phase 1.6 BIPA gates — engineering wave (4 of 7 staged)

Per docs/PHASE_1_6_BIPA_GATES.md. Status table now reflects:

  DONE (engineering-only, no counsel dependency):
  - Gate 4: name→ethnicity inference removed from mcp-server.
    Removal note in search.html:3372 + new Bun absence test
    (mcp-server/phase_1_6_gate_4.test.ts) with 3 assertions:
    walker actually scans files, regex catches synthetic positives,
    no offending DEFINITION patterns in any .html/.ts/.js source.
    3/3 pass.

  ENG-DONE, signature pending:
  - §2 attestation: scripts/staffing/attest_pre_identityd_biometric_state.sh
    runs three checks against the live state:
      1. workers_500k.parquet schema has no biometric/photo/face/image col
      2. data/_kb/*.jsonl + pathway state contain no base64 image magic
         bytes (JPEG /9j/, PNG iVBOR), no data:image/* MIME prefixes,
         no field-name patterns ("photo", "biometric", "deepface_*")
      3. data/headshots/manifest.jsonl is entirely synthetic-tagged
    3/3 evidence checks pass on the live data dir. Generates a
    signed-by-operator+counsel attestation document committed at
    docs/attestations/BIPA_PRE_IDENTITYD_ATTESTATION_2026-05-03.md
    with SHA-256 of the evidence summary so post-signature tampering
    is detectable.

  ENG-STAGED, awaiting counsel review:
  - Gate 1 retention schedule scaffold at
    docs/policies/consent/biometric_retention_schedule_v1.md (BIPA
    §15(a)). Engineering facts (categories, 18-month operational
    ceiling vs 3-year statutory cap, destruction procedure pointer
    to Gate 5 runbook) plus ⚖ COUNSEL markers for the binding text.
  - Gate 2 consent template scaffold at
    docs/policies/consent/biometric_consent_template_v1.md (BIPA
    §15(b)(1)-(3)). Required disclosures + plain-language summary +
    withdrawal procedure + the structured fields the consent UI must
    post to identityd.
  - Gate 5 destruction runbook at docs/runbooks/BIPA_DESTRUCTION_RUNBOOK.md.
    Triggers, pre-destruction checks (incl. chain-verified gate via
    /audit/subject/{id}), procedure (legal-tier endpoint), automatic
    audit row append (subject_audit.v1 with kind=biometric_erasure),
    backup-window disclosure, monthly reporting cadence, audit-trail
    attestation procedure cross-referencing the cross-runtime parity
    probe.

  BLOCKED on engineering design:
  - Gate 3 photo-upload endpoint. Requires identityd photo intake
    design + deepface integration scope. Deferred to its own session.

  DEFERRED:
  - §3 employee training material. Gate 5 runbook §7 may serve as
    substrate; counsel decides whether a separate program is needed.

Calendar bottleneck is now counsel review. Engineering can stage no
further deliverables until either (a) Gate 3's design conversation
happens or (b) counsel completes review of items 1/2/5/6.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/PHASE_1_6_BIPA_GATES.md

@@ -19,7 +19,7 @@ Each gate is a deliverable that must ship before real-photo intake. None is opti
 **Required:** A publicly-available, written retention schedule for biometric identifiers and information.
 
 **What ships:**
-- `data/_consent/biometric_retention_schedule_v1.md` — public file
+- `docs/policies/consent/biometric_retention_schedule_v1.md` — public file
 - Linked from public privacy policy at the deployment URL
 - Specifies:
   - Categories of biometric data collected (facial geometry derived from candidate photos, age estimate, gender classification, race classification — per Phase 1.5 deepface walk)
@@ -39,7 +39,7 @@ Each gate is a deliverable that must ship before real-photo intake. None is opti
 **Required:** Informed, written consent BEFORE any biometric collection occurs.
 
 **What ships:**
-- `data/_consent/biometric_consent_template_v1.md` — public consent template
+- `docs/policies/consent/biometric_consent_template_v1.md` — public consent template
 - Versioned, hashed, referenced from identityd's `consent_versions` table
 - Must disclose, per BIPA §15(b)(1)-(3):
   1. That biometric identifiers/information will be collected
@@ -181,20 +181,31 @@ ALTER TABLE subjects ADD COLUMN biometric_template_hash TEXT;     -- hash of the
 
 ## 4. Phase 1.6 exit criteria (gates Phase 2 backfill)
 
-All 5 gates must be DONE before identityd backfill begins:
+All 5 gates must be DONE before identityd backfill begins. Status as
+of 2026-05-03 — scaffolds vs. counsel sign-off vs. shipped code:
 
-1. ✅ Public retention schedule published + linked from privacy policy + counsel sign-off
-2. ✅ Consent template published + counsel sign-off + technical enforcement integrated
-3. ✅ Photo-upload endpoint shipped with consent enforcement + integration test green
-4. ✅ Name → ethnicity inference removed from search.html + unit test asserting absence
-5. ✅ Destruction runbook published + erasure endpoint includes biometric path + counsel sign-off
+| # | Gate | Engineering | Counsel | Status |
+|---|---|---|---|---|
+| 1 | Public retention schedule | scaffolded at `docs/policies/consent/biometric_retention_schedule_v1.md` | pending | **eng-staged** |
+| 2 | Consent template | scaffolded at `docs/policies/consent/biometric_consent_template_v1.md` | pending | **eng-staged** |
+| 3 | Photo-upload endpoint with consent enforcement | NOT STARTED — depends on identityd photo intake design + deepface integration | n/a until eng | **blocked-on-design** |
+| 4 | Name → ethnicity inference removed | DONE — `mcp-server/search.html:3372` removal note + `mcp-server/phase_1_6_gate_4.test.ts` absence test (3/3 green) | none required | **DONE** |
+| 5 | Destruction runbook | scaffolded at `docs/runbooks/BIPA_DESTRUCTION_RUNBOOK.md`; erasure endpoint + verify/report scripts marked TODO | pending | **eng-staged** |
 
 PLUS:
 
-6. ✅ Cryptographic attestation that no pre-identityd biometric data exists, signed by J + counsel
-7. ✅ Employee training material published + initial acknowledgments recorded
+| # | Item | Engineering | Counsel | Status |
+|---|---|---|---|---|
+| 6 | Cryptographic attestation pre-identityd | DONE — `scripts/staffing/attest_pre_identityd_biometric_state.sh` + `docs/attestations/BIPA_PRE_IDENTITYD_ATTESTATION_2026-05-03.md` (3/3 evidence checks pass; signature lines pending) | pending signature | **eng-DONE, signature-pending** |
+| 7 | Employee training material | scaffold deferred — Gate 5 runbook §7 acknowledgment may serve as substrate | pending | **deferred** |
 
-Until all 7 are checked off, **identity service backfill (Phase 2 §5 Step 5) cannot proceed.**
+Until items 1-5 + 6 are checked off, **identity service backfill (Phase 2 §5 Step 5) cannot proceed.**
+
+**Calendar bottleneck:** Items 1, 2, 5, 6 (and #7) await counsel
+review of the engineering scaffolds. Gate 3 (photo-upload endpoint)
+is the only remaining engineering work; it's deferred to its own
+session because it crosses into identityd photo intake and deepface
+integration scope that hasn't been designed yet.
 
 ---