Rehydrate Skill for Claude

confide:rehydrate — restore real values into a placeholder analysis

This is the last step of the CONFIDE round-trip:

• Redact locally with confide:anon (default reversible mode) → a GREEN copy

with unique reserved-sentinel placeholders ([CONFIDE_PERSON_0001],

[CONFIDE_EMAIL_0001], [CONFIDE_DATE_0002]…) plus a secret <name>.map.json

(structured: green_sha256, entries[]…) that stays on the machine.

• Analyze the GREEN text anywhere — including a cloud LLM. The analysis comes

back full of those same placeholders (sometimes mangled to CONFIDE_PERSON_0001,

[CONFIDE PERSON 0001]… — but always keeping the full CONFIDE_TYPE_NNNN core).

• Rehydrate here: replace every placeholder with its original value from your

own map, producing the real analysis — without the cloud ever seeing the originals.

Privacy invariants (do not violate)

• Local-only, on the user's OWN map. The map never leaves the machine. This skill

never fetches or transmits anything.

• Counts only on stdout. The summary reports restored N, unmatched M. The

restored text (which contains originals) is written to a local file; it is NEVER

echoed to stdout beyond the counts.

• Unmatched = possible hallucination. A placeholder that is not in the map is

reported as unmatched and left in place — we never invent a value for it.

Warn the user that these may be LLM hallucinations.

• The <name>.restored.md output contains originals: it is local-only, do not share

or commit it.

Run it

python3 skills/rehydrate/scripts/rehydrate.py ANALYSIS_FILE [--map <name>.map.json]

• ANALYSIS_FILE — the text/analysis containing placeholders.
• --map <name>.map.json — the secret map from confide:anon. If omitted, the

sibling *.map.json is auto-found (e.g. an analysis next to session.map.json,

or one derived from session.green.md).

• --out PATH — output path (default: <name>.restored.md next to the input).
• --verify-green <green_file> — check the map's green_sha256 against that GREEN

file; warns loudly if they don't match (wrong map for this document).

Robust to LLM mangling that still keeps the full CONFIDE_TYPE_NNNN core:

[CONFIDE_PERSON_0001], [CONFIDE PERSON 0001], CONFIDE_PERSON_0001, and

confide_person_0001 all restore to the same map entry. Ordinary prose lacking the

CONFIDE prefix (e.g. "Person 1", "patient 1", "section 2") is never touched, and

0001 never eats 0010. Rehydration is idempotent (re-running on restored text is a

no-op). Accepts both the structured map schema and a legacy flat map.

After running

• Report the restore summary (restored N, unmatched M) — never paste PII.
• If unmatched > 0, flag the placeholders as possible hallucinations not in the map.
• Remind the user the *.restored.md is local-only (it now contains originals).