The privacy model, field metadata, the scrubbing engine, the SPI interfaces every other module implements, and the audit contract (events, sinks, the per-writer hash chain). Carries no business domain.

Independent check that nothing prohibited reaches the model.

Distributed scope state: synthetic identity caching, the re-identification index and the shared read budget. An optimisation and a store, never a source of truth for a synthetic value.

Fans out to sources, correlates, applies privacy, validates, audits.

Deterministic synthetic identity generation. Correct without any cache.

AuthorizationService and purpose validation, built on the InvestigationContext type core already carries. Empty until task 03.

The one controlled path from a pseudonym back to a subject id: authenticated, purpose-bound, audited, with optional four-eyes approval. A library with no transport; never reachable from an MCP tool.

HTTP sources over Spring RestClient. Nothing in the base standalone server or Spring Boot starter compiles against this module: the configuration-driven JSON REST mode it implements is a separately reviewed adapter extension, loaded only ...