feat: add commercial privacy artifact gate

scripts/commercial_privacy_artifact_scan.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""Commercial privacy artifact gate.
+
+This is a thin commercial wrapper around the existing public release privacy
+scanner. It exists so CI/product checks can call a business-named gate without
+duplicating privacy logic.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+
+from public_release_privacy_scan import build_report
+
+
+def commercial_report() -> dict[str, object]:
+    base = build_report()
+    return {
+        "scope": "commercial_privacy_artifact_scan",
+        "status": base["status"],
+        "finding_count": base["finding_count"],
+        "scanned_files": base["scanned_files"],
+        "privacy_boundary": "no_real_user_birth_data_private_cases_or_secret_values_in_public_artifacts",
+        "scanner_reuse": "scripts/public_release_privacy_scan.py",
+        "local_runtime_assets_not_committed": ["hip_main.dat", "hip_main.dat.download"],
+        "findings": base["findings"],
+    }
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--json", action="store_true", help="Emit JSON.")
+    args = parser.parse_args()
+    report = commercial_report()
+    if args.json:
+        print(json.dumps(report, ensure_ascii=False, indent=2, sort_keys=True))
+    else:
+        print(f"{report['status']}: {report['finding_count']} findings")
+    return 0 if report["status"] == "pass" else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_commercial_privacy_artifact_scan.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_commercial_privacy_scan_reuses_public_release_scanner() -> None:
+    source = (ROOT / "scripts/commercial_privacy_artifact_scan.py").read_text()
+    assert "from public_release_privacy_scan import build_report" in source
+    assert "no_real_user_birth_data_private_cases_or_secret_values_in_public_artifacts" in source
+    assert "hip_main.dat" in source
+
+
+def test_commercial_privacy_scan_json_contract_passes_current_tree() -> None:
+    completed = subprocess.run(
+        [sys.executable, "scripts/commercial_privacy_artifact_scan.py", "--json"],
+        cwd=ROOT,
+        text=True,
+        capture_output=True,
+        check=True,
+    )
+    report = json.loads(completed.stdout)
+    assert report["scope"] == "commercial_privacy_artifact_scan"
+    assert report["scanner_reuse"] == "scripts/public_release_privacy_scan.py"
+    assert report["status"] == "pass"
+    assert report["finding_count"] == 0
+    assert "hip_main.dat" in report["local_runtime_assets_not_committed"]