Implement private Phase 7 stable Substitute planning

Priority Level

Medium

Task Summary

Implement the narrow private Phase 7 stable-Substitute profile only after its P0 contract, ownership, and operator gates are satisfied. The work is invocation-bounded and must preserve the existing public DataFrame Substitute behavior.

Governing record

As of 2026-09-01, this GitHub issue remains the governing tracker. No migration to Linear has been selected. Draft PR #253 remains linked to this issue.

The durable plan and cross-library relationship analysis are maintained outside the Anonymizer repository and must not be copied into the feature branch or PR diff:

• /root/kb/safe-synthesizer/raw/anonymizer-support-streaming/2026/09/01/anonymizer-phase-7-stable-substitute-plan.md
• /root/kb/safe-synthesizer/raw/anonymizer-support-streaming/2026/09/01/anonymizer-nss-relationship-semantics.md
• RFC review mirror

Frozen direction

• Narrow private A+C design: a small frozen role/constraint contract plus an independent executable reference model.
• All-pairs exact distinctness for v1.
• Phase 4 accounting remains separate from Phase 7 planner state, and Phase 4 remains the sole release authority.
• Public DataFrame Substitute behavior and Redact behavior remain unchanged.
• DataDesigner execution remains behind NddAdapter.run_workflow().
• Follow the approved P0-P8 dependency order and red/yellow/green gates.
• Estimated effort remains 34-54 focused engineering days, excluding approval, review, and CI latency.

P0 gate status

• Governing tracker decision recorded: issue #257 remains governing.
• Issue #257 is linked from PR #253.
• Durable planning and relationship artifacts are stored outside the Anonymizer branch and PR diff.
• The exact owner-controlled v1 semantic and execution contract is published and frozen.
• A named semantic owner explicitly approves the frozen semantic contract.
• A named execution owner explicitly approves the frozen execution contract.
• After both owner approvals, a separate operator checkpoint explicitly authorizes Phase 7 implementation.

The exact contract, both named owner approvals, and the subsequent separate operator checkpoint are recorded in issue comments. All P0 authorization gates are green; implementation must still follow the P0-P8 dependency order and each tier's test and promotion gates.

No contract loader, fixture, compiler, planner, runtime, public API, or production integration implementation may begin before every P0 gate above is complete.

Scope constraints

Do not publish graph or session APIs, add production Intake or OpenShell integration, weaken Redact, broaden the reviewed design, change public Substitute behavior, update the Google Doc as part of implementation, or call DataDesigner directly outside NddAdapter.run_workflow().

Start with the frozen semantic and execution contracts in the issue comments and the Phase 7 plan at /root/kb/safe-synthesizer/raw/anonymizer-support-streaming/2026/09/01/anonymizer-phase-7-stable-substitute-plan.md. Follow the P0-P8 gates and keep DataDesigner execution behind NddAdapter.run_workflow(); done means the private stable-Substitute profile is implemented without changing public DataFrame Substitute or Redact behavior.