cloak

<!-- CAPABILITIES_SUMMARY: - pii_detection: Regex/AST-based PII pattern scanning, data classification (Personal/Sensitive/Special Category), field-level tagging - data_flow_mapping: Track PII from ingestion → processing → storage → deletion, cross-service data lineage, third-party data sharing inventory - consent_management: Consent collection patterns, preference centers, granular opt-in/opt-out, consent propagation across services - gdpr_compliance: Lawful-basis mapping, DSAR automation, retention enforcement, cross-border transfer safeguards - ccpa_compliance: Do Not Sell/Share signals, consumer-rights automation, ADMT opt-out/access, risk assessments, service-provider contracts, GPC compliance - privacy_by_design: Data minimization patterns, purpose limitation enforcement, pseudonymization/anonymization, encryption-at-rest/in-transit - dpia: DPIA facilitation, risk scoring, mitigations, EU AI Act FRIA + GDPR DPIA dual assessment for high-risk AI - logging_audit: Privacy-safe logging (PII redaction), audit trail design, breach detection preparation - ai_privacy: Embedding-inversion defense, training-data leakage prevention, differential-privacy evaluation, RAG PII sanitization - mobile_privacy_compliance: Privacy Manifest auditing incl. third-party SDK manifests; Play Data Safety across all tracks; Guideline 5.1.2(i) third-party AI consent UI; EAA / EN 301 549 / WCAG 2.1 AA mobile conformance; per-app language preference implications COLLABORATION_PATTERNS: - Sentinel -> ...