sanitize.config.json

{
  "$comment": "CUSTOMIZE THIS FILE for your use case. It is the single surface that teaches the sanitization gate what 'a particular' looks like for your domain. The deterministic layer (secrets/PII) needs no tuning; the semantic layer does.",

  "package_name": "Matilde",
  "package_kind": "SHARED, public agent package (academia/science use-case customization)",

  "sensitive_prefixes": [
    "hermes-skill/",
    "matilde_plugin/",
    "docker/SOUL",
    "docs/"
  ],
  "$comment_prefixes": "Paths whose CONTENT could leak study/collaborator particulars. Top-level *.md (README, CONTRIBUTING) are always included automatically. Note: published paper titles, DOIs, and dataset accession IDs used as test fixtures or examples are PUBLIC reference material, not particulars — see do_not_flag_examples.",

  "semantic": {
    "domain_noun": "study",
    "$comment_domain_noun": "A 'particular' belongs to one research study/manuscript/engagement. Matilde works with public scholarly metadata by design, so the gate must distinguish PUBLIC references (fine) from PRIVATE study particulars (not fine).",
    "flag_examples": [
      "names of human research participants, patients, or subjects tied to a specific study",
      "an unpublished manuscript's content, working title, hypotheses, or results before publication",
      "a specific dataset accession ID, file path, or repository tied to one private/in-progress study (e.g. an embargoed OpenNeuro dataset)",
      "names of collaborators, PIs, reviewers, or institutions tied to one active engagement (not public co-author lists)",
      "grant numbers, IRB/ethics protocol numbers, or funding details specific to one engagement",
      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)",
      "a messaging or account identifier tied to a real person — a Signal/Telegram UUID, a contact phone, an allowlisted user ID (these belong in deployment config/secrets, never in the package)"
    ],
    "do_not_flag_examples": [
      "generic methodology (\"how to verify a citation\", \"how to grade a source\")",
      "tool, API, library, standard, or service names (Crossref, OpenAlex, DataCite, GROBID, BIDS, Quarto, Pandoc)",
      "PUBLISHED paper titles, author names, DOIs, or retraction examples used illustratively or as test fixtures (these are public record)",
      "public dataset identifiers used as documentation examples"
    ],
    "model": "claude-opus-4-8"
  },

  "deterministic": {
    "$comment": "The credential/PII layer runs with NO external dependencies and FAILS CLOSED. These patterns are conservative defaults; add your own. Allowlist false-positives by exact line substring in 'allow_substrings'.",
    "enabled": true,
    "allow_substrings": [
      "noreply@anthropic.com",
      "example.com",
      "example.org",
      "user@example",
      "team@ourresearch.org",
      "127.0.0.1",
      "0.0.0.0"
    ],
    "skip_paths": [
      "tests/"
    ],
    "$comment_skip_paths": "Path prefixes the deterministic layer does NOT scan. Test files legitimately contain credential-SHAPED fixtures and public DOIs/emails to exercise the detectors; scanning them would self-flag. Keep this tight — only paths that intentionally hold pattern-shaped non-secrets."
  }
}