CI deploy d3d1cf1

amanpay/agentic_orchestration/c4_evaluation.py

@@ -0,0 +1,321 @@
+"""PR C4 — system evaluation + tracked-artifact generation.
+
+Deterministic. Aggregates the honest C1/C2/C3 evidence, adds the C4 consent + required-processing
+model, and emits five tracked artifacts. Every artifact states, explicitly: implemented / simulated /
+design-only / not-implemented status; storage durability; identity assumptions; deletion limitations;
+DP-exhausted status; secure-aggregation design-only status; synthetic-data limitation; and that the
+whole agentic layer has no payment authority.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from typing import Dict, List, Optional
+
+from amanpay.agentic_orchestration.consent import (
+    ConsentError, ConsentStore, CONSENT_STATUSES, OPTIONAL_PURPOSES, POLICY_VERSION,
+    PURPOSE_KIND, PURPOSES, REQUIRED_PURPOSES, storage_consistency)
+from amanpay.agentic_orchestration.federated_status import federated_status, privacy_view
+from amanpay.federated_risk.simulation import DISCLAIMER, STATUS_LABELS
+from amanpay.storage.kv import reset_kv_for_tests
+
+_ART_DIR = os.path.join("docs", "agentic-risk", "artifacts")
+_VERSION = "c4-v2"
+_GENERATED_AT = 0
+
+DISCLAIMER_C4 = ("Advisory-only agentic layer. Consent governs the SHADOW behavioural model and the "
+                 "SIMULATED federated demo; required security processing is separate and is not an "
+                 "optional consent. Nothing here has payment authority or can override the "
+                 "deterministic policy engine or Payment Core.")
+
+SYNTHETIC_NOTE = ("Engineering evaluation on synthetic data; not evidence of real-world "
+                  "fraud-detection performance.")
+
+
+def _read(name: str) -> Optional[Dict]:
+    path = os.path.join(_ART_DIR, name)
+    if not os.path.exists(path):
+        return None
+    try:
+        return json.load(open(path, encoding="utf-8"))
+    except Exception:
+        return None
+
+
+def _classifications() -> Dict:
+    """The honesty block embedded in every artifact."""
+    return {
+        "federation": STATUS_LABELS["federation"],                 # SIMULATED
+        "secure_aggregation": STATUS_LABELS["secure_aggregation"], # DESIGN_ONLY
+        "differential_privacy": STATUS_LABELS["differential_privacy"],  # SIMULATED
+        "real_device_training": STATUS_LABELS["real_device_training"],  # NOT_IMPLEMENTED
+        "native_local_only_training": "NOT_IMPLEMENTED",
+        "client_type": "SYNTHETIC_SERVER_SIMULATION",
+        "differential_privacy_budget_exhausted": bool(privacy_view().get("budget_exhausted", True)),
+        "storage_durability": storage_consistency(),
+        "identity_assumptions": "Subject is the authenticated principal (Bearer-token subject); "
+                                "clients cannot select another subject.",
+        "deletion_limitations": "Eligible-scope deletion of derived/optional data + a minimal "
+                                "non-sensitive tombstone; NOT perfect erasure or machine unlearning.",
+        "synthetic_data_limitation": SYNTHETIC_NOTE,
+        "no_payment_authority": True,
+        "automatic_model_promotion": False,
+    }
+
+
+def _envelope(artifact: str, commit: str, **extra) -> Dict:
+    base = {"artifact": artifact, "version": _VERSION, "implementation_commit": commit,
+            "generated_at": _GENERATED_AT, "affects_payment": False,
+            "classifications": _classifications()}
+    base.update(extra)
+    return base
+
+
+# ---- artifacts ---- #
+def consent_model_artifact(commit: str) -> Dict:
+    return _envelope(
+        "c4_consent_model", commit,
+        purposes=[{"name": p, "purpose_kind": PURPOSE_KIND[p], "withdrawable": p in OPTIONAL_PURPOSES}
+                  for p in PURPOSES],
+        required_processing=list(REQUIRED_PURPOSES),
+        optional_consent=list(OPTIONAL_PURPOSES),
+        consent_statuses=list(CONSENT_STATUSES),
+        required_state="active",
+        integrity={"profile_generation": "increments on deletion; stale generation rejected",
+                   "record_version": "monotonic; never resets for the subject lifetime",
+                   "optimistic_concurrency": "expected_version / expected_generation compare-and-set",
+                   "idempotency": "request_id replay-safe; reuse with a different payload rejected",
+                   "binding": ["subject", "purpose", "generation", "expected_version",
+                               "policy_version", "request_id", "timestamp"]},
+        rules=[
+            "required security processing is NOT optional consent and cannot be withdrawn here",
+            "optional purposes default to not_granted (explicit opt-in; no silent enrolment)",
+            "personalization and federation are independent — one never implies the other",
+            "withdrawal takes effect immediately; pre-withdrawal/previous-generation updates rejected",
+            "profile deletion is eligible-scope (not perfect erasure or machine unlearning)",
+            "consent has no payment authority and cannot override the deterministic PDP",
+        ],
+        policy_version=POLICY_VERSION, disclaimer=DISCLAIMER_C4)
+
+
+def privacy_report_artifact(commit: str) -> Dict:
+    return _envelope(
+        "c4_privacy_report", commit,
+        differential_privacy=privacy_view(),
+        secure_aggregation=STATUS_LABELS["secure_aggregation"],
+        data_categories={
+            "device_authentication": "Secure confirmation only; biometric templates stay on the device.",
+            "derived_behavioural_features": "Non-identifying features used by the SHADOW model only.",
+            "consent_records": "Per-subject purpose states/statuses + versions + bounded audit trail.",
+        },
+        retention={
+            "required_security_processing_records": "Retained (payment security/fraud/integrity/obligations).",
+            "derived_behavioural_and_optional_learning": "Deleted on eligible-scope profile deletion.",
+            "deletion_tombstone": "Minimal, non-sensitive (retired generation, last version, audit ref).",
+            "raw_iban_or_keys": "Never stored in the agentic layer.",
+        },
+        deletion={"endpoint": "DELETE /ai/v1/profile", "type": "eligible_scope_deletion",
+                  "not_perfect_erasure": True, "not_machine_unlearning": True,
+                  "deleted_categories": ["derived_behavioural_features", "optional_personalization_state",
+                                         "pending_optional_federated_updates", "raw_model_input"],
+                  "retained_categories": ["required_security_processing_records",
+                                          "minimal_deletion_tombstone"],
+                  "cross_user_isolation": True, "idempotent": True},
+        data_leaves_device={"real_federated_updates": False, "real_user_data_used": False,
+                            "claim_data_stays_on_device": False,
+                            "note": "Federation is a synthetic server-side simulation; there is no real "
+                                    "device training, so no 'data stays on your device' claim is made."},
+        disclaimer=DISCLAIMER)
+
+
+def system_evaluation_artifact(commit: str) -> Dict:
+    c1 = _read("risk_baseline.json") or {}
+    fed = _read("federated_simulation.json") or {}
+    cand = _read("federated_model_candidate.json") or {}
+    priv = privacy_view()
+
+    logreg = (c1.get("aggregate_stability") or {}).get("logreg", {})
+    rules = (c1.get("aggregate_stability") or {}).get("rules", {})
+    c1_pr = (logreg.get("pr_auc") or {}).get("mean")
+    rules_pr = (rules.get("pr_auc") or {}).get("mean")
+    per_seed0 = (fed.get("per_seed") or [{}])[0]
+    fed_fedavg = (per_seed0.get("federated") or {}).get("fedavg", {})
+    fed_c1 = per_seed0.get("centralized_c1", {})
+
+    phases = {
+        "behavioural_c1": {
+            "model": c1.get("primary_model", "logreg"),
+            "pr_auc_mean_synthetic": c1_pr, "reference_baseline": c1.get("reference_baseline", "rules"),
+            "reference_pr_auc_mean_synthetic": rules_pr,
+            "beats_rules_in_synthetic_eval": bool(c1_pr and rules_pr and c1_pr > rules_pr),
+            "metric_caveat": SYNTHETIC_NOTE,
+            "shadow_only": True, "affects_payment": False,
+        },
+        "orchestration_c2": {
+            "agents": ["context", "risk", "auth_recommender", "rail", "explanation"],
+            "risk_role": "advisory (shadow) into the deterministic PDP",
+            "invariants": ["agents cannot override a deny", "agents cannot weaken step-up",
+                           "only Payment Core initiates", "replay blocked"],
+            "affects_payment": False,
+        },
+        "federated_c3": {
+            "client_type": "SYNTHETIC_SERVER_SIMULATION",
+            "fedavg_pr_auc_synthetic": fed_fedavg.get("pr_auc"),
+            "centralized_c1_pr_auc_synthetic": fed_c1.get("pr_auc"),
+            "metric_caveat": SYNTHETIC_NOTE,
+            "candidate_status": cand.get("status", "candidate"),
+            "candidate_promotable": False,
+            "differential_privacy": priv["differential_privacy"],
+            "dp_budget_exhausted": priv["budget_exhausted"],
+            "candidate_privacy_eligibility": priv["candidate_privacy_eligibility"],
+            "affects_payment": False,
+        },
+        "consent_c4": {
+            "purpose_kinds": {p: PURPOSE_KIND[p] for p in PURPOSES},
+            "required_is_not_consent": True,
+            "optional_defaults_opt_in": True, "withdrawal_supported": True,
+            "immediate_withdrawal_enforced": True,
+            "profile_generation_and_versioning": True,
+            "eligible_scope_deletion": True, "principal_bound_identity": True,
+            "cross_user_isolation": True, "affects_payment": False,
+        },
+    }
+    invariants = {
+        "no_ai_payment_authority": True,
+        "pdp_authoritative": True,
+        "shadow_model_advisory_only": True,
+        "required_processing_not_optional_consent": True,
+        "federation_simulated_not_real": STATUS_LABELS["federation"] == "SIMULATED",
+        "secure_aggregation_design_only": STATUS_LABELS["secure_aggregation"] == "DESIGN_ONLY",
+        "differential_privacy_simulated": STATUS_LABELS["differential_privacy"] == "SIMULATED",
+        "dp_budget_exhausted_surfaced": bool(priv["budget_exhausted"]),
+        "candidate_not_privacy_eligible": priv["candidate_privacy_eligibility"] == "ineligible",
+        "no_auto_promotion": True,
+        "consent_opt_in": True,
+        "identity_bound_to_principal": True,
+        "deletion_is_eligible_scope_only": True,
+    }
+    return _envelope("c4_system_evaluation", commit, phases=phases, invariants=invariants,
+                     disclaimer=DISCLAIMER_C4,
+                     notes=[SYNTHETIC_NOTE,
+                            "The whole agentic stack (C1-C4) is advisory; the deterministic engine and "
+                            "Payment Core remain the only authority over money.",
+                            "An exhausted simulated DP budget is not a production privacy guarantee."])
+
+
+def threat_model_artifact(commit: str) -> Dict:
+    threats = [
+        {"id": "C4-T1", "threat": "Consent bypass — behavioural model personalises without opt-in",
+         "mitigation": "Optional purposes default not_granted; has_consent() fails closed.",
+         "tests": ["test_default_status_opt_in", "test_has_consent_gates_personalization"]},
+        {"id": "C4-T2", "threat": "Required processing misrepresented as optional consent",
+         "mitigation": "purpose_kind=required_processing; state=active (not 'granted'); cannot be "
+                       "modified via /consent.",
+         "tests": ["test_required_is_not_optional_consent", "test_cannot_modify_required_processing"]},
+        {"id": "C4-T3", "threat": "Cross-user read/modify/delete via spoofed subject",
+         "mitigation": "Subject derived from Bearer-token; body/query user_id that differs -> 403.",
+         "tests": ["test_principal_binding", "test_body_user_id_substitution_rejected",
+                   "test_cross_user_delete_isolated"]},
+        {"id": "C4-T4", "threat": "Stale/replayed pre-deletion consent or update accepted",
+         "mitigation": "profile_generation retired on deletion; stale generation rejected; "
+                       "assert_update_allowed rejects pre-withdrawal/previous-generation updates.",
+         "tests": ["test_previous_generation_update_rejected", "test_pre_withdrawal_update_rejected",
+                   "test_reenrollment_new_generation"]},
+        {"id": "C4-T5", "threat": "Idempotency-key reuse / version rollback / concurrent conflict",
+         "mitigation": "request_id replay-safe; reuse with different payload rejected; "
+                       "expected_version/generation compare-and-set.",
+         "tests": ["test_request_id_reuse_conflict", "test_stale_version_conflict",
+                   "test_concurrent_grant_withdraw_conflict"]},
+        {"id": "C4-T6", "threat": "Deletion overclaimed as perfect erasure / deletes payment records",
+         "mitigation": "erasure_type=eligible_scope_deletion; retained categories listed; payment "
+                       "records not in deletable scope.",
+         "tests": ["test_deletion_is_eligible_scope", "test_deletion_does_not_touch_payment_records"]},
+        {"id": "C4-T7", "threat": "Federated/DP status shown as real/healthy/compliant",
+         "mitigation": "SYNTHETIC_SERVER_SIMULATION; DP SIMULATED + budget exhausted; candidate "
+                       "privacy-ineligible; no 'data stays on device' claim.",
+         "tests": ["test_federated_status_fields", "test_dp_exhausted_surfaced",
+                   "test_no_data_stays_on_device_claim"]},
+        {"id": "C4-T8", "threat": "Consent used to influence a payment decision",
+         "mitigation": "No Payment-Core / PDP / capability imports; affects_payment always False.",
+         "tests": ["test_consent_module_has_no_payment_imports", "test_consent_api_no_payment_authority"]},
+    ]
+    return _envelope("c4_threat_model", commit, threats=threats, disclaimer=DISCLAIMER_C4)
+
+
+def _run_conformance_checks() -> List[Dict]:
+    reset_kv_for_tests()
+    s = ConsentStore()
+    checks: List[Dict] = []
+
+    def record(cid: str, desc: str, ok: bool):
+        checks.append({"id": cid, "check": desc, "result": "PASS" if ok else "FAIL"})
+
+    st = s.status("u1", now=1.0)
+    record("C4-C1", "optional purposes default not_granted (opt-in)",
+           st["purposes"]["optional_personalization"]["status"] == "not_granted")
+    record("C4-C2", "required processing reported as required_processing/active (not consent)",
+           st["purposes"]["service_essential"]["purpose_kind"] == "required_processing"
+           and st["purposes"]["service_essential"]["state"] == "active")
+
+    r = s.set_consent("u1", "optional_personalization", True, request_id="r1", now=2.0)
+    record("C4-C3", "grant sets granted + bumps version",
+           r["purposes"]["optional_personalization"]["status"] == "granted"
+           and r["personalization_enabled"])
+
+    try:
+        s.set_consent("u1", "service_essential", False, request_id="r2", now=3.0)
+        req_ok = False
+    except ConsentError as e:
+        req_ok = str(e) == "cannot_modify_required_processing"
+    record("C4-C4", "required processing cannot be modified via consent", req_ok)
+
+    try:
+        s.set_consent("u1", "optional_personalization", True, request_id="r1b",
+                      expected_version=999, now=4.0)
+        cas_ok = False
+    except ConsentError as e:
+        cas_ok = str(e) == "version_conflict"
+    record("C4-C5", "stale expected_version -> version_conflict", cas_ok)
+
+    gen_before = s.current_generation("u1", now=5.0)
+    s.delete_profile("u1", request_id="d1", now=5.0)
+    gen_after = s.current_generation("u1", now=6.0)
+    record("C4-C6", "deletion retires the generation (monotonic, no reuse)", gen_after > gen_before)
+
+    try:
+        s.assert_update_allowed("u1", "optional_personalization", generation=gen_before, now=6.0)
+        stale_ok = False
+    except ConsentError:
+        stale_ok = True
+    record("C4-C7", "previous-generation update rejected after deletion", stale_ok)
+
+    fs = federated_status()
+    record("C4-C8", "federated status SIMULATED/synthetic + DP exhausted + not promotable",
+           fs["client_type"] == "SYNTHETIC_SERVER_SIMULATION" and fs["candidate_promotable"] is False
+           and fs["differential_privacy_detail"]["budget_exhausted"] is True
+           and fs["affects_payment_authorization"] is False)
+
+    record("C4-C9", "consent status carries no payment authority",
+           s.status("u1", now=7.0)["affects_payment"] is False)
+
+    return checks
+
+
+def conformance_artifact(commit: str) -> Dict:
+    checks = _run_conformance_checks()
+    passed = sum(1 for c in checks if c["result"] == "PASS")
+    return _envelope("c4_conformance", commit, checks=checks,
+                     summary={"total": len(checks), "passed": passed, "failed": len(checks) - passed,
+                              "conformant": passed == len(checks)},
+                     disclaimer=DISCLAIMER_C4)
+
+
+def generate_c4_artifacts(commit: str) -> Dict[str, Dict]:
+    return {
+        "c4_consent_model.json": consent_model_artifact(commit),
+        "c4_privacy_report.json": privacy_report_artifact(commit),
+        "c4_system_evaluation.json": system_evaluation_artifact(commit),
+        "c4_threat_model.json": threat_model_artifact(commit),
+        "c4_conformance.json": conformance_artifact(commit),
+    }

amanpay/agentic_orchestration/consent.py

@@ -0,0 +1,372 @@
+"""PR C4 — consent + required-processing model for the agentic/behavioural layer.
+
+Honest separation of THREE purposes with an explicit ``purpose_kind``:
+
+  * ``service_essential``        — **required_processing**. Processing required for payment security,
+                                   fraud prevention, service integrity and applicable obligations.
+                                   NOT an optional consent toggle; cannot be withdrawn through the
+                                   personalization interface. Subject to documented purpose,
+                                   minimisation, retention and legal review.
+  * ``optional_personalization`` — **optional_consent**. Opt-in; starts not_granted; withdrawable
+                                   independently. Lets the SHADOW behavioural model personalise.
+  * ``optional_federation``      — **optional_consent**. Opt-in; starts not_granted; withdrawable
+                                   independently; never implied by personalization consent. Nominal
+                                   inclusion in the SIMULATED federated demo (synthetic clients only).
+
+Required processing is never shown as "consent granted".
+
+Integrity model (replay / ordering / deletion):
+  * A monotonic ``record_version`` (never resets for the life of a subject) + a ``profile_generation``
+    that increments on deletion. Every mutation binds subject, purpose, generation, expected version,
+    policy version, request id and timestamp.
+  * Optimistic concurrency: ``expected_version`` / ``expected_generation`` compare-and-set. Idempotency:
+    a repeated ``request_id`` returns the same safe result; a reused ``request_id`` with a different
+    payload is rejected.
+  * Deletion erases eligible derived/optional-learning data and leaves a minimal non-sensitive
+    tombstone (retired generation + last version + audit reference) so stale/previous-generation
+    updates are rejected and re-enrolment never collides with a deleted generation.
+
+Advisory only: consent/required-processing has **no payment authority** and cannot override the
+deterministic PDP or Payment Core. Storage durability is reported honestly (in-process MemoryKV vs
+Redis) — no distributed-atomicity claims.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import time
+from typing import Dict, List, Optional, Tuple
+
+from amanpay.storage.kv import get_kv, kv_backend
+
+# ---- vocabulary ---- #
+PURPOSES = ("service_essential", "optional_personalization", "optional_federation")
+REQUIRED_PURPOSES = ("service_essential",)
+OPTIONAL_PURPOSES = ("optional_personalization", "optional_federation")
+PURPOSE_KIND = {
+    "service_essential": "required_processing",
+    "optional_personalization": "optional_consent",
+    "optional_federation": "optional_consent",
+}
+CONSENT_STATUSES = ("not_granted", "granted", "withdrawn")   # optional_consent states
+REQUIRED_STATE = "active"                                    # required_processing state (NOT consent)
+POLICY_VERSION = "c4-policy-v1"
+
+_KEY = "consent:{subject}"
+_TOMB = "consent:tomb:{subject}"
+_HISTORY_CAP = 50
+_IDEMPOTENCY_CAP = 50
+_NAMESPACE = "ai.consent.v2"
+
+# Categories used in deletion receipts (honest, non-sensitive labels).
+DELETABLE_CATEGORIES = ("derived_behavioural_features", "optional_personalization_state",
+                        "pending_optional_federated_updates", "raw_model_input")
+RETAINED_CATEGORIES = ("required_security_processing_records", "minimal_deletion_tombstone")
+
+
+class ConsentError(ValueError):
+    """Normalised, non-sensitive consent failure reason."""
+
+
+def _now(now: Optional[float]) -> float:
+    return float(now) if now is not None else time.time()
+
+
+def _clean_subject(subject: str) -> str:
+    if not isinstance(subject, str) or not subject.strip():
+        raise ConsentError("invalid_subject")
+    return subject.strip()
+
+
+def _payload_hash(purpose: str, grant: bool) -> str:
+    return hashlib.sha256(f"{purpose}|{int(grant)}".encode()).hexdigest()[:16]
+
+
+def storage_consistency() -> Dict:
+    """Honest description of the durability/atomicity actually available — no over-claiming."""
+    backend = kv_backend()
+    if backend == "redis":
+        return {"backend": "redis",
+                "atomicity": "single_key_atomic_ops",
+                "consent_writes": "optimistic_read_modify_write",  # store uses get/set, not distributed CAS
+                "durable_multi_replica": False,
+                "note": "Redis provides atomic single-key ops; the consent store uses optimistic "
+                        "read-modify-write, so mutations are not distributed compare-and-set."}
+    return {"backend": "memory",
+            "atomicity": "in_process_only",
+            "consent_writes": "optimistic_in_process",
+            "durable_multi_replica": False,
+            "note": "MemoryKV is per-process and ephemeral; no cross-replica consistency or durability."}
+
+
+def _default_purposes(now: float) -> Dict:
+    return {
+        "service_essential": {"kind": "required_processing", "state": REQUIRED_STATE,
+                              "version": 1, "updated_at": now},
+        "optional_personalization": {"kind": "optional_consent", "status": "not_granted",
+                                     "version": 0, "updated_at": now},
+        "optional_federation": {"kind": "optional_consent", "status": "not_granted",
+                                "version": 0, "updated_at": now},
+    }
+
+
+class ConsentStore:
+    """Per-subject consent + required-processing over the shared KV. Subject MUST be an authenticated
+    principal (never a client-supplied user id). No Payment-Core / PDP / capability access."""
+
+    def __init__(self) -> None:
+        self._kv = get_kv()
+
+    # ---- low-level ---- #
+    def _load(self, subject: str, now: float) -> Optional[Dict]:
+        rec = self._kv.get(_KEY.format(subject=subject), now=now)
+        return rec if isinstance(rec, dict) else None
+
+    def _load_tomb(self, subject: str, now: float) -> Optional[Dict]:
+        t = self._kv.get(_TOMB.format(subject=subject), now=now)
+        return t if isinstance(t, dict) else None
+
+    def _save(self, rec: Dict, now: float) -> None:
+        rec["updated_at"] = now
+        self._kv.set(_KEY.format(subject=rec["subject"]), rec, now=now)
+
+    def _new_record(self, subject: str, now: float) -> Dict:
+        """Fresh record. If a deletion tombstone exists, start in the NEXT generation and continue the
+        monotonic record_version so versions never collide with the retired generation."""
+        tomb = self._load_tomb(subject, now)
+        generation = (int(tomb["retired_generation"]) + 1) if tomb else 1
+        start_version = (int(tomb["last_record_version"]) + 1) if tomb else 1
+        return {
+            "namespace": _NAMESPACE, "subject": subject, "policy_version": POLICY_VERSION,
+            "profile_generation": generation, "record_version": start_version,
+            "created_at": now, "updated_at": now,
+            "purposes": _default_purposes(now),
+            "history": [{"event": "created", "generation": generation,
+                         "record_version": start_version, "at": now, "actor": "system"}],
+            "idempotency": {},
+        }
+
+    # ---- read ---- #
+    def status(self, subject: str, now: Optional[float] = None,
+               include_generation: bool = True) -> Dict:
+        """Safe status view. Required processing is reported with purpose_kind=required_processing and
+        state=active (never as consent). Optional purposes carry status + version."""
+        subject = _clean_subject(subject)
+        now = _now(now)
+        rec = self._load(subject, now) or self._new_record(subject, now)
+        purposes = {}
+        for p in PURPOSES:
+            meta = rec["purposes"][p]
+            if PURPOSE_KIND[p] == "required_processing":
+                purposes[p] = {"purpose_kind": "required_processing", "state": meta.get("state", REQUIRED_STATE),
+                               "withdrawable": False, "version": meta["version"], "updated_at": meta["updated_at"]}
+            else:
+                purposes[p] = {"purpose_kind": "optional_consent", "status": meta["status"],
+                               "withdrawable": True, "version": meta["version"], "updated_at": meta["updated_at"]}
+        out = {
+            "subject": subject,
+            "policy_version": rec.get("policy_version", POLICY_VERSION),
+            "record_version": rec["record_version"],
+            "purposes": purposes,
+            "personalization_enabled": rec["purposes"]["optional_personalization"]["status"] == "granted",
+            "federation_enrolled": rec["purposes"]["optional_federation"]["status"] == "granted",
+            # honest "personalization without shared learning" derived flag
+            "personalization_without_shared_learning":
+                rec["purposes"]["optional_personalization"]["status"] == "granted"
+                and rec["purposes"]["optional_federation"]["status"] != "granted",
+            "affects_payment": False,
+            "authoritative": False,
+            "storage_consistency": storage_consistency(),
+            "label": "Advisory only · required security processing is separate from optional learning",
+        }
+        if include_generation:
+            # generation is developer-safe metadata (not necessarily surfaced to ordinary customers)
+            out["profile_generation"] = rec["profile_generation"]
+        return out
+
+    def has_consent(self, subject: str, purpose: str, now: Optional[float] = None) -> bool:
+        """Is an OPTIONAL purpose currently granted? Required processing always applies (returns True);
+        unknown purpose -> False (fail-closed)."""
+        if purpose not in PURPOSES:
+            return False
+        if purpose in REQUIRED_PURPOSES:
+            return True
+        subject = _clean_subject(subject)
+        rec = self._load(subject, _now(now))
+        return bool(rec) and rec["purposes"][purpose]["status"] == "granted"
+
+    def current_generation(self, subject: str, now: Optional[float] = None) -> int:
+        subject = _clean_subject(subject)
+        rec = self._load(subject, _now(now))
+        if rec:
+            return int(rec["profile_generation"])
+        tomb = self._load_tomb(subject, _now(now))
+        return (int(tomb["retired_generation"]) + 1) if tomb else 1
+
+    # ---- write ---- #
+    def set_consent(self, subject: str, purpose: str, grant: bool, *, request_id: str,
+                    expected_generation: Optional[int] = None, expected_version: Optional[int] = None,
+                    policy_version: str = POLICY_VERSION, now: Optional[float] = None,
+                    actor: str = "user") -> Dict:
+        """Grant/withdraw ONE optional purpose with optimistic concurrency + idempotency.
+
+        Errors (normalised): unknown_purpose, cannot_modify_required_processing, invalid_request_id,
+        idempotency_key_reuse, generation_mismatch, version_conflict.
+        """
+        subject = _clean_subject(subject)
+        if purpose not in PURPOSES:
+            raise ConsentError("unknown_purpose")
+        if PURPOSE_KIND[purpose] == "required_processing":
+            # required processing is not a consent toggle — neither grant nor withdraw
+            raise ConsentError("cannot_modify_required_processing")
+        if not isinstance(request_id, str) or not request_id.strip():
+            raise ConsentError("invalid_request_id")
+        now = _now(now)
+        rec = self._load(subject, now) or self._new_record(subject, now)
+
+        # idempotency: same request_id + same payload -> replay the safe result; different -> reject
+        idem = rec.get("idempotency", {})
+        phash = _payload_hash(purpose, grant)
+        if request_id in idem:
+            if idem[request_id].get("payload_hash") == phash:
+                return self.status(subject, now)
+            raise ConsentError("idempotency_key_reuse")
+
+        # optimistic concurrency
+        if expected_generation is not None and int(expected_generation) != int(rec["profile_generation"]):
+            raise ConsentError("generation_mismatch")
+        if expected_version is not None and int(expected_version) != int(rec["record_version"]):
+            raise ConsentError("version_conflict")
+
+        pmeta = rec["purposes"][purpose]
+        pmeta["status"] = "granted" if grant else "withdrawn"
+        pmeta["version"] = int(pmeta["version"]) + 1
+        pmeta["updated_at"] = now
+        rec["record_version"] = int(rec["record_version"]) + 1
+        rec["policy_version"] = policy_version
+
+        # withdrawal takes effect immediately: drop any pending optional payload for this purpose
+        if not grant:
+            self._deactivate_optional(subject, purpose)
+
+        self._bind_history(rec, {"event": "consent_change", "purpose": purpose,
+                                 "status": pmeta["status"], "grant": grant, "request_id": request_id,
+                                 "policy_version": policy_version, "actor": actor}, now)
+        self._remember_request(rec, request_id, phash, rec["record_version"])
+        self._save(rec, now)
+        return self.status(subject, now)
+
+    def assert_update_allowed(self, subject: str, purpose: str, generation: int,
+                              now: Optional[float] = None) -> None:
+        """Gate for an OPTIONAL profile/federated update prepared earlier and submitted now. Rejects
+        it if the purpose is no longer granted or the generation is stale (pre-deletion). Enforces
+        immediate withdrawal + previous-generation rejection."""
+        subject = _clean_subject(subject)
+        now = _now(now)
+        if purpose not in OPTIONAL_PURPOSES:
+            raise ConsentError("unknown_purpose")
+        rec = self._load(subject, now)
+        if rec is None:
+            raise ConsentError("stale_generation")
+        if int(generation) != int(rec["profile_generation"]):
+            raise ConsentError("stale_generation")
+        if rec["purposes"][purpose]["status"] != "granted":
+            raise ConsentError("consent_withdrawn")
+
+    def delete_profile(self, subject: str, *, request_id: Optional[str] = None,
+                       now: Optional[float] = None, reason: str = "user_request",
+                       actor: str = "user") -> Dict:
+        """Delete eligible derived behavioural/optional-learning data. Retains only required
+        security records and a minimal non-sensitive deletion tombstone. Retires the generation so
+        stale/previous-generation updates are rejected and re-enrolment starts fresh. Idempotent.
+
+        This is eligible-scope deletion, NOT perfect erasure or machine unlearning.
+        """
+        subject = _clean_subject(subject)
+        now = _now(now)
+        rec = self._load(subject, now)
+        existing_tomb = self._load_tomb(subject, now)
+
+        if rec is None:
+            # already deleted (or never existed) -> idempotent no-op receipt
+            if existing_tomb:
+                return self._deletion_receipt(subject, existing_tomb, deleted_now=False)
+            retired_generation, last_version = 0, 0
+        else:
+            retired_generation = int(rec["profile_generation"])
+            last_version = int(rec["record_version"])
+
+        # Erase eligible optional/derived payloads. Required-processing records are NOT touched here.
+        for key in (f"behavprofile:{subject}", f"fedpending:{subject}",
+                    f"personalization:{subject}"):
+            try:
+                self._kv.delete(key)
+            except Exception:
+                pass
+
+        audit_ref = hashlib.sha256(f"{subject}|{retired_generation}|{now}".encode()).hexdigest()[:16]
+        tomb = {
+            "namespace": _NAMESPACE, "subject": subject,
+            "retired_generation": retired_generation,
+            "last_record_version": last_version,
+            "deleted_at": now, "audit_ref": audit_ref, "reason": reason,
+            "deleted_categories": list(DELETABLE_CATEGORIES),
+            "retained_categories": list(RETAINED_CATEGORIES),
+            "policy_version": POLICY_VERSION,
+        }
+        # Remove the behavioural record; keep only the minimal tombstone.
+        try:
+            self._kv.delete(_KEY.format(subject=subject))
+        except Exception:
+            pass
+        self._kv.set(_TOMB.format(subject=subject), tomb, now=now)
+        return self._deletion_receipt(subject, tomb, deleted_now=rec is not None)
+
+    @staticmethod
+    def _deletion_receipt(subject: str, tomb: Dict, deleted_now: bool) -> Dict:
+        return {
+            "subject": subject,
+            "profile": "deleted",
+            "deleted_now": deleted_now,
+            "deleted_categories": tomb["deleted_categories"],
+            "retained_categories": tomb["retained_categories"],
+            "retention_reason": "Required for payment security, fraud prevention, service integrity "
+                                "and applicable obligations; plus a minimal deletion audit record.",
+            "retired_generation": tomb["retired_generation"],
+            "deleted_at": tomb["deleted_at"],
+            "audit_reference": tomb["audit_ref"],
+            "personalization_enabled": False,
+            "federation_enrolled": False,
+            "affects_payment": False,
+            "erasure_type": "eligible_scope_deletion",   # NOT perfect erasure / machine unlearning
+            "note": "Deletes eligible derived behavioural and optional-learning profile data while "
+                    "retaining only required payment/security records and a minimal non-sensitive "
+                    "deletion audit record. Not perfect erasure or machine unlearning.",
+        }
+
+    # ---- helpers ---- #
+    def _deactivate_optional(self, subject: str, purpose: str) -> None:
+        key = {"optional_personalization": f"personalization:{subject}",
+               "optional_federation": f"fedpending:{subject}"}.get(purpose)
+        if key:
+            try:
+                self._kv.delete(key)
+            except Exception:
+                pass
+
+    def _bind_history(self, rec: Dict, entry: Dict, now: float) -> None:
+        bound = {**entry, "subject": rec["subject"], "generation": rec["profile_generation"],
+                 "record_version": rec["record_version"], "at": now}
+        hist = rec.setdefault("history", [])
+        hist.append(bound)
+        if len(hist) > _HISTORY_CAP:
+            del hist[: len(hist) - _HISTORY_CAP]
+
+    @staticmethod
+    def _remember_request(rec: Dict, request_id: str, payload_hash: str, record_version: int) -> None:
+        idem = rec.setdefault("idempotency", {})
+        idem[request_id] = {"payload_hash": payload_hash, "record_version": record_version}
+        if len(idem) > _IDEMPOTENCY_CAP:
+            for k in list(idem.keys())[: len(idem) - _IDEMPOTENCY_CAP]:
+                del idem[k]

amanpay/agentic_orchestration/consent_api.py

@@ -0,0 +1,152 @@
+"""PR C4 — consent, profile-deletion and federated-status HTTP surface (/ai/v1).
+
+Endpoint classification:
+  * Authenticated customer (subject derived from the Bearer token — NEVER from a client-supplied
+    user id): GET /profile/status, POST /consent, DELETE /profile, GET /consent/history.
+  * Authenticated-safe / demo-gated aggregate: GET /federated/status.
+  * Static safe policy metadata (no thresholds/coefficients/feature defs): GET /consent/model.
+
+None of these can move money, mint capabilities, change the PDP, or expose scores/thresholds/keys/
+raw IBANs. Identity is bound to the authenticated principal; a client cannot select another subject.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import time
+import uuid
+from typing import Dict, Optional
+
+from fastapi import APIRouter, Body, HTTPException, Request
+
+from amanpay.agentic_orchestration.consent import (
+    ConsentError, ConsentStore, OPTIONAL_PURPOSES, POLICY_VERSION, PURPOSE_KIND,
+    PURPOSES, REQUIRED_PURPOSES, storage_consistency)
+from amanpay.agentic_orchestration.federated_status import federated_status
+from api.auth import require_auth, verify_token
+
+router = APIRouter(prefix="/ai/v1", tags=["agentic-consent"])
+
+_CLIENT_ERRORS = {
+    "unknown_purpose", "cannot_modify_required_processing", "invalid_request_id",
+    "idempotency_key_reuse", "generation_mismatch", "version_conflict", "invalid_subject",
+    "stale_generation", "consent_withdrawn",
+}
+# Idempotency-key reuse / version-generation conflicts are 409; other client faults are 422.
+_CONFLICT = {"idempotency_key_reuse", "generation_mismatch", "version_conflict"}
+
+
+def _store() -> ConsentStore:
+    return ConsentStore()
+
+
+def _principal(request: Request, claimed_user_id: Optional[str] = None) -> str:
+    """Authoritative subject = the Bearer token's subject. A client can NEVER select another subject.
+
+    * Valid token -> its subject. If the body/query also claims a user_id that differs -> 403.
+    * No/invalid token -> 401 (consent is inherently per-user; there is no anonymous consent).
+      Even when AMANPAY_REQUIRE_AUTH is off (public demo), the subject still comes from the token
+      minted at sign-in; unauthenticated callers cannot read or mutate anyone's consent.
+    """
+    auth = request.headers.get("authorization", "")
+    token = auth[7:].strip() if auth.lower().startswith("bearer ") else None
+    subject = verify_token(token) if token else None
+    if not subject:
+        raise HTTPException(status_code=401, detail="authentication required")
+    if claimed_user_id is not None and str(claimed_user_id).strip() and str(claimed_user_id) != subject:
+        # never honour a client-selected subject that isn't the authenticated principal
+        raise HTTPException(status_code=403, detail="subject does not match authenticated principal")
+    return subject
+
+
+def _raise(exc: ConsentError):
+    reason = str(exc)
+    code = 409 if reason in _CONFLICT else (422 if reason in _CLIENT_ERRORS else 400)
+    raise HTTPException(status_code=code, detail=reason)
+
+
+# ---- authenticated customer endpoints ---- #
+@router.get("/profile/status")
+def profile_status(request: Request) -> Dict:
+    """This authenticated user's consent + required-processing status (safe view)."""
+    subject = _principal(request)
+    try:
+        return _store().status(subject)
+    except ConsentError as exc:
+        _raise(exc)
+
+
+@router.post("/consent")
+def set_consent(request: Request, body: dict = Body(...)) -> Dict:
+    """Grant/withdraw ONE optional purpose. Required processing cannot be changed here.
+    Body: {purpose, grant, request_id?, expected_version?, expected_generation?, policy_version?}."""
+    subject = _principal(request, body.get("user_id"))
+    purpose = body.get("purpose")
+    grant = body.get("grant")
+    if purpose not in PURPOSES:
+        raise HTTPException(status_code=422, detail="unknown_purpose")
+    if purpose in REQUIRED_PURPOSES:
+        raise HTTPException(status_code=422, detail="cannot_modify_required_processing")
+    if not isinstance(grant, bool):
+        raise HTTPException(status_code=422, detail="grant_must_be_boolean")
+    request_id = (body.get("request_id") or request.headers.get("idempotency-key")
+                  or f"auto-{uuid.uuid4().hex[:16]}")
+    try:
+        return _store().set_consent(
+            subject, purpose, grant, request_id=request_id,
+            expected_generation=body.get("expected_generation"),
+            expected_version=body.get("expected_version"),
+            policy_version=body.get("policy_version", POLICY_VERSION))
+    except ConsentError as exc:
+        _raise(exc)
+
+
+@router.delete("/profile")
+def delete_profile(request: Request, body: Optional[dict] = Body(default=None)) -> Dict:
+    """Delete eligible behavioural/optional-learning profile data for the authenticated user.
+    Required security records + a minimal deletion tombstone are retained."""
+    subject = _principal(request, (body or {}).get("user_id"))
+    request_id = ((body or {}).get("request_id") or request.headers.get("idempotency-key")
+                  or f"del-{uuid.uuid4().hex[:16]}")
+    try:
+        return _store().delete_profile(subject, request_id=request_id)
+    except ConsentError as exc:
+        _raise(exc)
+
+
+# ---- safe aggregate / demo-gated ---- #
+@router.get("/federated/status")
+def get_federated_status() -> Dict:
+    return federated_status()
+
+
+# ---- static safe policy metadata ---- #
+@router.get("/consent/model")
+def consent_model() -> Dict:
+    """Static, safe policy metadata only. Exposes NO thresholds, coefficients, feature definitions,
+    client identifiers or raw audit payloads."""
+    return {
+        "purposes": [{"name": p, "purpose_kind": PURPOSE_KIND[p],
+                      "withdrawable": p in OPTIONAL_PURPOSES,
+                      "default": ("active" if p in REQUIRED_PURPOSES else "not_granted")}
+                     for p in PURPOSES],
+        "purpose_kinds": {"required_processing": "Required for payment security, fraud prevention, "
+                          "service integrity and applicable obligations; not an optional toggle.",
+                          "optional_consent": "Opt-in; starts not_granted; withdrawable independently."},
+        "statuses": {"required_processing": ["active"],
+                     "optional_consent": ["not_granted", "granted", "withdrawn"]},
+        "rules": [
+            "required security processing is not optional consent and cannot be withdrawn here",
+            "optional purposes default to not_granted (explicit opt-in; no silent enrolment)",
+            "personalization and federation are independent — one never implies the other",
+            "every mutation binds subject, purpose, generation, expected version, policy, request id",
+            "withdrawal takes effect immediately; pre-withdrawal/previous-generation updates are rejected",
+            "profile deletion is eligible-scope (not perfect erasure or machine unlearning)",
+            "consent has no payment authority and cannot override the deterministic PDP",
+        ],
+        "policy_version": POLICY_VERSION,
+        "storage_consistency": storage_consistency(),
+        "affects_payment": False,
+        "generated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(0)),
+    }

amanpay/agentic_orchestration/federated_status.py

@@ -0,0 +1,88 @@
+"""PR C4 — honest, non-authoritative federated-learning status.
+
+Surfaces the C3 SIMULATION truthfully. There are NO real devices and NO real user training, so we do
+NOT claim "data never leaves your device". Instead we report explicit, unambiguous statuses:
+
+  * client_type: SYNTHETIC_SERVER_SIMULATION       (synthetic clients, server-side only)
+  * real_device_training: NOT_IMPLEMENTED
+  * native_local_only_training: NOT_IMPLEMENTED
+  * real_user_data_used: false
+  * secure_aggregation: DESIGN_ONLY
+  * differential_privacy: SIMULATED (+ exhausted budget surfaced honestly)
+  * automatic_model_promotion: false
+  * affects_payment_authorization: false
+
+The simulated DP budget is reported as exhausted when the C3 accountant says so, and the candidate is
+reported ineligible for promotion — an exhausted simulated budget is never shown as healthy/approved.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from typing import Dict, Optional
+
+from amanpay.federated_risk.simulation import DISCLAIMER, STATUS_LABELS
+
+_ART_DIR = os.path.join("docs", "agentic-risk", "artifacts")
+
+
+def _read(name: str) -> Optional[Dict]:
+    path = os.path.join(_ART_DIR, name)
+    if not os.path.exists(path):
+        return None
+    try:
+        return json.load(open(path, encoding="utf-8"))
+    except Exception:
+        return None
+
+
+def privacy_view() -> Dict:
+    """Honest DP view from the C3 privacy artifact. An exhausted simulated budget is surfaced as
+    such and marks the candidate privacy-ineligible."""
+    pr = _read("federated_privacy_report.json") or {}
+    exhausted = bool(pr.get("exhausted", True))
+    return {
+        "differential_privacy": STATUS_LABELS.get("differential_privacy", "SIMULATED"),
+        "accountant": pr.get("accountant", "basic_composition (conservative, non-tight)"),
+        "cumulative_epsilon": pr.get("cumulative_epsilon"),
+        "budget_epsilon": pr.get("budget_epsilon"),
+        "budget_exhausted": exhausted,
+        "candidate_privacy_eligibility": "ineligible" if exhausted else "eligible_simulated",
+        "production_privacy_guarantee": False,
+        "note": "SIMULATED privacy accounting only. An exhausted simulated budget is not a production "
+                "privacy guarantee and does not indicate compliance.",
+    }
+
+
+def federated_status() -> Dict:
+    cand = _read("federated_model_candidate.json") or {}
+    priv = privacy_view()
+    out: Dict = {
+        # explicit, unambiguous statuses (no "data stays on your device" claim)
+        "client_type": "SYNTHETIC_SERVER_SIMULATION",
+        "real_device_training": STATUS_LABELS.get("real_device_training", "NOT_IMPLEMENTED"),
+        "native_local_only_training": "NOT_IMPLEMENTED",
+        "real_user_data_used": False,
+        "federation": STATUS_LABELS.get("federation", "SIMULATED"),
+        "secure_aggregation": STATUS_LABELS.get("secure_aggregation", "DESIGN_ONLY"),
+        "differential_privacy": priv["differential_privacy"],
+        "differential_privacy_detail": priv,
+        "automatic_model_promotion": False,
+        "affects_payment_authorization": False,
+        "affects_pdp": False,
+        "affects_authentication": False,
+        "affects_payment_execution": False,
+        "no_payment_authority": True,
+        "candidate_status": cand.get("status", "candidate"),
+        "candidate_promotable": False,          # never auto-promoted; simulated + budget exhausted
+        "promotion_boundary": cand.get("promotion_boundary", "approved_for_shadow"),
+        "disclaimer": DISCLAIMER,
+        "label": "SIMULATED federated learning · synthetic server-side clients · no payment authority",
+    }
+    # coarse, non-identifying facts if available
+    sim = _read("federated_simulation.json")
+    if sim:
+        per_seed = sim.get("per_seed") or []
+        out["aggregators"] = sorted(list((per_seed[0].get("federated") if per_seed else {}) or {}))
+    return out

api/main.py

@@ -146,6 +146,10 @@ app.include_router(agent_security_router)
 from amanpay.agentic_orchestration.api import router as ai_router  # noqa: E402
 app.include_router(ai_router)
 
+# Consent, profile-deletion and federated-status surface (/ai/v1 — advisory only, no payment authority).
+from amanpay.agentic_orchestration.consent_api import router as consent_router  # noqa: E402
+app.include_router(consent_router)
+
 
 _ROOT = os.path.dirname(os.path.dirname(__file__))
 _FRONTEND = os.path.join(_ROOT, "frontend", "index.html")           # legacy (rollback)

build_info.json

@@ -1 +1 @@
-{"commit":"f7e2045","build_time":"2026-07-14T00:53:35Z","frontend":"1.0.0"}
+{"commit":"d3d1cf1","build_time":"2026-07-14T01:50:52Z","frontend":"1.0.0"}

web/e2e/agentic-ux.spec.ts

@@ -36,6 +36,54 @@ async function mockApi(page: Page) {
   await page.route('**/ai/v1/models/status', (r) => r.fulfill(json({ behavioural_model: 'logreg', model_version: 'v1', feature_version: 'features-v1', reason_codes_version: 'reason_codes-v1', shadow_only: true, affects_payment: false, label: 'DEMO ONLY · Mock provider · No real-money payment' })))
   await page.route('**/ai/v1/demo/payee', (r) => r.fulfill(json({ payee_ref: 'payee_demo', display: 'SA03 **** 7519' })))
   await page.route('**/ai/v1/demo/orchestrate', (r) => r.fulfill(json(orchestrateResult(r.request().postDataJSON() ?? {}))))
+  // C4: consent + federated status. Subject is the authenticated principal (token); the mock keeps
+  // in-memory state keyed by a single demo subject so grant/withdraw/delete is observable.
+  const consent: Record<string, string> = {}
+  let version = 3
+  const meta = (purpose: string) =>
+    purpose === 'service_essential'
+      ? { purpose_kind: 'required_processing', withdrawable: false, state: 'active', version: 1, updated_at: 1 }
+      : { purpose_kind: 'optional_consent', withdrawable: true, status: consent[purpose] ?? 'not_granted', version: 1, updated_at: 1 }
+  const profile = () => {
+    const pers = consent['optional_personalization'] ?? 'not_granted'
+    const fed = consent['optional_federation'] ?? 'not_granted'
+    return {
+      subject: 'demo', policy_version: 'c4-policy-v1', record_version: version, profile_generation: 1,
+      purposes: { service_essential: meta('service_essential'), optional_personalization: meta('optional_personalization'), optional_federation: meta('optional_federation') },
+      personalization_enabled: pers === 'granted', federation_enrolled: fed === 'granted',
+      personalization_without_shared_learning: pers === 'granted' && fed !== 'granted',
+      affects_payment: false, authoritative: false,
+      storage_consistency: { backend: 'memory', durable_multi_replica: false, note: 'ephemeral' },
+      label: 'Advisory only',
+    }
+  }
+  await page.route('**/ai/v1/profile/status', (r) => r.fulfill(json(profile())))
+  await page.route('**/ai/v1/consent', (r) => {
+    const b = r.request().postDataJSON() ?? {}
+    consent[b.purpose] = b.grant ? 'granted' : 'withdrawn'
+    version += 1
+    return r.fulfill(json(profile()))
+  })
+  await page.route('**/ai/v1/profile', (r) => {
+    delete consent['optional_personalization']; delete consent['optional_federation']; version += 1
+    return r.fulfill(json({ subject: 'demo', profile: 'deleted', deleted_now: true,
+      deleted_categories: ['derived_behavioural_features', 'optional_personalization_state'],
+      retained_categories: ['required_security_processing_records', 'minimal_deletion_tombstone'],
+      retention_reason: 'required', retired_generation: 1, audit_reference: 'abc123',
+      erasure_type: 'eligible_scope_deletion', affects_payment: false, note: 'eligible-scope' }))
+  })
+  await page.route('**/ai/v1/federated/status', (r) => r.fulfill(json({
+    client_type: 'SYNTHETIC_SERVER_SIMULATION', real_device_training: 'NOT_IMPLEMENTED',
+    native_local_only_training: 'NOT_IMPLEMENTED', real_user_data_used: false,
+    federation: 'SIMULATED', secure_aggregation: 'DESIGN_ONLY', differential_privacy: 'SIMULATED',
+    differential_privacy_detail: { differential_privacy: 'SIMULATED', budget_exhausted: true,
+      candidate_privacy_eligibility: 'ineligible', cumulative_epsilon: 38.76, budget_epsilon: 8,
+      production_privacy_guarantee: false, note: 'simulated only' },
+    automatic_model_promotion: false, affects_payment_authorization: false,
+    candidate_status: 'candidate', candidate_promotable: false,
+    disclaimer: 'Server-side simulation using synthetic clients; not real cross-device federated learning.',
+    label: 'SIMULATED', aggregators: ['coordinate_median', 'fedavg', 'trimmed_mean'],
+  })))
 }
 
 test.beforeEach(async ({ page }) => { await mockApi(page) })
@@ -189,6 +237,119 @@ test('21. unknown route shows a safe not-found screen', async ({ page }) => {
   await expect(page.getByText(/Page not found/i)).toBeVisible()
 })
 
+test('23. required security row is informational (no toggle, not "granted consent")', async ({ page }, info) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await expect(page.getByTestId('required-state')).toHaveText('Active')
+  await expect(page.getByTestId('consent-toggle-service_essential')).toHaveCount(0)
+  await expect(page.getByTestId('consent-service_essential')).not.toContainText(/granted/i)
+  await shot(page, 'security-required', info.project.name)
+})
+
+test('24. personalization and federation are separate opt-ins; one never grants the other', async ({ page }, info) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await expect(page.getByTestId('consent-state-optional_personalization')).toHaveText('Not granted')
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Not granted')
+  await page.getByTestId('consent-toggle-optional_personalization').click()
+  await expect(page.getByTestId('consent-state-optional_personalization')).toHaveText('Granted')
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Not granted')  // NOT granted
+  await expect(page.getByTestId('pwsl')).toBeVisible()   // personalization without shared learning
+  await shot(page, 'consent-personalization', info.project.name)
+})
+
+test('25. granting federation does not alter payment; personalization stays independent', async ({ page }, info) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await page.getByTestId('consent-toggle-optional_federation').click()
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Granted')
+  await expect(page.getByTestId('consent-state-optional_personalization')).toHaveText('Not granted')
+  // withdrawing federation leaves personalization independently configurable
+  await page.getByTestId('consent-toggle-optional_federation').click()
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Not granted')
+  await shot(page, 'consent-federation', info.project.name)
+})
+
+test('26. federated status: synthetic server simulation, DP simulated+exhausted, secure-agg design-only', async ({ page }, info) => {
+  await page.goto('/#/security')
+  await expect(page.getByTestId('fed-label-client_type')).toHaveText('SYNTHETIC_SERVER_SIMULATION')
+  await expect(page.getByTestId('fed-label-secure_aggregation')).toHaveText('DESIGN_ONLY')
+  await expect(page.getByTestId('fed-label-real_device_training')).toHaveText('NOT_IMPLEMENTED')
+  await expect(page.getByTestId('dp-exhausted')).toContainText(/budget is exhausted/i)
+  await expect(page.getByTestId('fed-no-authority')).toContainText(/No payment authority/i)
+  // no "data stays on device" claim anywhere on the page
+  await expect(page.locator('body')).not.toContainText(/stays only on your (phone|device)|never leaves your device/i)
+  await shot(page, 'security-federated', info.project.name)
+})
+
+test('27. delete profile lists eligible-deleted + retained-required, resets optional state', async ({ page }, info) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await page.getByTestId('consent-toggle-optional_federation').click()
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Granted')
+  page.once('dialog', (d) => d.accept())
+  await page.getByTestId('consent-delete').click()
+  await expect(page.getByText(/eligible behavioural profile data was deleted/i)).toBeVisible()
+  const receipt = page.getByTestId('deletion-receipt')
+  await expect(receipt).toContainText(/derived_behavioural_features/)
+  await expect(receipt).toContainText(/required_security_processing_records/)
+  await expect(receipt).toContainText(/not perfect erasure or machine unlearning/i)
+  await expect(page.getByTestId('consent-state-optional_federation')).toHaveText('Not granted')  // reset
+  await shot(page, 'consent-deleted', info.project.name)
+})
+
+test('28. re-enrollment works after deletion', async ({ page }) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  page.once('dialog', (d) => d.accept())
+  await page.getByTestId('consent-delete').click()
+  await expect(page.getByTestId('deletion-receipt')).toBeVisible()
+  await page.getByTestId('consent-toggle-optional_personalization').click()
+  await expect(page.getByTestId('consent-state-optional_personalization')).toHaveText('Granted')
+})
+
+test('29. no raw feature/client-id/weight/coefficient/capability leaks on Security', async ({ page }) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await expect(page.getByTestId('federated-status')).toBeVisible()
+  const body = (await page.locator('body').textContent()) ?? ''
+  expect(body).not.toMatch(/coefficient|feature_vector|CapabilityGrant|ExecutionCapability|BEGIN [A-Z ]*PRIVATE KEY|608010167519/)
+})
+
+test('30. shared-learning demo explains the simulation honestly (synthetic, not promotable)', async ({ page }, info) => {
+  await page.goto('/#/demo/federated-learning')
+  await expect(page.getByRole('heading', { name: /Shared-learning demo/i })).toBeVisible()
+  await expect(page.getByText('Shadow mode').first()).toBeVisible()
+  await expect(page.getByText(/not real cross-device training/i)).toBeVisible()
+  await expect(page.getByTestId('fed-not-promotable')).toContainText(/not promotable/i)
+  await expect(page.getByTestId('fed-synthetic')).toContainText(/no real user data is used/i)
+  await shot(page, 'federated-demo', info.project.name)
+})
+
+test('31. Arabic consent + deletion wording renders', async ({ page }, info) => {
+  await signIn(page)
+  await page.getByRole('button', { name: 'العربية' }).click()
+  await goHash(page, '#/security')
+  await expect(page.getByTestId('required-state')).toHaveText('مُفعَّلة')                          // required processing = Active (AR)
+  await expect(page.getByTestId('consent-service_essential')).toContainText('معالجة الأمان المطلوبة')  // required security processing
+  await expect(page.getByTestId('consent-optional_personalization')).toContainText('التخصيص الاختياري') // optional personalization
+  await shot(page, 'arabic-consent', info.project.name)
+  page.once('dialog', (d) => d.accept())
+  await page.getByTestId('consent-delete').click()
+  await expect(page.getByTestId('deletion-receipt')).toBeVisible()
+  await shot(page, 'arabic-deletion', info.project.name)
+})
+
+test('32. payment journey is unchanged by consent selections', async ({ page }) => {
+  await signIn(page)
+  await goHash(page, '#/security')
+  await page.getByTestId('consent-toggle-optional_personalization').click()
+  await expect(page.getByTestId('consent-state-optional_personalization')).toHaveText('Granted')
+  await walkToReview(page)                       // full staged journey still works
+  await expect(page.getByTestId('stage-review')).toBeVisible()
+  await expect(page.getByText(/SA03 \*\*\*\* \*\*\*\* 7519/)).toBeVisible()
+})
+
 test('22. Arabic payment review renders', async ({ page }, info) => {
   await signIn(page)
   await page.goto('/#/home')

web/src/App.tsx

@@ -6,6 +6,7 @@ import { HomePage } from './pages/HomePage'
 import { SecurityPage } from './pages/SecurityPage'
 import { BiometricsLabPage } from './pages/BiometricsLabPage'
 import { AgenticDemoPage } from './pages/AgenticDemoPage'
+import { FederatedDemoPage } from './pages/FederatedDemoPage'
 import { ActivityPage } from './pages/ActivityPage'
 import { BiometricsDashboard } from './pages/BiometricsDashboard'
 import { BiometricEnrollPage } from './pages/BiometricEnrollPage'
@@ -21,7 +22,7 @@ import { Button } from './components/ui'
 import { AGENTIC_DEMO_ENABLED } from './api/ai'
 
 const ROUTES = [
-  'home', 'pay', 'security', 'activity', 'demo/agentic-security', 'biometrics/lab',
+  'home', 'pay', 'security', 'activity', 'demo/agentic-security', 'demo/federated-learning', 'biometrics/lab',
   'enroll', 'biometrics', 'biometrics/enroll', 'biometrics/verify',
   'biometrics/liveness', 'biometrics/reportcard', 'biometrics/oob', 'results', 'notfound',
 ] as const
@@ -76,6 +77,7 @@ export function App() {
         <nav aria-label="Primary" className="desktop-nav">
           {PRIMARY.map((p) => <span key={p.route}>{tab(p.route, t(p.key as never))}</span>)}
           {AGENTIC_DEMO_ENABLED && tab('demo/agentic-security', t('nav.demo'))}
+          {AGENTIC_DEMO_ENABLED && tab('demo/federated-learning', t('nav.federatedDemo'))}
           {tab('biometrics/lab', t('nav.lab'))}
         </nav>
         <div className="topbar-right">
@@ -89,6 +91,7 @@ export function App() {
         {route === 'pay' && <PayPage onNavEnroll={() => nav('enroll')} onNav={(r) => nav(r)} />}
         {route === 'security' && <SecurityPage onNav={(r) => nav(r)} />}
         {route === 'demo/agentic-security' && <AgenticDemoPage />}
+        {route === 'demo/federated-learning' && <FederatedDemoPage />}
         {route === 'biometrics/lab' && <BiometricsLabPage onNav={(r) => nav(r)} />}
         {route === 'activity' && <ActivityPage />}
         {route === 'enroll' && <EnrollPage />}
@@ -106,6 +109,9 @@ export function App() {
           {AGENTIC_DEMO_ENABLED && (
             <button role="menuitem" className="more-item" onClick={() => { setMoreOpen(false); nav('demo/agentic-security') }}>{t('nav.demo')}</button>
           )}
+          {AGENTIC_DEMO_ENABLED && (
+            <button role="menuitem" className="more-item" onClick={() => { setMoreOpen(false); nav('demo/federated-learning') }}>{t('nav.federatedDemo')}</button>
+          )}
           <button role="menuitem" className="more-item" onClick={() => { setMoreOpen(false); nav('biometrics/lab') }}>{t('nav.lab')}</button>
         </div>
       )}

web/src/api/ai.ts

@@ -65,10 +65,107 @@ export interface ScenarioInput {
   now?: number
 }
 
+// ---- C4: consent, profile deletion, federated status (advisory only, no payment authority) ---- //
+// Identity is the authenticated principal (the session token's subject) — the client never sends a
+// user_id. Every mutation carries a fresh request_id (idempotency) and the last-known record_version
+// (optimistic concurrency); a 409 means a newer decision exists, so the caller refetches.
+export type ConsentPurpose = 'service_essential' | 'optional_personalization' | 'optional_federation'
+export type PurposeKind = 'required_processing' | 'optional_consent'
+export type ConsentStatus = 'not_granted' | 'granted' | 'withdrawn'
+
+export interface PurposeMeta {
+  purpose_kind: PurposeKind
+  withdrawable: boolean
+  version: number
+  updated_at: number
+  status?: ConsentStatus   // optional_consent only
+  state?: string           // required_processing only ('active')
+}
+
+export interface ProfileStatus {
+  subject: string
+  policy_version: string
+  record_version: number
+  profile_generation?: number
+  purposes: Record<ConsentPurpose, PurposeMeta>
+  personalization_enabled: boolean
+  federation_enrolled: boolean
+  personalization_without_shared_learning: boolean
+  affects_payment: boolean
+  authoritative: boolean
+  storage_consistency: { backend: string; durable_multi_replica: boolean; note: string }
+  label: string
+}
+
+export interface DifferentialPrivacyDetail {
+  differential_privacy: string
+  budget_exhausted: boolean
+  candidate_privacy_eligibility: string
+  cumulative_epsilon?: number | null
+  budget_epsilon?: number | null
+  production_privacy_guarantee: boolean
+  note: string
+}
+
+export interface FederatedStatus {
+  client_type: string
+  real_device_training: string
+  native_local_only_training: string
+  real_user_data_used: boolean
+  federation: string
+  secure_aggregation: string
+  differential_privacy: string
+  differential_privacy_detail: DifferentialPrivacyDetail
+  automatic_model_promotion: boolean
+  affects_payment_authorization: boolean
+  candidate_status: string
+  candidate_promotable: boolean
+  disclaimer: string
+  label: string
+  aggregators?: string[]
+}
+
+export interface DeleteProfileResult {
+  subject: string
+  profile: string
+  deleted_now: boolean
+  deleted_categories: string[]
+  retained_categories: string[]
+  retention_reason: string
+  retired_generation: number
+  audit_reference: string
+  erasure_type: string
+  affects_payment: boolean
+  note: string
+}
+
+function requestId(): string {
+  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto
+  return c?.randomUUID ? c.randomUUID() : `req-${Date.now()}-${Math.random().toString(16).slice(2)}`
+}
+
 export function modelStatus(signal?: AbortSignal): Promise<ModelStatus> {
   return apiRequest<ModelStatus>('/ai/v1/models/status', { signal })
 }
 
+export function profileStatus(signal?: AbortSignal): Promise<ProfileStatus> {
+  return apiRequest<ProfileStatus>('/ai/v1/profile/status', { signal })
+}
+
+export function setConsent(purpose: ConsentPurpose, grant: boolean, expectedVersion?: number, signal?: AbortSignal): Promise<ProfileStatus> {
+  return apiRequest<ProfileStatus>('/ai/v1/consent', {
+    body: { purpose, grant, request_id: requestId(), expected_version: expectedVersion }, signal,
+  })
+}
+
+export function deleteProfile(signal?: AbortSignal): Promise<DeleteProfileResult> {
+  return apiRequest<DeleteProfileResult>('/ai/v1/profile', { method: 'DELETE', body: { request_id: requestId() }, signal })
+}
+
+export function federatedStatus(signal?: AbortSignal): Promise<FederatedStatus> {
+  return apiRequest<FederatedStatus>('/ai/v1/federated/status', { signal })
+}
+
 export function demoPayee(iban: string, signal?: AbortSignal): Promise<{ payee_ref: string; display: string }> {
   return apiRequest('/ai/v1/demo/payee', { body: { iban }, signal })
 }

web/src/components/ConsentControls.test.tsx

@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { render, screen, waitFor, fireEvent } from '@testing-library/react'
+import { I18nProvider } from '../i18n'
+import { ConsentControls } from './ConsentControls'
+import * as ai from '../api/ai'
+import { ApiRequestError } from '../api/client'
+
+vi.mock('../api/ai')
+
+function mkStatus(over: Partial<Record<ai.ConsentPurpose, Partial<ai.PurposeMeta>>> = {}): ai.ProfileStatus {
+  const opt = (status: ai.ConsentStatus, version: number): ai.PurposeMeta =>
+    ({ purpose_kind: 'optional_consent', withdrawable: true, status, version, updated_at: 1 })
+  const req: ai.PurposeMeta = { purpose_kind: 'required_processing', withdrawable: false, state: 'active', version: 1, updated_at: 1 }
+  const purposes = {
+    service_essential: { ...req, ...(over.service_essential ?? {}) },
+    optional_personalization: { ...opt('not_granted', 0), ...(over.optional_personalization ?? {}) },
+    optional_federation: { ...opt('not_granted', 0), ...(over.optional_federation ?? {}) },
+  } as ai.ProfileStatus['purposes']
+  return {
+    subject: 'alice', policy_version: 'c4-policy-v1', record_version: 3, profile_generation: 1,
+    purposes,
+    personalization_enabled: purposes.optional_personalization.status === 'granted',
+    federation_enrolled: purposes.optional_federation.status === 'granted',
+    personalization_without_shared_learning:
+      purposes.optional_personalization.status === 'granted' && purposes.optional_federation.status !== 'granted',
+    affects_payment: false, authoritative: false,
+    storage_consistency: { backend: 'memory', durable_multi_replica: false, note: 'ephemeral' },
+    label: 'Advisory only',
+  }
+}
+
+const renderCtl = () => render(<I18nProvider initial="en"><ConsentControls /></I18nProvider>)
+
+describe('ConsentControls', () => {
+  beforeEach(() => { vi.spyOn(ai, 'profileStatus').mockResolvedValue(mkStatus()) })
+  afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals() })
+
+  it('shows required processing as informational (no toggle, not "granted consent")', async () => {
+    renderCtl()
+    await screen.findByTestId('consent-service_essential')
+    expect(screen.getByTestId('required-state')).toHaveTextContent('Active')
+    expect(screen.getByText('Required')).toBeInTheDocument()
+    expect(screen.queryByTestId('consent-toggle-service_essential')).toBeNull()
+    // required processing must not be labelled as granted consent
+    expect(screen.getByTestId('consent-service_essential').textContent).not.toMatch(/granted/i)
+  })
+
+  it('optional purposes default to not-granted (opt-in)', async () => {
+    renderCtl()
+    expect(await screen.findByTestId('consent-state-optional_personalization')).toHaveTextContent('Not granted')
+    expect(screen.getByTestId('consent-state-optional_federation')).toHaveTextContent('Not granted')
+  })
+
+  it('granting personalization sends expected_version and reflects the new state', async () => {
+    vi.spyOn(ai, 'setConsent').mockResolvedValue(mkStatus({ optional_personalization: { status: 'granted', version: 1 } }))
+    renderCtl()
+    fireEvent.click(await screen.findByTestId('consent-toggle-optional_personalization'))
+    await waitFor(() => expect(ai.setConsent).toHaveBeenCalledWith('optional_personalization', true, 3))
+    expect(await screen.findByTestId('consent-state-optional_personalization')).toHaveTextContent('Granted')
+    expect(screen.getByTestId('pwsl')).toBeInTheDocument()   // personalization without shared learning
+  })
+
+  it('personalization and federation are independent toggles', async () => {
+    vi.spyOn(ai, 'setConsent').mockResolvedValue(mkStatus({ optional_federation: { status: 'granted', version: 1 } }))
+    renderCtl()
+    fireEvent.click(await screen.findByTestId('consent-toggle-optional_federation'))
+    await waitFor(() => expect(ai.setConsent).toHaveBeenCalledWith('optional_federation', true, 3))
+    // federation granted, personalization still not granted
+    expect(screen.getByTestId('consent-state-optional_personalization')).toHaveTextContent('Not granted')
+  })
+
+  it('on a 409 conflict, refetches and shows a conflict notice', async () => {
+    vi.spyOn(ai, 'setConsent').mockRejectedValue(new ApiRequestError({ status: 409, message: 'version_conflict' }))
+    const refetch = vi.spyOn(ai, 'profileStatus')
+    renderCtl()
+    fireEvent.click(await screen.findByTestId('consent-toggle-optional_personalization'))
+    await waitFor(() => expect(screen.getByText(/changed elsewhere/i)).toBeInTheDocument())
+    expect(refetch.mock.calls.length).toBeGreaterThanOrEqual(2)   // initial + refetch after conflict
+  })
+
+  it('does not delete when the confirm dialog is cancelled', async () => {
+    const confirmMock = vi.fn(() => false)
+    vi.stubGlobal('confirm', confirmMock)
+    const del = vi.spyOn(ai, 'deleteProfile')
+    renderCtl()
+    fireEvent.click(await screen.findByTestId('consent-delete'))
+    await waitFor(() => expect(confirmMock).toHaveBeenCalled())
+    expect(del).not.toHaveBeenCalled()
+  })
+
+  it('deletes eligible data and shows deleted/retained categories', async () => {
+    vi.stubGlobal('confirm', vi.fn(() => true))
+    vi.spyOn(ai, 'deleteProfile').mockResolvedValue({
+      subject: 'alice', profile: 'deleted', deleted_now: true,
+      deleted_categories: ['derived_behavioural_features', 'optional_personalization_state'],
+      retained_categories: ['required_security_processing_records', 'minimal_deletion_tombstone'],
+      retention_reason: 'required', retired_generation: 1, audit_reference: 'abc123',
+      erasure_type: 'eligible_scope_deletion', affects_payment: false, note: 'eligible-scope',
+    })
+    renderCtl()
+    fireEvent.click(await screen.findByTestId('consent-delete'))
+    await waitFor(() => expect(ai.deleteProfile).toHaveBeenCalled())
+    const receipt = await screen.findByTestId('deletion-receipt')
+    expect(receipt).toHaveTextContent(/derived_behavioural_features/)
+    expect(receipt).toHaveTextContent(/required_security_processing_records/)
+    expect(receipt).toHaveTextContent(/not perfect erasure or machine unlearning/i)
+  })
+})

web/src/components/ConsentControls.tsx

@@ -0,0 +1,134 @@
+import { useEffect, useState } from 'react'
+import { useI18n } from '../i18n'
+import { Callout, Spinner } from './ui'
+import { ApiRequestError } from '../api/client'
+import {
+  deleteProfile, profileStatus, setConsent,
+  type ConsentPurpose, type DeleteProfileResult, type ProfileStatus,
+} from '../api/ai'
+
+/** Customer privacy/consent controls (PR C4). Advisory only — these choices never approve, deny or
+ * change a payment. Required security processing is shown as informational (not a consent toggle).
+ * Identity is the authenticated principal (session token); no user id is sent. */
+export function ConsentControls() {
+  const { t } = useI18n()
+  const [status, setStatus] = useState<ProfileStatus | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState(false)
+  const [busy, setBusy] = useState<ConsentPurpose | 'delete' | null>(null)
+  const [notice, setNotice] = useState<{ tone: 'ok' | 'warn'; msg: string } | null>(null)
+  const [deleted, setDeleted] = useState<DeleteProfileResult | null>(null)
+
+  async function refresh(signal?: AbortSignal) {
+    setLoading(true)
+    try {
+      setStatus(await profileStatus(signal))
+    } catch {
+      setErr(true)
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  useEffect(() => {
+    const c = new AbortController()
+    refresh(c.signal)
+    return () => c.abort()
+  }, [])
+
+  async function toggle(purpose: ConsentPurpose, grant: boolean) {
+    if (!status) return
+    setBusy(purpose); setNotice(null)
+    try {
+      const next = await setConsent(purpose, grant, status.record_version)
+      setStatus(next); setNotice({ tone: 'ok', msg: t('consent.saved') })
+    } catch (e) {
+      if (e instanceof ApiRequestError && e.status === 409) {
+        await refresh(); setNotice({ tone: 'warn', msg: t('consent.conflict') })
+      } else {
+        setErr(true)
+      }
+    } finally {
+      setBusy(null)
+    }
+  }
+
+  async function onDelete() {
+    if (!window.confirm(t('consent.delete.confirm'))) return
+    setBusy('delete'); setNotice(null)
+    try {
+      const res = await deleteProfile()
+      setDeleted(res)
+      await refresh()
+      setNotice({ tone: 'ok', msg: t('consent.delete.done') })
+    } catch {
+      setErr(true)
+    } finally {
+      setBusy(null)
+    }
+  }
+
+  if (loading && !status) return <Spinner label={t('common.loading')} />
+  if (err && !status) return <Callout tone="warn">{t('home.security.unavailable')}</Callout>
+  if (!status) return null
+
+  const optionalRow = (purpose: ConsentPurpose, titleKey: string, explainKey: string) => {
+    const meta = status.purposes[purpose]
+    const granted = meta.status === 'granted'
+    return (
+      <div className="consent-row" data-testid={`consent-${purpose}`}>
+        <div className="consent-row-text">
+          <strong>{t(titleKey as never)}</strong>
+          <p className="muted small">{t(explainKey as never)}</p>
+        </div>
+        <div className="consent-row-control">
+          <span className={`badge ${granted ? 'tone-ok' : 'tone-info'}`} data-testid={`consent-state-${purpose}`}>
+            {granted ? t('consent.on') : t('consent.off')}
+          </span>
+          <button className="btn" disabled={busy === purpose}
+            onClick={() => toggle(purpose, !granted)}
+            data-testid={`consent-toggle-${purpose}`}>
+            {granted ? t('consent.withdraw') : t('consent.grant')}
+          </button>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <div className="consent-controls">
+      {/* Required security processing — informational, NOT a consent toggle, not "granted". */}
+      <div className="consent-row" data-testid="consent-service_essential">
+        <div className="consent-row-text">
+          <strong>{t('required.title')} <span className="badge tone-warn">{t('required.badge')}</span></strong>
+          <p className="muted small">{t('required.explain')}</p>
+        </div>
+        <span className="badge tone-neutral" data-testid="required-state">{t('required.state')}</span>
+      </div>
+
+      {optionalRow('optional_personalization', 'consent.personalization.title', 'consent.personalization.explain')}
+      {optionalRow('optional_federation', 'consent.federation.title', 'consent.federation.explain')}
+
+      {status.personalization_without_shared_learning && (
+        <Callout tone="info"><span data-testid="pwsl">{t('consent.pwsl')}</span></Callout>
+      )}
+      {notice && <Callout tone={notice.tone}>{notice.msg}</Callout>}
+
+      <div className="consent-delete">
+        <strong>{t('consent.delete.title')}</strong>
+        <p className="muted small">{t('consent.delete.explain')}</p>
+        <button className="btn danger" disabled={busy === 'delete'}
+          onClick={onDelete} data-testid="consent-delete">
+          {t('consent.delete.button')}
+        </button>
+        {deleted && (
+          <div className="deletion-receipt" data-testid="deletion-receipt">
+            <p className="small"><strong>{t('consent.delete.deletedLabel')}:</strong> {deleted.deleted_categories.join(', ')}</p>
+            <p className="small"><strong>{t('consent.delete.retainedLabel')}:</strong> {deleted.retained_categories.join(', ')}</p>
+            <p className="muted small">{t('consent.delete.notUnlearning')}</p>
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}

web/src/components/FederatedStatusCard.test.tsx

@@ -0,0 +1,60 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { render, screen } from '@testing-library/react'
+import { I18nProvider } from '../i18n'
+import { FederatedStatusCard } from './FederatedStatusCard'
+import * as ai from '../api/ai'
+
+vi.mock('../api/ai')
+
+const status: ai.FederatedStatus = {
+  client_type: 'SYNTHETIC_SERVER_SIMULATION',
+  real_device_training: 'NOT_IMPLEMENTED',
+  native_local_only_training: 'NOT_IMPLEMENTED',
+  real_user_data_used: false,
+  federation: 'SIMULATED',
+  secure_aggregation: 'DESIGN_ONLY',
+  differential_privacy: 'SIMULATED',
+  differential_privacy_detail: {
+    differential_privacy: 'SIMULATED', budget_exhausted: true, candidate_privacy_eligibility: 'ineligible',
+    cumulative_epsilon: 38.76, budget_epsilon: 8, production_privacy_guarantee: false, note: 'simulated only',
+  },
+  automatic_model_promotion: false, affects_payment_authorization: false,
+  candidate_status: 'candidate', candidate_promotable: false,
+  disclaimer: 'Server-side simulation using synthetic clients; not real cross-device federated learning.',
+  label: 'SIMULATED', aggregators: ['coordinate_median', 'fedavg', 'trimmed_mean'],
+}
+
+const renderCard = (detailed = false) =>
+  render(<I18nProvider initial="en"><FederatedStatusCard detailed={detailed} /></I18nProvider>)
+
+describe('FederatedStatusCard', () => {
+  beforeEach(() => { vi.spyOn(ai, 'federatedStatus').mockResolvedValue(status) })
+  afterEach(() => vi.restoreAllMocks())
+
+  it('reports synthetic server simulation + design-only + not-implemented labels', async () => {
+    renderCard()
+    expect(await screen.findByTestId('fed-label-client_type')).toHaveTextContent('SYNTHETIC_SERVER_SIMULATION')
+    expect(screen.getByTestId('fed-label-secure_aggregation')).toHaveTextContent('DESIGN_ONLY')
+    expect(screen.getByTestId('fed-label-real_device_training')).toHaveTextContent('NOT_IMPLEMENTED')
+    expect(screen.getByTestId('fed-label-native_local_only_training')).toHaveTextContent('NOT_IMPLEMENTED')
+  })
+
+  it('surfaces the exhausted simulated DP budget as a warning', async () => {
+    renderCard()
+    expect(await screen.findByTestId('dp-exhausted')).toHaveTextContent(/budget is exhausted/i)
+    expect(screen.getByTestId('dp-exhausted')).toHaveTextContent(/not a production privacy guarantee/i)
+  })
+
+  it('never claims data stays on the device', async () => {
+    const { container } = renderCard(true)
+    await screen.findByTestId('federated-status')
+    expect(container.textContent).not.toMatch(/stays (only )?on your (phone|device)/i)
+    expect(container.textContent).not.toMatch(/never leaves your device/i)
+  })
+
+  it('detailed mode states the candidate is not promotable and clients are synthetic', async () => {
+    renderCard(true)
+    expect(await screen.findByTestId('fed-not-promotable')).toHaveTextContent(/not promotable/i)
+    expect(screen.getByTestId('fed-synthetic')).toHaveTextContent(/no real user data is used/i)
+  })
+})

web/src/components/FederatedStatusCard.tsx

@@ -0,0 +1,69 @@
+import { useEffect, useState } from 'react'
+import { useI18n } from '../i18n'
+import { Callout, Spinner } from './ui'
+import { federatedStatus, type FederatedStatus } from '../api/ai'
+
+/** Honest, non-authoritative view of the SIMULATED federated-learning demo (PR C3/C4).
+ * Reports synthetic-server-simulation status, secure-aggregation DESIGN_ONLY, DP SIMULATED with an
+ * exhausted-budget warning, and no payment authority. Never claims "data stays on your device". */
+export function FederatedStatusCard({ detailed = false }: { detailed?: boolean }) {
+  const { t } = useI18n()
+  const [status, setStatus] = useState<FederatedStatus | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [err, setErr] = useState(false)
+
+  useEffect(() => {
+    const c = new AbortController()
+    federatedStatus(c.signal)
+      .then(setStatus)
+      .catch(() => setErr(true))
+      .finally(() => setLoading(false))
+    return () => c.abort()
+  }, [])
+
+  if (loading) return <Spinner label={t('common.loading')} />
+  if (err || !status) return <Callout tone="warn">{t('fed.unavailable')}</Callout>
+
+  const dp = status.differential_privacy_detail
+  const rows: [string, string][] = [
+    ['client_type', status.client_type],
+    ['federation', status.federation],
+    ['secure_aggregation', status.secure_aggregation],
+    ['differential_privacy', status.differential_privacy],
+    ['real_device_training', status.real_device_training],
+    ['native_local_only_training', status.native_local_only_training],
+  ]
+
+  return (
+    <div className="federated-status" data-testid="federated-status">
+      <ul className="status-list">
+        {rows.map(([key, value]) => (
+          <li key={key}>
+            <span>{t(`federated.label.${key}` as never)}</span>
+            <span className="badge tone-info mono" data-testid={`fed-label-${key}`}>{value}</span>
+          </li>
+        ))}
+      </ul>
+
+      {dp?.budget_exhausted && (
+        <Callout tone="warn">
+          <span data-testid="dp-exhausted">{t('fed.dp.exhausted')}</span>
+        </Callout>
+      )}
+
+      <p className="muted small" data-testid="fed-no-authority">{t('federated.noAuthority')}</p>
+
+      {detailed && (
+        <>
+          <p className="muted small" data-testid="fed-synthetic">{t('fed.syntheticClients')}</p>
+          {status.aggregators && status.aggregators.length > 0 && (
+            <p className="muted small">{t('fed.aggregators')}: <span className="mono">{status.aggregators.join(', ')}</span></p>
+          )}
+          <p className="muted small">{t('fed.candidate')}: <span className="mono">{status.candidate_status}</span>
+            {' · '}<span data-testid="fed-not-promotable">{t('fed.notPromotable')}</span></p>
+          <p className="muted small">{status.disclaimer}</p>
+        </>
+      )}
+    </div>
+  )
+}

web/src/i18n/ar.ts

@@ -292,6 +292,51 @@ export const ar: Record<MessageKey, string> = {
   'security.oob.title': 'التأكيد خارج القناة',
   'security.oob.explain': 'قد تتطلب المدفوعات عالية الخطورة تأكيدًا منفصلًا عبر قناتك المفضلة.',
   'security.activity.title': 'نشاط الأمان',
+  'security.privacy.title': 'الخصوصية والموافقة',
+  'security.privacy.explain': 'أنت تتحكم في خيارات التخصيص الاختيارية والتعلّم المشترك. هذه الخيارات لا توافق على أي دفعة أو ترفضها أو تغيّرها. معالجة الأمان المطلوبة منفصلة وتُطبَّق دائمًا.',
+  'security.privacy.signInFirst': 'سجّل الدخول لإدارة خيارات التخصيص والخصوصية الخاصة بك.',
+  'required.title': 'معالجة الأمان المطلوبة',
+  'required.badge': 'مطلوب',
+  'required.state': 'مُفعَّلة',
+  'required.explain': 'تُستخدم معالجة الأمان المطلوبة لحماية المدفوعات والحفاظ على سلامة الخدمة. وهي منفصلة عن التعلّم الاختياري ولا يمكن إيقافها من هنا.',
+  'consent.personalization.title': 'التخصيص الاختياري',
+  'consent.personalization.explain': 'اسمح للنموذج التجريبي في وضع الظل بتخصيص الفحوصات من أنماط دفعك. مُعطَّل افتراضيًا. إيقافه يوقف التخصيص — ولا يُضعف أي قرار أمني.',
+  'consent.federation.title': 'محاكاة التعلّم المشترك الاختيارية',
+  'consent.federation.explain': 'المشاركة في عرض تعلّم مشترك (موحّد) مُحاكى. مُعطَّل افتراضيًا. هذه محاكاة على الخادم تستخدم عملاء اصطناعيين؛ وهي منفصلة عن التخصيص ولا يُفعّلها أبدًا.',
+  'consent.pwsl': 'تخصيص بدون تعلّم مشترك: التخصيص مُفعَّل ومحاكاة التعلّم المشترك مُعطَّلة.',
+  'consent.on': 'مُفعَّل',
+  'consent.off': 'غير مُفعَّل',
+  'consent.grant': 'تفعيل',
+  'consent.withdraw': 'إيقاف',
+  'consent.saved': 'تم حفظ اختيارك.',
+  'consent.conflict': 'تم تغيير هذا في مكان آخر. حدّثنا إلى أحدث حالة — يُرجى المحاولة مرة أخرى.',
+  'consent.delete.title': 'حذف ملفي السلوكي',
+  'consent.delete.explain': 'يحذف البيانات السلوكية المشتقة والتعلّم الاختياري المؤهّلة للحذف. تُحتفظ سجلات الدفع/الأمان المطلوبة مع سجل حذف بسيط. لا يُحذف سجل مدفوعاتك.',
+  'consent.delete.button': 'حذف الملف السلوكي',
+  'consent.delete.confirm': 'هل تريد حذف بياناتك السلوكية والتعلّم الاختياري المؤهّلة؟ تُحتفظ سجلات الأمان المطلوبة. لا يمكن التراجع.',
+  'consent.delete.done': 'تم حذف بيانات ملفك السلوكي المؤهّلة للحذف.',
+  'consent.delete.deletedLabel': 'محذوف',
+  'consent.delete.retainedLabel': 'مُحتفظ به (مطلوب)',
+  'consent.delete.notUnlearning': 'هذا حذف ضمن النطاق المؤهّل، وليس محوًا تامًّا أو إلغاء تعلّم آلي.',
+  'security.federated.title': 'التعلّم المشترك (مُحاكى)',
+  'security.federated.explain': 'نموذج بحثي أوّلي مُدرَّب على عملاء اصطناعيين على الخادم. لا يعمل على جهازك ولا يؤثر في دفعاتك.',
+  'federated.label.client_type': 'نوع العميل',
+  'federated.label.federation': 'التعلّم الموحّد',
+  'federated.label.secure_aggregation': 'التجميع الآمن',
+  'federated.label.differential_privacy': 'الخصوصية التفاضلية',
+  'federated.label.real_device_training': 'تدريب حقيقي على الجهاز',
+  'federated.label.native_local_only_training': 'تدريب محلي على الجهاز فقط',
+  'federated.noAuthority': 'لا سلطة على الدفع · لا ترقية تلقائية · محاكاة اصطناعية على الخادم',
+  'fed.dp.exhausted': 'ميزانية الخصوصية التفاضلية المُحاكاة مُستنفدة. هذا ليس ضمانًا للخصوصية في الإنتاج والنموذج المرشّح غير مؤهّل للخصوصية.',
+  'fed.syntheticClients': 'العملاء اصطناعيون وعلى الخادم؛ لا تُستخدم أي بيانات مستخدم حقيقية.',
+  'fed.notPromotable': 'غير قابل للترقية',
+  'nav.federatedDemo': 'عرض التعلّم المشترك',
+  'fed.title': 'عرض التعلّم المشترك (مُحاكى)',
+  'fed.intro': 'تشرح هذه الصفحة ن��وذجًا بحثيًا أوّليًا. التعلّم المشترك هنا محاكاة على الخادم عبر عملاء اصطناعيين — وليس تدريبًا حقيقيًا عبر الأجهزة ولا يؤثر في دفعاتك.',
+  'fed.status.title': 'الحالة الصادقة',
+  'fed.aggregators': 'أدوات التجميع',
+  'fed.candidate': 'النموذج المرشّح',
+  'fed.unavailable': 'حالة التعلّم المشترك غير متاحة حاليًا.',
   'shadow.badge': 'وضع الظل',
   'shadow.advisory': 'استشاري فقط',
   'shadow.noChange': 'لا يغيّر تفويض الدفع',

web/src/i18n/en.ts

@@ -290,6 +290,51 @@ export const en = {
   'security.oob.title': 'Out-of-band confirmation',
   'security.oob.explain': 'High-risk payments can require a separate confirmation on your preferred channel.',
   'security.activity.title': 'Security activity',
+  'security.privacy.title': 'Privacy & consent',
+  'security.privacy.explain': 'You control optional personalization and shared-learning choices. These choices never approve, deny or change a payment. Required security processing is separate and always applies.',
+  'security.privacy.signInFirst': 'Sign in to manage your personalization and privacy choices.',
+  'required.title': 'Required security processing',
+  'required.badge': 'Required',
+  'required.state': 'Active',
+  'required.explain': 'Required security processing is used to protect payments and maintain service integrity. It is separate from optional learning and cannot be turned off here.',
+  'consent.personalization.title': 'Optional personalization',
+  'consent.personalization.explain': 'Let the experimental shadow model personalize checks from your payment patterns. Off by default. Turning it off stops personalization — it never weakens a security decision.',
+  'consent.federation.title': 'Optional shared-learning simulation',
+  'consent.federation.explain': 'Take part in a simulated shared-learning (federated) demo. Off by default. This is a server-side simulation using synthetic clients; it is separate from personalization and never enabled by it.',
+  'consent.pwsl': 'Personalization without shared learning: personalization is on and the shared-learning simulation is off.',
+  'consent.on': 'Granted',
+  'consent.off': 'Not granted',
+  'consent.grant': 'Turn on',
+  'consent.withdraw': 'Turn off',
+  'consent.saved': 'Your choice was saved.',
+  'consent.conflict': 'This was changed elsewhere. We refreshed to the latest state — please try again.',
+  'consent.delete.title': 'Delete my behavioural profile',
+  'consent.delete.explain': 'Deletes eligible derived behavioural and optional-learning data. Required payment/security records are kept, along with a minimal deletion record. Your payment history is not deleted.',
+  'consent.delete.button': 'Delete behavioural profile',
+  'consent.delete.confirm': 'Delete your eligible behavioural and optional-learning data? Required security records are kept. This cannot be undone.',
+  'consent.delete.done': 'Your eligible behavioural profile data was deleted.',
+  'consent.delete.deletedLabel': 'Deleted',
+  'consent.delete.retainedLabel': 'Retained (required)',
+  'consent.delete.notUnlearning': 'This is eligible-scope deletion, not perfect erasure or machine unlearning.',
+  'security.federated.title': 'Shared learning (simulated)',
+  'security.federated.explain': 'A research prototype trained on synthetic server-side clients. It does not run on your device and does not affect your payments.',
+  'federated.label.client_type': 'Client type',
+  'federated.label.federation': 'Federation',
+  'federated.label.secure_aggregation': 'Secure aggregation',
+  'federated.label.differential_privacy': 'Differential privacy',
+  'federated.label.real_device_training': 'Real device training',
+  'federated.label.native_local_only_training': 'On-device local-only training',
+  'federated.noAuthority': 'No payment authority · not auto-promoted · synthetic server-side simulation',
+  'fed.dp.exhausted': 'Simulated differential-privacy budget is exhausted. This is not a production privacy guarantee and the candidate is not privacy-eligible.',
+  'fed.syntheticClients': 'Clients are synthetic and server-side; no real user data is used.',
+  'fed.notPromotable': 'not promotable',
+  'nav.federatedDemo': 'Shared-learning demo',
+  'fed.title': 'Shared-learning demo (simulated)',
+  'fed.intro': 'This page explains a research prototype. Shared learning here is a server-side simulation over synthetic clients — it is not real cross-device training and has no effect on your payments.',
+  'fed.status.title': 'Honest status',
+  'fed.aggregators': 'Aggregators',
+  'fed.candidate': 'Model candidate',
+  'fed.unavailable': 'Shared-learning status is unavailable right now.',
   'shadow.badge': 'Shadow mode',
   'shadow.advisory': 'Advisory only',
   'shadow.noChange': 'Does not change payment authorization',

web/src/pages/FederatedDemoPage.tsx

@@ -0,0 +1,23 @@
+import { useI18n } from '../i18n'
+import { ShadowBadges } from '../components/ShadowBadge'
+import { FederatedStatusCard } from '../components/FederatedStatusCard'
+
+/** Labelled federated-learning demo (PR C4). Explains the C3 SIMULATION honestly — it is a
+ * server-side simulation over synthetic clients, not real cross-device training, and has no
+ * effect on payments. Route: #/demo/federated-learning. */
+export function FederatedDemoPage() {
+  const { t } = useI18n()
+  return (
+    <section className="page federated-demo" aria-labelledby="fed-h">
+      <h2 id="fed-h">{t('fed.title')}</h2>
+      <ShadowBadges />
+      <div className="card">
+        <p>{t('fed.intro')}</p>
+      </div>
+      <div className="card">
+        <h3>{t('fed.status.title')}</h3>
+        <FederatedStatusCard detailed />
+      </div>
+    </section>
+  )
+}

web/src/pages/SecurityPage.test.tsx

@@ -16,6 +16,17 @@ describe('SecurityPage', () => {
       reason_codes_version: 'reason_codes-v1', shadow_only: true, affects_payment: false,
       label: 'DEMO ONLY',
     })
+    // C4 additions: the Security page now also renders a federated-status card.
+    vi.spyOn(ai, 'federatedStatus').mockResolvedValue({
+      client_type: 'SYNTHETIC_SERVER_SIMULATION', real_device_training: 'NOT_IMPLEMENTED',
+      native_local_only_training: 'NOT_IMPLEMENTED', real_user_data_used: false,
+      federation: 'SIMULATED', secure_aggregation: 'DESIGN_ONLY', differential_privacy: 'SIMULATED',
+      differential_privacy_detail: { differential_privacy: 'SIMULATED', budget_exhausted: true,
+        candidate_privacy_eligibility: 'ineligible', production_privacy_guarantee: false, note: 'x' },
+      automatic_model_promotion: false, affects_payment_authorization: false,
+      candidate_status: 'candidate', candidate_promotable: false,
+      disclaimer: 'Server-side simulation using synthetic clients.', label: 'SIMULATED',
+    })
   })
   afterEach(() => vi.restoreAllMocks())
 

web/src/pages/SecurityPage.tsx

@@ -3,6 +3,8 @@ import { useI18n } from '../i18n'
 import { useSession } from '../hooks/useSession'
 import { Callout, Spinner } from '../components/ui'
 import { ShadowBadges, ShadowFootnote } from '../components/ShadowBadge'
+import { ConsentControls } from '../components/ConsentControls'
+import { FederatedStatusCard } from '../components/FederatedStatusCard'
 import { modelStatus, type ModelStatus } from '../api/ai'
 
 /** Customer-facing security page: device authentication + behavioural-protection (shadow) status.
@@ -58,6 +60,23 @@ export function SecurityPage({ onNav }: { onNav: (r: string) => void }) {
         )}
       </div>
 
+      <div className="card" data-testid="privacy-card">
+        <h3>{t('security.privacy.title')}</h3>
+        <p className="muted">{t('security.privacy.explain')}</p>
+        {activeUser ? (
+          <ConsentControls />
+        ) : (
+          <Callout tone="info">{t('security.privacy.signInFirst')}</Callout>
+        )}
+      </div>
+
+      <div className="card" data-testid="federated-card">
+        <h3>{t('security.federated.title')}</h3>
+        <p className="muted">{t('security.federated.explain')}</p>
+        <FederatedStatusCard />
+        <button className="btn" onClick={() => onNav('demo/federated-learning')}>{t('nav.federatedDemo')}</button>
+      </div>
+
       <div className="card">
         <h3>{t('security.oob.title')}</h3>
         <p className="muted">{t('security.oob.explain')}</p>

web/src/styles.css

@@ -180,3 +180,17 @@ h2 { margin: 0 0 12px; font-size: 18px; }
 .more-sheet { position:fixed; bottom:3.6rem; inset-inline:0; z-index:25; background:var(--bg,#fff); border-top:1px solid rgba(0,0,0,.12); display:flex; flex-direction:column; }
 .more-item { padding:.9rem 1rem; text-align:start; background:none; border:none; border-bottom:1px solid rgba(0,0,0,.06); font:inherit; min-height:44px; cursor:pointer; }
 @media (prefers-reduced-motion: reduce) { .spin { animation: none !important; } }
+
+/* PR C4 — consent controls + federated status */
+.consent-row { display:flex; gap:1rem; align-items:flex-start; justify-content:space-between; padding:.7rem 0; border-bottom:1px solid rgba(0,0,0,.07); }
+.consent-row:last-of-type { border-bottom:none; }
+.consent-row-text { flex:1 1 auto; min-width:0; }
+.consent-row-control { display:flex; flex-direction:column; align-items:flex-end; gap:.4rem; flex:0 0 auto; }
+.consent-delete { margin-top:1rem; padding-top:.8rem; border-top:1px dashed rgba(0,0,0,.15); }
+.btn.danger { border-color:#b42318; color:#b42318; }
+.btn.danger:hover:not(:disabled) { background:#b42318; color:#fff; }
+.federated-status .status-list { margin:.4rem 0; }
+@media (max-width:520px){ .consent-row { flex-direction:column; } .consent-row-control { align-items:flex-start; } }
+.badge.tone-neutral { background:rgba(0,0,0,.06); color:inherit; }
+.deletion-receipt { margin-top:.6rem; padding:.5rem .6rem; border:1px solid rgba(0,0,0,.1); border-radius:.5rem; }
+.deletion-receipt p { margin:.15rem 0; word-break:break-word; }