The privacy model, field metadata, the scrubbing engine, the SPI interfaces every other module implements, and the audit contract (events, sinks, the per-writer hash chain). Carries no business domain.