Compile private-training data-use policies

[maziyarpanahi]

Summary

Local execution still violates governance when a site's data-use terms do not permit the requested task, retention, model family, or derivative artifact.

Scope

• Compile declarative use restrictions into preflight checks for training, evaluation, retention, aggregation, and release.
• Produce a decision trace using policy identifiers and hashes without copying source records or legal text into artifacts.

Acceptance criteria

• The implementation is deterministic and performs no mandatory network call.
• Logs, exceptions, reports, and fixtures contain no raw sensitive values.
• .venv/bin/python -m pytest tests/unit/governance/test_training_use_policy.py -q

Out of scope

• A compliance certification or autonomous clinical decision guarantee.
• Bundling restricted datasets, credentials, or proprietary services.
• Unrelated changes to release publishing or existing public APIs.

Files

• openmed/governance/training_use_policy.py
• tests/unit/governance/test_training_use_policy.py
• docs/governance/private-training-policies.md

---

Task: OM-172d · Milestone: v3.3 · Priority: P0 · Size: L
Depends on: — · Blocks: —
Roadmap: Audited V3 horizon expansion, 2026-08-13: OPENMED_V2_UNIFIED_ROADMAP.md section 6.5 and OPENMED_V3_HORIZON_BRIEF.md section 3
Spec: PLANS/V2/EXECUTION/tasks/OM-172d.md