specs/PRIVACY-PROFILE.md)
- [Trust artifacts index](../TRUST-ARTIFACTS.md)
