# AutoShorts Sanitizer Mapping

The AutoShorts sanitizer is allowlist-first. It treats local probe data and HTTP API responses as hostile input and emits only the existing JARVIS `ModuleSnapshot` contract.

## Allowed input mapping

- `pending_review_count` or Dashboard `ready_for_approval` -> `Candidates pending review` KPI.
- `ready_preview_count` or Dashboard `needs_metadata` -> `Ready previews` KPI.
- `failed_pipeline_count` or Dashboard `failed_actions` -> generic degraded status and `Render failed` attention.
- `last_pipeline_status` -> safe enum category only.
- `pipeline_freshness` -> stale flag and `Pipeline stale` attention. Live Dashboard responses without an explicit safe freshness indicator map to `unknown`, not `fresh`.
- `publishing_status_category` -> `Upload check needed` attention when review/check is needed.
- `last_success_at` -> timestamp only.

## Blocked classes

Blocked from output:
- tokens, secrets, OAuth/refresh/access token strings
- platform identifiers in raw payloads
- renderer/tool commands
- prompts, full scripts, voiceovers, subtitles, captions, descriptions
- video/audio/image/frame/thumbnail/manifest/local path fields
- `/home/` and media subtitle suffixes such as `.mp4`, `.mov`, `.wav`, `.mp3`, `.png`, `.jpg`, `.webp`, `.srt`, `.ass`

Dedicated dirty fixtures contain synthetic blocked examples to prove they do not reach API output.

## Error handling

Adapter errors become safe degraded/offline snapshots with redacted error categories. `/api/overview` must remain stable.