Improve AI privacy erasure propagation gates

[shensz2017]

Bounty type

Skill Improvement ($50-150 potential bounty)

Requested bounty tier: Moderate ($100)

Related review issue: #2069

Summary

This improves ai-data-privacy by adding explicit evidence gates for data subject erasure requests and consent withdrawals across AI-derived stores and model lineage.

The update covers source-to-derived artifact lineage for embeddings, vector chunks, prompt logs, training snapshots, evaluation datasets, provider-retained objects, backups, and affected model artifacts.

Changes

• Bump ai-data-privacy skill version to 1.0.1.
• Add Step 7 for erasure and consent-withdrawal propagation.
• Require deletion receipts, tombstones, reconciliation checks, training exclusion manifests, provider retention evidence, backup restore replay, and model/training decisions.
• Expand high-severity classification for erasure requests that do not propagate to AI-derived stores.
• Add reporting table for erasure propagation evidence.
• Add vulnerable and benign regression scenarios for missing vs. complete erasure propagation evidence.

Tests

Added scenario fixtures:

• tests/vulnerable/ai-data-privacy-erasure-missing-derived-store-reconciliation.yaml
• tests/benign/ai-data-privacy-erasure-propagated-with-receipts.yaml

Local validation performed:

• git diff --check
• verified required YAML keys in both new fixtures

Payment preference

GitHub Sponsors, if accepted.