privacy-opsec-suite

Use when you need to verify sessions are truly unlinkable. Owns linkability and session identity, not network egress or file metadata.

Use when you need the keystone anonymity threat model that the other privacy audits build on.

Use when a commit, PR, or branch must carry no AI or tooling trace before publishing.

Use to reduce the fingerprinting and uniqueness surface that could re-link anonymous users. Traffic timing and size belong to traffic-analysis-resistance.

Use when an anonymity or privacy leak is suspected and you need to triage, contain, scope the blast radius, and plan remediation without making it worse.

Use to find PII or identifiers leaking in logs, telemetry, errors, headers, or file metadata. Timing and size side channels go to traffic-analysis-resistance.

Use when a LEAK_REGISTER.md exists and you want its leaks fixed safely, each pinned with a regression test. Requires a register as input.

Use as a pre-merge gate that blocks egress, logging, identifiers, fingerprints, correlation, or weaker anonymity defaults. Anonymity twin of rigor:deep-review.

Use when privacy promises, the threat model, or opsec runbooks have drifted from code and you want them reconciled into the single source of truth.

Use when you want high-value privacy and trust features found and specified, each gated against the anonymity model. Discovery and specification only.

Use to vet dependencies for telemetry, phone-home behavior, and egress, for CVEs, and for build and lockfile integrity under an anonymity-hostile model.

Use when you need to prove no traffic escapes the proxy or Tor. Owns network egress and routing.

Use to reduce timing, size, and volume side channels and add padding or batching defaults. Header and TLS fingerprints belong to fingerprint-resistance.