Add vcf-rdfizer-policy: ODRL policy attachment with declared selectors and partitions

[ecrum19]

Why

The paper's capabilities table lists Provenance/policy annotations as not implemented. docs/privacy-policy-design.md specifies a full governed-release system, but none of it exists. This PR adds a first slice of that design, general enough to be useful beyond this project's example.

It is governed release, not anonymization. The tool says so in its manifest, its docs and its README.

What

vcf-rdfizer-policy (explain, attach, evaluate, check) is a host-side command in the pattern of vcf-rdfizer-link, with no Docker. The engine has three generic steps, each configured in Turtle, not code:

Step	What configures it
select	A rule targets a resource IRI, or a selection computed by a selector type: a SPARQL SELECT ?resource with named parameters, declared in a profile or in the policy file itself
partition	A profile's ownership rule, a property path plus IRI subtrees, says what a withheld resource takes with it
decide	ODRL: a binding permission must own a resource and no binding prohibition may; deny wins; default-deny. Purposes come from any RDFS/SKOS vocabulary (bundled default: a DUO subset)

All VCF knowledge is in one Turtle file, the bundled VCF Core profile (vcf_rdfizer_data/policy/vcf-core-profile.ttl):

• region and variant selectors;
• the ownership rule: a record owns its call, alleles and per-sample calls, and a file owns everything under it;
• the per-record report.

The engine itself never mentions VCF.

Refusal rule: anything the engine can't evaluate is refused with an error, never skipped. That includes an undeclared selector type, a missing parameter, a purpose outside the vocabulary, a failing precondition such as an assembly mismatch, or an unsupported ODRL construct.

check:

• Structural checks, for any graph: the policy digest matches; nothing a binding prohibition owns is present; nothing lacks a permission; no reference dangles.
• VCF oracle, --vcf: re-derives the expected records from the VCF text, never touching the converter, and requires an exact match.

Example

examples/policy/ holds:

• a synthetic cohort of five single-sample VCFs (real GRCh38 loci, synthetic genotypes);
• the cohort converted in both profiles, with provenance, so no Docker is needed;
• policy.ttl and run_demo.sh;
• custom-selector.ttl, a QUAL-threshold selector declared in the policy file, with no code.

requester P001.vcf  P002.vcf  P003.vcf  P004.vcf  P005.vcf  triples withheld
alz       22        16        18        withheld  20        4649
clinical  33        23        withheld  withheld  withheld  6539
gru       21        16        withheld  withheld  withheld  7869

Every view passes check, including the oracle, in both profiles. The generalisation reproduced the original grid and triple counts exactly.

Tests

As agreed, the plug-in's tests live apart from its code: ecrum19/vcf-rdfizer-testing#4 (plugin-tests/policy/, 32 tests, run by hand). They cover:

• the decision grid cell by cell;
• the refusals;
• the engine's generality: a selector declared in a policy, a non-VCF graph partitioned by a property path, a SKOS vocabulary;
• six planted faults the check must catch.

This repo keeps only the conda recipe's packaging checks for the plug-in.

On vcf-bench-1, inside the v3.1.0 image:

• The plug-in suite passes 32 of 32.
• The demo passes every check on both profiles.
• This repo's CI suite runs 902 tests. The 2 failures (test_validate_compression_unit) also fail on the base commit in the same container, as root or not, so they're specific to that environment and unrelated to this PR.

Also

• docs/policy-demonstrator.md is rewritten around select → partition → decide, including how to extend each without code. It adds a roadmap (v0.2–v0.5) mapped onto the full design; the sample, field and header selectors that design lists are now declarations rather than engine work.
• pyproject.toml and the conda recipe gain the command and the bundled data, and the recipe checks that the profile and vocabulary are packaged.

Not in v0.1.0

• multi-sample masking inside condensed vectors;
• conversion-time enforcement;
• pseudonymization; views keep their original IRIs;
• generalise and threshold effects;
• enforcing duties, which are only recorded;
• anything beyond fixture scale: evaluation is in memory, with a 5M-triple guard.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!