Turn sensitive sources into clean, shareable files.

teleon.dev/docs/cleanroom works in two rooms. Room A turns a source into a mathematical spec; past the aq507 airlock, Room B builds clean datasets, code, prose, 3D meshes and competition bundles from that spec alone.

v41.0teleon.dev/docs/cleanroomTwo-room airlockhttpsjson

Read the docs Copy the agent prompt

One source through both rooms

Room A: CleanRoomSpecIRfrom 40,000 support transcripts: structure and statistics

aq507 airlockverbatim runs of 5 words or fewer, MinHash 0.031

Room B builds from the spec

Datasetvine copula twin

Codefresh implementation

Prosereworked text

Room B works from the spec alone, and every output leaves with an SLSA v1.0 certificate that records how it was made.

What it does

Room A keeps the math

Each source becomes a CleanRoomSpecIR: its structure and statistics, with the original wording left behind.

The aq507 airlock

A spec passes when every verbatim run is five words or shorter and its MinHash similarity to the source is under 0.08.

Room B builds clean outputs

Synthetic twins, fresh code, reworked prose, meshes and leak-free competitions, each with an SLSA v1.0 IP certificate.

The contract

An airlock spec records the source lineage, the FF1 settings, the privacy floor and the overlap limits, with its IP certificate.

De-identificationFF1 only, NIST SP 800-38G Rev. 1, domain 10⁶ or more

Privacy floork_anonymity_floor >= 10, HMAC-SHA256 pseudonyms

Overlap limitsmax_5gram_overlap = 0.0, MinHash under 0.08

CertificatesSLSA v1.0 IP certificates, S178

Identifiers

teleon_clean_room_airlock_specs
CleanRoomSpecIR

Execution contracts

Request and responseCopy

POST /v1/cleanroom/specs
Host: api.teleon.dev
{
  "source": "swh:1:cnt:2b7f...c3",
  "outputs": ["dataset", "prose"],
  "skin": "logistics",
  "k_anonymity_floor": 10
}

# Response
{
  "spec_id": "0192c3e4-...-7a1f",
  "airlock": "aq507",
  "max_5gram_overlap": 0.0,
  "max_minhash_similarity": 0.031,
  "fpe_cipher_mode": "NIST-SP800-38G-REV1-FF1-ONLY",
  "slsa_ip_certificate": "attached"
}

Endpoints

Method	Path	Access	What it does
`POST`	`/v1/cleanroom/specs`	RING-2	Extract a spec from a source in Room A
`POST`	`/v1/cleanroom/specs/{id}/build`	RING-2	Build clean outputs from a spec in Room B
`GET`	`/v1/cleanroom/certificates/{id}`	RING-3	Verify an SLSA IP certificate

Listed paths appear in the service’s published files today. This surface comes from the Teleon Omnibus Codex v1.0 to v50.0, Oct 25, 2026. In the one-host plan every path here is served under api.teleon.dev/v1/cleanroom.

How it connects

Reads from

Files and vaultteleon.dev/docs/files Archive readerteleon.dev/docs/archives Repos and feedsteleon.dev/docs/repos

Feeds into

Datasetsteleon.dev/docs/datasets Creative studioteleon.dev/docs/studio Assurance and evidenceteleon.dev/docs/assurance

Queuesaq501-aq525 aq507 aq508

StoresS171 Clean-Room Specs (CleanRoomSpecIR)S172 Domain Skin Matrix S173 NIST FF1 and k-Anonymity Vault S175 Text Reworker Under 0.08 MinHash S176 Leak-Free Competition Builder S178 SLSA v1.0 IP Certificates

For agents

Give your agent the read-only guide first. It reports back before any write.

Agent prompt

Read https://teleon.dev/docs/cleanroom.md and explain what the aq507 airlock checks before Room B builds anything. Read only.

Copy

llms.txt Agent card

Words on this page

Full glossary

Format-preserving encryption: Encryption whose output keeps the input's shape, so a nine-digit ID becomes another nine-digit ID. Teleon uses the NIST FF1 mode.
k-anonymity: A privacy floor: each released record shares its identifying fields with at least k minus 1 others, so any one person sits in a group of k or more.
SLSA: Supply-chain Levels for Software Artifacts: signed provenance that records how an artifact was built and from which inputs.