Session records hold prompts, source code, command output, file paths, and often credentials that passed through a terminal. A stream is private data by default. ASR provides structure that makes redaction possible and checkable; it does not make any stream safe to share by itself.

​
Conformance is not share safety

A stream can be fully conformant and contain secrets, personal data and private paths. Validation checks structure, not safety. ASR-550 Tools MUST NOT label a stream or bundle as safe to share because it validates or conforms to this specification. ASR-551 An exporter that produces a stream or bundle for sharing MUST apply a redaction policy and record which one (in the stream’s derivedFrom.policy and the bundle’s redaction), and MUST NOT include native files unless the user explicitly asked for them (ASR-026).
Design note. Browser HTTP archives became a channel for stolen session tokens because a widely used format had no redaction rules. Several related formats have since moved transcripts out of shared storage, or labeled previews as “safe” and had to retract the labels. ASR instead says outright that conformance does not make a stream safe to share.
Passing the validator does not make a file safe to share. Producer tests using source data also do not guarantee that every file is free of secrets, complete or safe to share. Synthetic fixtures alone do not qualify a producer version (ASR-652).

​
Content levels

The header’s contentLevel describes how much content the stream discloses. A declaration can change it for subsequent records. It does not indicate whether the stream is safe to share. Content-bearing fields are:
  • message.content and displayContent, and all content parts;
  • tool_call.input and inputText;
  • tool_result.content, displayContent, raw, error.message, exec.command, exec.stdout, exec.stderr and exec.output;
  • instructions.content and tools;
  • compaction.summary and opaque;
  • plan.entries[].content and plan.content;
  • file_change.patch, and the text and content of file states;
  • terminal.command and output;
  • hook.output, stdout, stderr and command;
  • permission.title, description, feedback, rationale and reviews[].rationale;
  • input_request.message, questions (question and option text), answers, response and url;
  • delivery.reason;
  • session_info.title;
  • identity values: participants’ displayName and ids[].value, conversations’ nativeId, message.platform, delivery.platformMessageIds, and actor address and device values.
Identity values are personal data. Unlike other content, they also appear in structure (a sender, a decider), so a metadata stream keeps them only in a form that cannot be read back (ASR-568). ASR-552 A stream (or the part of it after a metadata declaration) at content level metadata MUST NOT contain content-bearing fields, except required arrays left empty and identity values kept as ASR-568 allows. Each removed field SHOULD carry the capture state omitted with reason: "policy". Opaque reasoning, opaque parts, signatures and content blobs MUST NOT be included. ASR-553 Readers MUST NOT treat full or redacted as an indication that content is safe to share. ASR-568 At content level metadata, each identity value MUST be omitted or replaced by a keyed digest: the string keyed: followed by the 64 lowercase hex digits of HMAC-SHA-256 over the value’s UTF-8 bytes, under a key that is not shared (as ASR-557 requires for low-entropy values). A required identity member (a participant’s ids[].value) is replaced, not omitted. The same value MUST get the same digest throughout the stream, so that the structure (who sent which message) stays usable.

​
Per-record redactions

A record’s redactions array lists what was removed from that record.
ASR-554 Each redaction entry MUST contain path, reason and policy, and path MUST be a valid JSON Pointer. ASR-555 A redacted value MUST be removed (for an object member) or replaced by a placeholder that carries no information derived from the original. When the redacted value is all or part of a content-bearing field, that field’s capture state MUST be redacted. ASR-556 A record’s redactions may reduce disclosure below the stream’s content level, but may not increase it. A metadata stream contains no content whether or not its records list redactions.

​
Roots

Workspace roots can be redacted independently of the records that refer to them: set path to null and, optionally, give pathDigest. Root-relative paths in records stay usable.
ASR-557 Digests of sensitive values with little entropy (paths, user names, short identifiers) can be reversed by guessing and MUST be treated as disclosing those values. A sharing exporter MUST either omit them or replace them with keyed digests whose key is not shared. Root redaction does not cover absolute paths inside tool inputs, commands, output text, patches and content (ASR-472). A redaction policy must find and handle those separately.

​
Redaction

Redaction produces a new stream. The original is never modified (ASR-005).
The header’s derivedFrom: ASR-558 A stream produced by redacting another stream MUST carry derivedFrom in its header, and SHOULD set contentLevel to redacted or metadata. ASR-559 Redaction MUST cover every place the policy’s targets can appear: record content, superseded revisions, capture-state blobs and every other blob reachable from the stream, native members and native files, _meta and unknown members, vendor record types, identifiers (session IDs, entity keys, session references in lineage and copiedFrom), and paths embedded in text. ASR-560 When redaction and preservation conflict, redaction wins. A redaction tool that cannot establish that an unknown member, _meta entry, vendor record type or native payload is free of the policy’s targets MUST remove it, overriding the preservation rules of Extensibility. ASR-561 A policy that pseudonymizes identifiers MUST apply the same mapping to every stream and manifest entry in the bundle, so that references between sessions stay consistent. A changed session ID is a different session key; derivedFrom keeps the link to the original stream.

​
Security requirements

Streams, bundles and discovery files come from other programs and other people. Readers and tools treat them as untrusted input. ASR-562 Readers MUST NOT fetch URIs found in streams or bundles automatically: blob uris, resource_link and resource URIs, native.ref locations outside the bundle, instructions.uri, input_request.url, data part schema URIs, pull request URLs, and session locators. Fetching requires an explicit user action. ASR-563 Tools that extract bundle archives MUST reject entries with absolute paths, .. segments, or links that resolve outside the extraction directory, MUST NOT create device files, and MUST enforce limits on total extracted size, entry count and compression ratio. ASR-564 Readers MUST limit their resource use: they MUST enforce configurable limits on line length, nesting depth, string length, record count and blob size, and exceeding a limit MUST produce a diagnostic message rather than a crash or unbounded memory use. ASR-565 Tools MUST NOT execute commands found in streams, bundles or discovery files automatically: discovery-file exportCommand values, exec.command values, terminal and hook commands. Running an export command requires the user’s consent for that source. Secrets are never part of a record. An answer to a question that asks for a secret is not recorded anywhere (ASR-283), and configuration records carry no credentials (ASR-189). A recorder does not record MCP server configuration values (ASR-712). ASR-566 Renderers MUST treat transcript content as untrusted when displaying it: escape markup, neutralize terminal control sequences, render Markdown without raw HTML, never execute scripts, and never load remote resources (images, links) without an explicit user action. ASR-567 Tools MUST obtain the user’s consent before publishing session references into Git history (commit trailers, pushed notes), as the integration companion describes.