Publish transparency tiers for traces and linked receipts #70

Outcome

Define and enforce the Dark, Pulse, Ledger, and Glass transparency tiers for traces and receipt links.

Current behavior

The platform stores conversations, ATIF traces, work jobs, and several receipt families, but visibility decisions remain distributed across surfaces. Public issues must not infer private work, while users need a predictable way to publish, restrict, export, and revoke linked artifacts.

Source: docs/episode-triage.md, episodes 228 and 272.

Contract

• Define each tier in user-facing and machine-readable documentation.
• Store the selected tier and authority snapshot on every eligible artifact link.
• Apply the same decision in issue timelines, changelog entries, project items, APIs, exports, and analytics.
• Keep the artifact's repository and account authority stronger than the selected tier.
• Support revocation without rewriting immutable receipts: remove access to the artifact while preserving a bounded tombstone.
• Record consent for any trace or code use beyond delivery, including training or licensing.

Acceptance criteria

• The same viewer receives the same visibility result across web, API, and export surfaces.
• A public issue can disclose that restricted evidence exists without revealing its contents or private source metadata.
• Revoking an artifact link removes access promptly and leaves an auditable tombstone.
• No tier can make a private repository, prompt, credential, or customer artifact public by implication.
• Documentation states the default and the exact effect of each tier.

Verification

Cover all tier and repository-visibility combinations, revocation, export, cache invalidation, and analytics redaction. Run focused tests and mix precommit.

Dependencies

Build on #10 and the exact-receipt timeline issue. The licensing project must reuse this policy.