fix(research): reconcile public-release privacy gate with current main

[seonghobae]

Why

Public Research Commons release packaging still needs a product-owned, fail-closed privacy boundary before a fixture can be treated as publishable evidence. Historical PR #301 contained the reviewed security/privacy implementation but was 38 protected-main commits behind, diverged, and carried 69 historical commits. Protected main@c3eff8d2fbd7e69dccbc3b1f7bf166969c209303 had not modified src/research_release.rs, docs/RESEARCH_GOVERNANCE.md, or the research-publication contract files after #301's merge base, so this PR replayed that reviewed work onto current main without importing stale ancestry or unrelated changes, then repaired two current-head review findings test-first.

Current-main TDD lineage

• RED d99db02212d3193f39307f0654a14dbec43425da added the nine reviewed research-publication contracts against current main before the implementation replay.
• GREEN e6706af7ce501c9c3e46cc9cc0825f0afe77a668 replayed the reviewed final src/research_release.rs and docs/RESEARCH_GOVERNANCE.md blobs from fix(research): harden public-release identity privacy gate #301 head bf46714a900a0ef19f63cdceb5ab8d0188350b88.
• Review RED 04bab47c5e2478c82d9b3ff0173f16277c1f78a7 pinned key_research_participant_ref, camelCase equivalent, and the deliberately conservative tokenized_score rejection.
• Review GREEN 051a711f9fb846ee85ab5393d078fc4b3009802b applies credential/compound checks to prefixes before research_participant_ref and recognizes key/keys as credential words.
• 34601e7300d0719554b4da556c906d702586fbee documents the intentional fail-closed false-positive tradeoff and the operator remediation path.
• Exact compare from protected base is 5 commits ahead, 0 behind, with only src/research_release.rs, docs/RESEARCH_GOVERNANCE.md, and the nine tests/research_publication_* files changed.

Privacy contract

• reject operational, Keyverse, restricted-linkage, authentication, credential, and internal-location column aliases after conservative ASCII normalization;
• reject bypasses using case, separators, prefixes/suffixes, inserted digits, glued credentials, non-ASCII/confusable column names, and credential-shaped prefixes on the public research identity namespace;
• preserve the separately governed research_participant_ref public namespace, including reviewed author-metadata exceptions, without weakening restricted markers;
• intentionally fail closed on normalized credential markers even when they appear inside longer column words; benign aliases must be renamed or handled by a separately reviewed contract rather than an ad hoc bypass;
• require at least one published column and an effective product-authorized restricted-identity inventory;
• reject exact restricted identity values in otherwise public flat columns;
• reject structured cells this flat scanner cannot prove clean;
• preserve forbidden-column precedence when identity inventory is unavailable;
• keep operator errors actionable without echoing restricted identifiers;
• never query Keyverse, linkage storage, or another service's application database to fill missing identity evidence.

Bounded context

Psychometrics Commons owns enrollment/consent/normalized ingestion/reference orchestration and this pre-publication product privacy gate. semantic-data-portal remains the immutable external research catalog/release-registration owner. This change does not duplicate Keyverse identity authority, TEPP analysis, Gyeot collection, or fast-mlsirm psychometric kernels, and it does not add direct cross-service database access.

Closes #260

Acceptance

Do not merge until the unchanged exact head independently passes Runtime CI including exact owned-production statement/branch coverage, rustfmt/Clippy/rustdoc, Security/SAST, SPDX SBOM, supply-chain provenance, every live required organization workflow, zero valid unresolved findings, and qualifying independent non-author/non-last-pusher approval under the active ruleset. Pending, queued, skipped, cancelled, absent, stale, predecessor, synthetic, or model-only evidence is not passing. Never self-approve or use administrator bypass.

Supersedes stale/diverged #301 as the clean current-main landing vehicle; historical checks and reviews do not transfer to this exact head.

[coderabbitai]

Warning

Review limit reached

Next included review available in 10 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a6a7372c-785d-4c36-a32b-3564044c282a

📥 Commits

Reviewing files that changed from the base of the PR and between 09534ef and cc98e9d.

📒 Files selected for processing (11)

• docs/RESEARCH_GOVERNANCE.md
• src/research_release.rs
• tests/research_publication_alias_case_contract.rs
• tests/research_publication_branch_coverage.rs
• tests/research_publication_column_name_contract.rs
• tests/research_publication_compound_credential_contract.rs
• tests/research_publication_contract.rs
• tests/research_publication_empty_fixture_contract.rs
• tests/research_publication_glued_credential_contract.rs
• tests/research_publication_leading_credential_contract.rs
• tests/research_publication_sensitive_prefix_contract.rs

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch reconcile/research-release-privacy-main-20260826

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.