Separate envelope on its own endpoint + own sync cursor + own consent gate (never AttestationBatch — see D-0001 and wire_contract_carries_no_content_fields). Metadata-only by default (ids, status, guards, trailer keys + refs, content_hash); body/trailer content behind an explicit opt-in knob. Idempotent ingestion keyed by content_hash + sha; wipe-and-resync must reproduce cloud state. Exit: dashboard shows a decision's origination cost + >=1 guard event within 60s. Full design note: docs/zavet.md.
Separate envelope on its own endpoint + own sync cursor + own consent gate (never AttestationBatch — see D-0001 and wire_contract_carries_no_content_fields). Metadata-only by default (ids, status, guards, trailer keys + refs, content_hash); body/trailer content behind an explicit opt-in knob. Idempotent ingestion keyed by content_hash + sha; wipe-and-resync must reproduce cloud state. Exit: dashboard shows a decision's origination cost + >=1 guard event within 60s. Full design note: docs/zavet.md.