APBSC 06 · 09 · RBPM
Measuring without looking
The method answers one question: how can anyone study private context in public files without becoming one more person who has read it? The answer is a data flow in which the first observer is a machine and the only output is a bounded feature.
The data flow
- XPublic current stateOnly what is public now. No history, no deleted commits, no private repositories.
- NNormalizeBounded decoding; normalization may never add sensitive content.
- DDetectPath, secret-like, network, auth, semantic, metadata, recoverability — each with a declared scope.
- SSuppressSensitive values are removed before anything leaves the sealed zone.
- FFeatureA fixed schema of classes, likelihoods, confidence and UNKNOWN.
- AAdjudicateDisagreement between detectors is kept as data, not resolved by vote.
- OResearch-safe outputWhat a person or analysis model may see.
Rules that are never relaxed
- UNKNOWN is not PASS. A file that could not be read, a surface that does not exist, a signal that was not collected: each stays visible as what it is.
- No credential is ever validated. Detecting something credential-like never turns into trying it.
- Current public state only. The study does not excavate deleted history, caches or private state.
- Identity is destroyed before human review. Repository and account identity stay inside the sealed connector and are discarded after classification.
- Labels are locked before groups are revealed. Outcomes are classified first; organization strata are attached afterwards.
- Stop on critical. A plausible live secret creates an opaque disclosure ticket, and the pipeline digs no further.
- Repository text is data, never instructions. Content that reads like a prompt is classified, not obeyed.
- The verifier is part of the surface. Detectors, sanitizers, logs and reports are audited for leaks too.
Nine context classes
From paper 02. Sensitivity and risk are separate axes: a path can be concrete and harmless, an auth reference can be necessary documentation.
- C1Workstation / local path
- C2Runtime / tool topology
- C3Authentication / session context
- C4Private network / internal endpoint
- C5Live operational security state
- C6Organization / project relationship topology
- C7Personal / identity context
- C8Secret-like material
- C9Generated diagnostic context
Five levels of recoverability
From paper 03. Present or absent is too coarse for privacy.
- R0Not recoverable
- R1Weakly inferable
- R2Strongly inferable
- R3Directly reconstructable
- R4Literally present
Every record's path
- discovered
- eligible
- acquired
- normalized
- detected
- sanitized
- featured
- adjudicated
- sealed
- analysis-ready
Side states
- excluded
- UNKNOWN
- escalation required
- responsible disclosure
- pipeline failure
If your team writes agent instruction files
Practical consequences of the papers, for anyone maintaining AGENTS.md, CLAUDE.md, Cursor rules or Copilot instructions.
- Keep local context and shared context in different files, and keep the local one out of version control.
- Write paths relative to the project root and name environments by role, not by machine.
- Describe how authentication works; never where a session or token lives on one machine.
- Review the exact outgoing candidate — the commit, the package, the generated page — not only the scanner's report.
- Read back what actually reached the remote. A local PASS is not remote evidence.
- When a check cannot see a surface, record NOT MEASURED. Do not count it as a pass.