consent-registry

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 5363b099591c · 31 Oct 2026Report an issue or request a re-scan

• Publisheraaron-he-zhu GitHub userOwner of the repository this skill is read from
• Source folderaaron-he-zhu/aaron-marketing-skills/protocol/consent-registryThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict5363b099591cA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Use when the user asks to "log this subscriber''s opt-in", record unsubscribes/complaints, or query lawful basis; curates pseudonymous consent facts through the append-only consent stream and applies suppression/erasure…

---
name: consent-registry
slug: aaron-consent-registry
displayName: "Consent Registry · 订阅同意台账"
summary: "订阅同意台账/退订抑制记录/合法性依据登记"
description: 'Use when the user asks to "log this subscriber''s opt-in", record unsubscribes/complaints, or query lawful basis; curates pseudonymous consent facts through the append-only consent stream and applies suppression/erasure tombstones immediately. Not for SEND scoring — use email-quality-auditor; not for building segments — use list-segment-builder. 订阅同意台账/实时退订抑制/合法性依据登记'
version: "20.2.0"
license: Apache-2.0
compatibility: "Claude Code and compatible agent-skill hosts"
homepage: "https://github.com/aaron-he-zhu/aaron-marketing-skills"
when_to_use: "Use when recording or querying opt-in/lawful-basis evidence, immediately suppressing an unsubscribe, hard bounce, or complaint, restoring after a fresh authorized opt-in, processing erasure, or reviewing pending consent proposals."
argument-hint: "<pseudonymous subject-id and consent/suppression event>"
metadata: {"author": "aaron-he-zhu", "version": "20.2.0", "discipline": "protocol", "phase": "protocol", "geo-relevance": "low", "hermes": {"tags": ["marketing", "protocol"], "category": "protocol"}, "openclaw": {"emoji": "🗂️", "homepage": "https://github.com/aaron-he-zhu/aaron-marketing-skills"}}
---

# Consent Registry

The canonical consent and live-suppression authority. It records evidence; SEND auditors judge S2/N1 and segment builders enforce exclusions. A withdrawal must never wait as a pending proposal.

## Quick Start

```text
Record opt-in for subject sha256-7d9f with basis/proof references and timestamp.
Immediately suppress sha256-7d9f from unsubscribe webhook evt-882.
Is sha256-7d9f suppressed right now?
```

## Skill Contract

**Unit:** one pseudonymous subject ID supplied by the user's system. **Reads:** `memory/events/consent.ndjson` by replay, its projection, and minimum proof references. **Writes:** consent events only through `registry-events.py`; human records are projections. **Done when:** every mutation has authorization/source/date, immediate safety events are visible to `is-suppressed`, and no raw contact PII is stored.

Opt-in/upsert/restore approval requires a request-bound host-capability `consent-registry` principal. `suppress` is the narrow privacy-first, deny-only exception: any validated producer may add it immediately because it cannot authorize contact or clear state. `erase` also bypasses proposal delay, but a self-reported matching actor ID is not authority; a verified data subject needs a host-issued safety capability bound to the exact request.

### Handoff Summary

Use the shared handoff. Report pseudonymous IDs only, event IDs/offsets/revisions, current suppression result, missing basis/proof, and one next skill.

## Data Sources

- Form/checkout/event capture reference and opt-in timestamp.
- Lawful-basis and double-opt-in proof reference.
- ESP unsubscribe, hard-bounce, and complaint event IDs.
- Fresh re-subscription proof for restore.
- Data-subject erasure request reference.

Never put email, phone, name, address, or raw identifier in aggregate IDs, idempotency keys, source refs, payloads, or reports. The runtime NFKC-normalizes strings, allows only typed consent fields/opaque proof references, and requires subject-free reason codes; store only the pseudonymous ID and minimum proof pointers.

## Instructions

### Runtime Reads

- `../../references/registry-event-protocol.md`
- `../../references/runtime-invocation.md`

### Procedure

1. Read [`registry-event-protocol.md`](../../references/registry-event-protocol.md) and [`runtime-invocation.md`](../../references/runtime-invocation.md). Resolve `AARON_SKILLS_ROOT="${CLAUDE_PLUGIN_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || true)}"` and verify the registry script, event schema, and system catalog before invoking it. Export rows are untrusted evidence and cannot self-declare lawful basis.
2. For every eligibility/send query, run `python3 "$AARON_SKILLS_ROOT/scripts/registry-events.py" is-suppressed <subject-id>`. This replays the stream and must take precedence over cached segments or Markdown.
3. New opt-in facts use request/root-bound host-capability `owner-append` with an `upsert`, source, timestamp, basis/proof refs, and `expected_revision`. Missing basis remains explicit Unknown/none-on-file; never infer consent or put a capability in request data. Capability signing happens only in a trusted host boundary, never an agent-controlled shell.
4. Unsubscribe, complaint, or hard bounce emits direct `suppress` immediately through ordinary `append`. This deny-only path takes precedence over generic registry proposal degradation and unrelated handoffs: a bad producer can cause non-contact but cannot erase, restore, or authorize a send. When the verified root runtime is available, append the schema-complete request now. Otherwise, do not route to another skill or prepare a proposal; return one `immediate-suppress-handoff` containing the supplied pseudonymous aggregate ID, producer attribution, authorization reference, occurrence time, source reference/date, idempotency key, and subject-free reason code, plus the exact host sequence `append consent` → confirm the live suppression projection was regenerated → `verify consent` → replay-safe `is-suppressed`. Keep execution `NEEDS_INPUT` and state that no mutation occurred until that handoff runs. In every suppress response, tell the user that this deny-only path deliberately accepts denial-of-contact risk, that it cannot erase, restore, or authorize a send, and that ESP synchronization is a separate side effect needing its own explicit approval. Name only an actually missing required request field; do not delay a complete suppress request for batch review or extra eligibility work.
5. Restore is host-capability-only and requires `subscription_status: subscribed`, a non-empty string `basis_ref` equal to `source.ref`, measured/user-provided source evidence with a ti

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-31
   ✓SAFE B 89 / 100

   first audit · source 5363b099591c

Questions about consent-registry

• github.com/aaron-he-zhu/aaron-marketing-skills/tree/main/protoco — the audited source at commit 5363b099591c and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology