Masking/Tokenization & GrASP: wire enforcement runtime (Chameleon crate + PDP + GrASP provider)

[mdheller]

Tracks the runtime "Next steps" from the 1SP Masking / Tokenization & GrASP design (spec-intake 2026-08-03) that are not buildable as a small PR. The contract layer is done and enforced: schemas + valid fixtures landed in #487; negative conformance (reject under-masked/ungoverned input) landed in #539. What remains is the code that executes those contracts.

1. Chameleon / key-evolving tokenization crate

Own implementation of the published primitive (sovereign posture — reimplement, do not vendor IBM product), backed by KMIP/PKCS#11 + HSM (key handles only, never material).
Acceptance:

• Deterministic in-domain pseudonym; provably not cross-domain-linkable (property test).
• Key-evolving rotation emits an epoch tweak that migrates tokens consistency-preservingly (no full re-tokenise; append-only ledger replay unbroken).
• Emits tokenization-profile.v1 + masking-decision.v1 conformant to the schemas.
• FIPS: SHA-256 authoritative for any hashing; HSM FIPS 140-2 L3.
• MIT/Apache-only deps.

2. Wire masking PDP into the Catalog Gateway read path (WKC-parity deliverable)

PDP at read/export/activation/re-identify time returns masking-decision.v1 (verdict + applied_transforms + re_identification + side_channel_mitigations + receipt), emitting BEACON_COMMIT.
Acceptance:

• Read/export/activate/re_identify each produce a schema-valid masking-decision.v1.
• no_health_adtech polytope veto returns deny + forbidden_mixture (health_adtech_deny fixture as golden).
• re_identify without reason-for-action is refused (negative fixture as golden).
• Every decision carries a verified-compute receipt (the moat vs WKC).

3. Adopt GrASP (open-source, adopt directly) as an extract.mentions.v1 provider

Interpretable extractor for claim/evidence/compliance/policy_trigger lanes; mine policy_trigger patterns for the CONSTRAINTS family.
Acceptance:

• GrASP matches emit source-record.mentions + human-readable feature_contributions.
• Patterns conform to grasp-pattern.v1 (empty feature_sets rejected — negative fixture as golden).
• Runs local-first on CITIZEN_FOG; CPU-light.

4. Bind audience-tagging tag_assignment to masking-decision

So subject ids are tokenized per realm.
Acceptance:

• tag_assignment references the governing masking-decision/tokenization-profile; cross-realm reuse blocked.

Companion refs: docs/architecture/masking-tokenization-and-grasp-extraction.md, Catalog Gateway PDP (prophet-platform/docs/strategy/PROPHET_DATA_CATALOG_DESIGN.md §5.2/§6.2).