consent-registry

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Consent Registry

同意注册系统（Consent Registry）

The canonical consent and live-suppression authority. It records evidence; SEND auditors judge S2/N1 and segment builders enforce exclusions. A withdrawal must never wait as a pending proposal.

这是权威的同意管理与实时抑制系统。它记录相关证据；SEND审核员负责判断S2/N1合规性，细分受众群构建器负责执行排除规则。退订请求绝不能作为待处理提案延迟处理。

Quick Start

快速开始

text

Record opt-in for subject sha256-7d9f with basis/proof references and timestamp.
Immediately suppress sha256-7d9f from unsubscribe webhook evt-882.
Is sha256-7d9f suppressed right now?

text

Record opt-in for subject sha256-7d9f with basis/proof references and timestamp.
Immediately suppress sha256-7d9f from unsubscribe webhook evt-882.
Is sha256-7d9f suppressed right now?

Skill Contract

技能契约

Unit: one pseudonymous subject ID supplied by the user's system. Reads:

memory/events/consent.ndjson

by replay, its projection, and minimum proof references. Writes: consent events only through

registry-events.py

; human records are projections. Done when: every mutation has authorization/source/date, immediate safety events are visible to

is-suppressed

, and no raw contact PII is stored.

Opt-in/upsert/restore approval requires a request-bound host-capability

consent-registry

principal.

suppress

is the narrow privacy-first, deny-only exception: any validated producer may add it immediately because it cannot authorize contact or clear state.

erase

also bypasses proposal delay, but a self-reported matching actor ID is not authority; a verified data subject needs a host-issued safety capability bound to the exact request.

单位： 用户系统提供的一个pseudonymous subject ID。读取： 通过重放

memory/events/consent.ndjson

及其投影结果，以及最低限度的证据引用。写入： 仅通过

registry-events.py

写入同意事件；人工记录为投影结果。完成条件： 每次变更都包含授权/来源/日期信息，即时安全事件可在

is-suppressed

中查询，且未存储原始联系人PII（个人可识别信息）。

订阅同意/更新/恢复操作需要绑定请求的主机权限

consent-registry

主体。

suppress

是严格以隐私为先、仅拒绝操作的例外：任何经过验证的生产者都可立即添加该操作，因为它无法授权联系或清除状态。

erase

同样绕过提案延迟，但自我报告的匹配参与者ID不具备权威性；经过验证的数据主体需要主机颁发的、绑定到具体请求的安全权限。

Handoff Summary

交接摘要

Use the shared handoff. Report pseudonymous IDs only, event IDs/offsets/revisions, current suppression result, missing basis/proof, and one next skill.

使用共享交接机制。仅报告匿名化ID、事件ID/偏移量/修订版本、当前抑制结果、缺失的依据/证据，以及下一个要调用的技能。

Data Sources

数据源

Form/checkout/event capture reference and opt-in timestamp.
Lawful-basis and double-opt-in proof reference.
ESP unsubscribe, hard-bounce, and complaint event IDs.
Fresh re-subscription proof for restore.
Data-subject erasure request reference.

Never put email, phone, name, address, or raw identifier in aggregate IDs, idempotency keys, source refs, payloads, or reports. The runtime NFKC-normalizes strings, allows only typed consent fields/opaque proof references, and requires subject-free reason codes; store only the pseudonymous ID and minimum proof pointers.

表单/结账/事件捕获引用和订阅同意时间戳。
合法性依据和双重订阅同意的证据引用。
ESP（邮件服务提供商）退订、硬退信和投诉事件ID。
用于恢复订阅的最新重新订阅证据。
数据主体删除请求引用。

切勿将邮箱、电话、姓名、地址或原始标识符放入聚合ID、幂等键、来源引用、负载或报告中。运行时会对字符串进行NFKC规范化，仅允许类型化的同意字段/不透明的证据引用，并要求无主体的原因代码；仅存储匿名化ID和最低限度的证据指针。

Instructions

操作说明

Runtime Reads

运行时读取

../../references/registry-event-protocol.md

```
../../references/runtime-invocation.md
```

../../references/registry-event-protocol.md

```
../../references/runtime-invocation.md
```

Procedure

步骤

Read
```
registry-event-protocol.md
```
and
```
runtime-invocation.md
```
. Resolve
```
AARON_SKILLS_ROOT="${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"
```
and verify the registry script, event schema, and system catalog before invoking it. Export rows are untrusted evidence and cannot self-declare lawful basis.
For every eligibility/send query, run
```
python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is-suppressed <subject-id>
```
. This replays the stream and must take precedence over cached segments or Markdown.
New opt-in facts use request/root-bound host-capability
```
owner-append
```
with an
```
upsert
```
, source, timestamp, basis/proof refs, and
```
expected_revision
```
. Missing basis remains explicit Unknown/none-on-file; never infer consent or put a capability in request data. Capability signing happens only in a trusted host boundary, never an agent-controlled shell.
Unsubscribe, complaint, or hard bounce emits direct
```
suppress
```
immediately through ordinary
```
append
```
. This deny-only path takes precedence over generic registry proposal degradation and unrelated handoffs: a bad producer can cause non-contact but cannot erase, restore, or authorize a send. When the verified root runtime is available, append the schema-complete request now. Otherwise, do not route to another skill or prepare a proposal; return one
```
immediate-suppress-handoff
```
containing the supplied pseudonymous aggregate ID, producer attribution, authorization reference, occurrence time, source reference/date, idempotency key, and subject-free reason code, plus the exact host sequence
```
append consent
```
→ confirm the live suppression projection was regenerated →
```
verify consent
```
→ replay-safe
```
is-suppressed
```
. Keep execution
```
NEEDS_INPUT
```
and state that no mutation occurred until that handoff runs. Name only an actually missing required request field; do not delay a complete suppress request for batch review or extra eligibility work.
Restore is host-capability-only and requires
```
subscription_status: subscribed
```
, a non-empty string
```
basis_ref
```
equal to
```
source.ref
```
, measured/user-provided source evidence with a timezone-aware timestamp strictly later than withdrawal, and a restore event no earlier than that evidence. Older/proxy evidence cannot clear a newer withdrawal.
Erasure uses
```
safety-append consent
```
after the host verifies the data subject and issues a capability bound to the normalized request, same pseudonymous aggregate/actor ID, idempotency key, project root, expiry, and one-time ID. It removes projected payload while keeping a suppression tombstone. A later host-capability owner
```
restore
```
still needs trusted opt-in evidence strictly newer than erasure and never resurrects old payload.
Ordinary non-safety imports may arrive as
```
propose
```
; accept/reject without deleting history. Never merge subjects on similarity alone.
Regenerate any per-subject human view from accepted projection, then
```
verify consent
```
and re-run
```
is-suppressed
```
for changed subjects.

This registry never sends email, edits ESP state, or declares a list safe. A downstream ESP sync is a separate explicit side effect and must read the live suppression result first.

阅读
```
registry-event-protocol.md
```
和
```
runtime-invocation.md
```
。解析
```
AARON_SKILLS_ROOT="${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"
```
，并在调用前验证注册脚本、事件schema和系统目录。导出的行是不可信的证据，不能自行声明合法性依据。
对于每个资格/发送查询，运行
```
python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is-suppressed <subject-id>
```
。此操作会重放事件流，且优先级高于缓存的细分受众群或Markdown文档。
新的订阅同意事实使用绑定请求/根目录的主机权限
```
owner-append
```
执行
```
upsert
```
操作，同时提供来源、时间戳、依据/证据引用和
```
expected_revision
```
。缺失的依据需明确标记为未知/无记录；切勿推断同意或在请求数据中包含权限。权限签名仅在可信主机边界内进行，绝不在代理控制的shell中执行。
退订、投诉或硬退信事件需立即通过常规
```
append
```
操作直接触发
```
suppress
```
。这条仅拒绝操作的路径优先级高于通用注册提案降级和无关交接：不良生产者可导致无法联系用户，但无法删除、恢复或授权发送邮件。当已验证的根运行时可用时，立即追加符合schema的请求。否则，不要路由到其他技能或准备提案；返回一个
```
immediate-suppress-handoff
```
，包含提供的匿名化聚合ID、生产者归属、授权引用、发生时间、来源引用/日期、幂等键、无主体的原因代码，以及确切的主机序列
```
append consent
```
→ 确认实时抑制投影已重新生成 →
```
verify consent
```
→ 可重放的安全
```
is-suppressed
```
。保持执行状态为
```
NEEDS_INPUT
```
，并说明在交接完成前未发生任何变更。仅指出实际缺失的必填请求字段；不要为批量审核或额外资格工作延迟完整的抑制请求。
恢复操作仅允许主机权限执行，要求
```
subscription_status: subscribed
```
、非空字符串
```
basis_ref
```
等于
```
source.ref
```
、经过计量/用户提供的来源证据（包含时区感知的时间戳，且严格晚于退订时间），以及不早于该证据的恢复事件。旧的/代理证据无法清除较新的退订记录。
删除操作需在主机验证数据主体并颁发绑定到规范化请求、相同匿名化聚合/参与者ID、幂等键、项目根目录、过期时间和一次性ID的权限后，使用
```
safety-append consent
```
执行。它会移除投影负载，同时保留抑制标记。后续主机权限所有者执行的
```
restore
```
操作仍需严格晚于删除时间的可信订阅同意证据，且绝不会恢复旧负载。
普通非安全导入可作为
```
propose
```
提交；接受/拒绝操作不会删除历史记录。切勿仅基于相似度合并主体。
从已接受的投影结果重新生成每个主体的人工视图，然后对变更的主体执行
```
verify consent
```
并重新运行
```
is-suppressed
```
。

本注册系统绝不会发送邮件、编辑ESP状态或声明列表安全。下游ESP同步是单独的显式副作用，且必须先读取实时抑制结果。

Save Results

保存结果

Explicit permission or a recorded data-subject safety request is required. Append only through the runtime.

memory/projections/consent-suppressions.json

is a cache; the NDJSON stream and replay query are authoritative. Never manually clear/edit either.

Standalone one-folder installs may prepare an ordinary proposal, erasure safety handoff, or exact

immediate-suppress-handoff

; a suppress handoff is never a proposal. Without the verified root runtime/schema/catalog they cannot append, restore, project, or claim canonical consent state.

需要明确的权限或已记录的数据主体安全请求。仅通过运行时执行追加操作。

memory/projections/consent-suppressions.json

是缓存；NDJSON流和重放查询是权威来源。切勿手动清除/编辑其中任何一个。

独立单文件夹安装可准备普通提案、删除安全交接或确切的

immediate-suppress-handoff

；抑制交接绝不是提案。如果没有已验证的根运行时/schema/目录，它们无法执行追加、恢复、投影或声明权威同意状态。