t2-p2-07draft4–7h
Data export with privacy handling
requires: t2-p2-06
Spec
A GDPR-style "export all my org's data" endpoint that explicitly handles soft-deleted records and other users' PII inside shared resources - for example comments authored by former members. Document the decisions in docs/privacy.md.
Why this matters
Export is where multi-tenancy meets privacy law, and the interesting cases are the ones with no clean answer. Deciding deliberately and writing it down is the skill; there is no correct answer to look up.
Verify
No result yet. Run `learn verify t2-p2-07` locally, or push to trigger CI.
contract
unrun
artifact
unrun
judge
unrun
Rubric
# t2-p2-07 — Data export with privacy handling
**Task:** A GDPR-style "export all my org's data" endpoint that explicitly handles soft-deleted records and other users' PII inside shared resources - for example comments authored by former members. Document the decisions in docs/privacy.md.
**Strong:** Directly answers every one of the review questions below in the affirmative, with specific evidence from the actual work, not a restatement of the task.
- Are ex-member comments and soft-deleted rows both addressed explicitly?
**Passing but weak:** The deliverable exists and technically satisfies the spec, but is generic, restates the task instructions instead of engaging with them, or only partially addresses the review questions below.
**Fails:** The deliverable is missing, or engages with none of the review questions below - e.g. it describes what was built without explaining the reasoning the task actually asks for.