Principles
- Evidence first. Every finding points to the request and the exact location of the value.
- Honest confidence. Direct and heuristic evidence are separated, and each finding states how it could be wrong.
- Scope travels with the data. Capture details and blind spots are part of every file.
- Redacted by default. Values are shortened, URL query values removed, and cookie and authorization values are never exported.
Top level
| Field | Type | Description |
|---|---|---|
schema | string | Always nodal.findings/v0 |
generatedAt | ISO time | When the file was produced |
tool | object | Name and version of Trace Lab |
capture | object | Scenario, build, browser, HAR creator, request count, time range, first-party hosts, number of declared values |
scope | object | analysed and notAnalysed lists |
redacted | boolean | Whether values and URLs are redacted |
summary | object | Counts: requests, hosts, findings, direct, heuristic, by severity |
hosts[] | array | Every contacted host with category, basis, request count and worst severity |
findings[] | array | See below |
disclaimer | string | States that this is observed traffic, not proof |
Finding
| Field | Values | Description |
|---|---|---|
id | F01… | Stable within one file, ordered by severity |
severity | high · medium · low · info | Triage aid, see severity |
kind | wallet-address · tx-hash · ens-name · chain-id | What was found |
evidence | direct · heuristic | Direct = matches a declared value |
confidence | high · medium · low | For heuristics, e.g. EIP-55 checksummed = high |
value | string | Redacted unless exported unredacted |
forms | string[] | How it appeared: exact, lower-case, without 0x prefix… |
host, category, categoryBasis | string | Who received it and why it was classified that way |
triage | unreviewed · expected · unexpected · investigate | Your decision in Trace Lab |
reason, falsePositive | string | Why it appeared, and how it could be wrong |
occurrences[] | array | entry index in the HAR, method, redacted url, location (e.g. body.userId, query: uid, header: referer), form |
Example
Generated live from the synthetic sample by the same exporter Trace Lab uses.
Next: Observed Data Manifest Planned
The proposed nodal.manifest/v0 would summarise what Privacy CI observed for one build in named test scenarios: values, hosts, categories, whether the policy declared each flow, and what was not analysed. It reports only what was observed in those tests. A signature could show who published it; it could never prove that the app has no other behaviour. See Privacy CI.