feat: establish a private graph-native protection runtime

STYLEGUIDE.md

@@ -55,6 +55,13 @@ except Exception as exc:
     raise AnonymizerWorkflowError("Workflow failed")
 ```
 
+Privacy-sensitive public boundaries are the narrow exception. When an
+underlying exception may contain input values, private correlations, prompts,
+or backend details, translate it to a generic canonical interface error after
+leaving the active exception handler. The public error must have neither an
+accessible ``__cause__`` nor ``__context__``; ``raise ... from None`` inside an
+``except`` block only suppresses display and still retains ``__context__``.
+
 Don't use defensive `try/except` on trusted internal calls that shouldn't fail — only catch at module boundaries. `RewriteWorkflow._run_final_judge` is the intentional exception: it's explicitly non-critical and catches broadly, logging with `exc_info=True` and substituting safe defaults.
 
 **Error messages** must identify the actual bad value. Use `!r` to make interpolated values unambiguous:

docs/development/extensible-sdk-companion-plans.md

@@ -0,0 +1,20 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Extensible SDK planning (superseded)
+
+Status: superseded on 2026-08-20. This path remains as a compatibility landing
+page for existing repository links; it is not a second architecture plan.
+
+Use these documents instead:
+
+- [Technical Proposal — Graph-native Anonymizer SDK](graph-native-anonymizer-sdk-technical-proposal.md)
+  defines the proposed architecture, migration sequence, ownership boundary,
+  and promotion gates.
+- [Evidence — Intake workload validation](intake-workload-validation-evidence.md)
+  records the published Intake behavior, dated dogfood observations, inferred
+  Platform compatibility, and unresolved adopter decisions that inform the
+  proposal.
+
+The repository history retains the former planning report. Do not use that
+historical text as current architecture or evidence.

docs/development/plan-a-design-spike.md

@@ -0,0 +1,81 @@
+<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Historical private protection design-spike record
+
+Status: historical branch-local implementation evidence. This record predates
+and is subordinate to the current
+[graph-native technical proposal](graph-native-anonymizer-sdk-technical-proposal.md);
+its former “Plan A” vocabulary is retained only where needed to describe the
+implemented checkpoint and test lineage.
+
+This record covers the private, synchronous protection slice only. It does not
+authorize a public SDK, Intake integration, release decision, or alternate
+engine path.
+
+The Intake team is the named adopter. The project owner accepted the canonical
+cause-free `AnonymizerWorkflowError` mapping for pipeline failures that cross
+the private row-verification boundary. The customer or consumer PII boundary
+remains unresolved and must be recorded by the consuming-product owner before
+a production validation placement is selected.
+
+## Ownership verdicts
+
+Ownership: stay; owner=anonymizer.interface._protection._compile_protection_plan; evidence=the helper consumes AnonymizerConfig, ModelSelection, and ModelConfig and returns a distinct private plan; reason=cross-domain release-policy compilation is not a same-type config transform.
+
+Ownership: stay; owner=anonymizer.interface._protection._build_operation_plan; evidence=the helper consumes a compiled plan and protection records and returns an invocation-private operation plan; reason=batch admission bounds and correlation span several domain values.
+
+Ownership: stay; owner=anonymizer.interface._protection._ProtectionFlow._execute; evidence=the lifecycle caller coordinates the pandas runtime, invocation verifier, and terminal accounting; reason=effectful runtime coordination does not belong on a frozen domain value.
+
+Ownership: stay; owner=anonymizer.interface._protection._failure; evidence=the helper constructs one closed safe-failure domain value from static enum and stage inputs; reason=the private protection domain module owns its stable failure taxonomy.
+
+Ownership: stay; owner=anonymizer.interface._protection release-policy helpers; evidence=_has_accepted_detections and _redact_release_passed inspect verified engine entity values to derive a protection disposition and enforce the compiled Redact predicate; reason=these helpers coordinate engine schema values with protection-domain policy rather than transform one config model.
+
+Ownership: stay; owner=anonymizer.interface._protection._SafeRepr; evidence=all new private domain values inherit the content-free rendering mixin; reason=one domain-local rendering policy prevents record content and references from entering repr, logs, or errors.
+
+Ownership: stay; owner=anonymizer.engine.ndd.adapter.NddAdapter.private_execution; evidence=the policy coordinates DataDesigner invocation artifacts and ambient measurement, message-trace, and task-trace collection across all engine workflows while preserving run_workflow as the sole execution boundary; reason=filesystem and collector isolation belong at the DataDesigner adapter boundary, with _ProtectionFlow activating the policy only for private execution.
+
+## Test strategy
+
+Focused contract tests cover private value bounds, closed compilation outcomes,
+pre-admission batch rejection, terminal accounting, lifecycle overlap and close,
+safe rendering, and adversarial engine results. A focused integration test uses
+the synthetic detector and the real local Redact/pandas runtime seam. Tests
+assert returned outcomes and absence of private data, not internal call counts.
+
+The flow borrows the facade runtime. Closing it rejects new admission and lets
+an already admitted synchronous invocation drain; it never closes the borrowed
+DataDesigner or provider resources. The current runtime does not establish hard
+cancellation or deterministic dependency teardown, and this spike makes no such
+claim. Execution completion remains distinct from external data-handling and
+release or commit authority.
+
+The implemented private execution path gives each DataDesigner `create()` call
+an invocation-scoped temporary artifact root, loads its output before cleanup,
+and disables ambient Anonymizer measurement plus DataDesigner message and task
+traces for that scope. `preview()` retains its existing in-memory behavior.
+Adapter and flow canaries cover durable-root and collector isolation, backend
+exception and failed-record diagnostic safety, and fail-closed terminal
+accounting.
+
+The compiled plan deep-copies execution inputs and fingerprints the complete
+allowlisted Plan A semantic snapshot, including selected models, model configs,
+detection settings, replacement settings, profile, versions, and limits.
+Execution verifies that fingerprint before effects. Receipts bind the plan
+digest and a fresh content-independent attempt identity. Failure retry safety
+is `unknown` and retry ownership is `Unassigned`; this spike makes no stronger
+retry claim before taxonomy review.
+
+## Intake-format validation
+
+The synthetic validation corpus covers ATIF v1.0 and v1.7, an
+extension-bearing chat-completion request and response, a real OTLP protobuf
+batch, and an Intake-shaped local CHAIN-to-LLM trace. Every declared target
+runs through the private Plan A flow with deterministic local detection and
+`Redact`. Tests verify reconstruction, structural and topology preservation,
+closed field handling, and complete-item withholding after invalid OTLP spans
+or non-success outcomes.
+
+This is adapter and execution evidence only. It does not run the Intake
+service, persist records, call an external provider, use customer data, or
+establish ATIF, chat-completion, or OTLP production support.

pyproject.toml

@@ -26,6 +26,7 @@ anonymizer-chunked-validation = "anonymizer.engine.workflow_columns.detection.pl
 
 [dependency-groups]
 dev = [
+    "opentelemetry-proto>=1.27.0,<2",
     "pre-commit>=4.0.0,<5",
     "pytest>=9.0.3,<10",
     "pytest-cov>=7.0,<8",

src/anonymizer/__init__.py

@@ -25,6 +25,7 @@
 from anonymizer.interface.errors import (
     AnonymizerError,
     AnonymizerIOError,
+    AnonymizerWorkflowError,
     InvalidConfigError,
     InvalidInputError,
 )
@@ -52,6 +53,7 @@ def __getattr__(name: str) -> object:
     "AnonymizerError",
     "AnonymizerInput",
     "AnonymizerIOError",
+    "AnonymizerWorkflowError",
     "Annotate",
     "DEFAULT_ENTITY_LABELS",
     "Detect",

src/anonymizer/engine/constants.py

@@ -12,6 +12,26 @@
 # Input
 COL_TEXT = "__nemo_anonymizer_text_input__"
 
+# Private target/context workframes. These columns never enter public results.
+COL_TARGET_WORK_ID = "__anonymizer_private_row_correlation__"
+COL_TASK_ID = "__anonymizer_private_task_identity__"
+COL_ATTEMPT_ID = "__anonymizer_private_attempt_identity__"
+COL_CONTEXT_BINDING_ID = "__anonymizer_context_binding_id__"
+COL_CONTEXT_OWNER_WORK_ID = "__anonymizer_context_owner_work_id__"
+COL_CONTEXT_ORDINAL = "__anonymizer_context_ordinal__"
+COL_CONTEXT_TEXT = "__anonymizer_context_text__"
+
+# Private Phase 6 provider workframes. These columns never enter public results.
+COL_PHASE6_CONTEXT = "__anonymizer_phase6_context__"
+COL_PHASE6_CANDIDATES = "__anonymizer_phase6_candidates__"
+COL_PHASE6_AUGMENTED = "__anonymizer_phase6_augmented__"
+COL_PHASE6_VALIDATION = "__anonymizer_phase6_validation__"
+
+# Private Phase 7 candidate workframes. These columns never enter public results.
+COL_PHASE7_INVOCATION_ID = "__anonymizer_phase7_invocation_identity__"
+COL_PHASE7_CANDIDATE_REQUEST = "__anonymizer_phase7_candidate_request__"
+COL_PHASE7_CANDIDATE_BUNDLE = "__anonymizer_phase7_candidate_bundle__"
+
 # Step 1: GLiNER detection
 COL_RAW_DETECTED = "_raw_detected_entities"
 

src/anonymizer/engine/detection/detection_workflow.py

@@ -5,7 +5,7 @@
 
 import logging
 from copy import deepcopy
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import cast
 
@@ -42,7 +42,7 @@
     _jinja,
 )
 from anonymizer.engine.detection.postprocess import EntitySpan, group_entities_by_value
-from anonymizer.engine.ndd.adapter import FailedRecord, NddAdapter
+from anonymizer.engine.ndd.adapter import FailedRecord, NddAdapter, _FailedRowEvidence
 from anonymizer.engine.ndd.model_loader import resolve_model_alias, resolve_model_aliases
 from anonymizer.engine.prompt_utils import substitute_placeholders
 from anonymizer.engine.schemas import (
@@ -75,6 +75,7 @@
 class EntityDetectionResult:
     dataframe: pd.DataFrame
     failed_records: list[FailedRecord]
+    failed_row_evidence: tuple[_FailedRowEvidence, ...] = field(default=(), repr=False)
 
 
 class EntityDetectionWorkflow:
@@ -123,7 +124,11 @@ def detect_and_validate_entities(
             preview_num_records=preview_num_records,
         )
         detected_df = detection_result.dataframe.copy()
-        return EntityDetectionResult(dataframe=detected_df, failed_records=detection_result.failed_records)
+        return EntityDetectionResult(
+            dataframe=detected_df,
+            failed_records=detection_result.failed_records,
+            failed_row_evidence=detection_result.failed_row_evidence,
+        )
 
     def _build_detection_spec(
         self,
@@ -347,7 +352,11 @@ def identify_latent_entities(
             workflow_name="latent-entity-detection",
             preview_num_records=preview_num_records,
         )
-        return EntityDetectionResult(dataframe=latent_result.dataframe, failed_records=latent_result.failed_records)
+        return EntityDetectionResult(
+            dataframe=latent_result.dataframe,
+            failed_records=latent_result.failed_records,
+            failed_row_evidence=latent_result.failed_row_evidence,
+        )
 
     def run(
         self,
@@ -407,9 +416,14 @@ def run(
                 )
                 final_df = latent_result.dataframe.copy()
                 final_failures = [*detected_result.failed_records, *latent_result.failed_records]
+                final_failure_evidence = (
+                    *detected_result.failed_row_evidence,
+                    *latent_result.failed_row_evidence,
+                )
             else:
                 final_df = detected_result.dataframe.copy()
                 final_failures = detected_result.failed_records
+                final_failure_evidence = detected_result.failed_row_evidence
 
             # When entity_labels is explicitly provided (even if it matches DEFAULT_ENTITY_LABELS),
             # the augmenter is strict and out-of-scope labels are filtered.
@@ -425,6 +439,7 @@ def run(
             result = EntityDetectionResult(
                 dataframe=final_df,
                 failed_records=final_failures,
+                failed_row_evidence=final_failure_evidence,
             )
             measurement.update(
                 output_row_count=len(result.dataframe),
@@ -440,19 +455,35 @@ def _inject_detector_params(
         labels: list[str],
         gliner_detection_threshold: float,
     ) -> list[ModelConfig]:
-        resolved = deepcopy(model_configs)
-        for config in resolved:
-            if config.alias != selected_models.entity_detector:
-                continue
-            if config.inference_parameters.extra_body is None:
-                config.inference_parameters.extra_body = {}
-            config.inference_parameters.extra_body["labels"] = labels
-            config.inference_parameters.extra_body["threshold"] = gliner_detection_threshold
-            config.inference_parameters.extra_body["chunk_length"] = 384
-            config.inference_parameters.extra_body["overlap"] = 128
-            config.inference_parameters.extra_body["flat_ner"] = False
-            break
-        return resolved
+        return _inject_detector_params(
+            model_configs=model_configs,
+            selected_models=selected_models,
+            labels=labels,
+            gliner_detection_threshold=gliner_detection_threshold,
+        )
+
+
+def _inject_detector_params(
+    *,
+    model_configs: list[ModelConfig],
+    selected_models: DetectionModelSelection,
+    labels: list[str],
+    gliner_detection_threshold: float,
+) -> list[ModelConfig]:
+    """Return detached GLiNER model configs for one detector workflow."""
+    resolved = deepcopy(model_configs)
+    for config in resolved:
+        if config.alias != selected_models.entity_detector:
+            continue
+        if config.inference_parameters.extra_body is None:
+            config.inference_parameters.extra_body = {}
+        config.inference_parameters.extra_body["labels"] = labels
+        config.inference_parameters.extra_body["threshold"] = gliner_detection_threshold
+        config.inference_parameters.extra_body["chunk_length"] = 384
+        config.inference_parameters.extra_body["overlap"] = 128
+        config.inference_parameters.extra_body["flat_ner"] = False
+        break
+    return resolved
 
 
 def _resolve_detection_labels(entity_labels: list[str] | None) -> list[str]:

src/anonymizer/engine/execution/__init__.py

@@ -0,0 +1,4 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Private pandas execution coordination for the public interface."""