Privacy Orchestration

---
name: privacy-orchestration
description: "Guides SecretFlow PSI, secure aggregation/comparison, Kuscia, TEEU
  simulation, and deployment orchestration workflows."
disable-model-invocation: true
metadata:
  disco-role: operating
license: Apache 2.0
---

# Privacy and orchestration

Use this sub-skill when the task depends on privacy-preserving protocols,
cluster wiring, or deployment mode selection rather than on direct model or
component APIs.

## Owns

- PSI helpers and PSI protocol choices
- secure aggregation and comparison helpers
- Kuscia request parsing and SecretFlow cluster conversion helpers
- TEEU simulation guidance and deployment flow
- debug/simulation/production/Kuscia deployment-mode decisions
- common party/device co-location and orchestration failures

## Does not own

- plain device setup and data containers — use `runtime-data`
- direct preprocessing/statistics/classical ML APIs — use `analytics`
- component CLI / export workflows — use `component-cli`

## Trigger phrases

Use this route when a user asks things like:
- how to run PSI in SecretFlow
- how to compare or aggregate data securely
- how to parse a Kuscia task config
- how to choose debug, simulation, production, or Kuscia deployment modes
- how to use TEEU in simulation mode
- why a protocol or party layout is failing

## Reading order

1. Read `references/privacy-orchestration.md` for the protocol and deployment
   map.
2. Read the root troubleshooting page when the problem is an install, backend,
   or cluster issue that is not unique to this workflow.
3. Use `scripts/kuscia_config_smoke.py` when you want a tiny config-parser check
   that does not require any external cluster.

## Workflow

1. Pick the deployment mode before picking a protocol. The runtime shape changes
   between debug, simulation, production, and Kuscia.
2. For PSI or comparison tasks, decide which party owns the result and whether
   the inputs must already be co-located.
3. For Kuscia, parse the request shape first and only then derive the SecretFlow
   cluster config.
4. For TEEU, treat the auth-manager and memory prerequisites as part of the
   workflow, not as an afterthought.

## Common decisions

- Use the simplest PSI protocol that matches the dataset size and privacy
  needs.
- Use simulation mode when the task is about code flow or basic validation and
  not about a production deployment.
- Use Kuscia when the task names task orchestration, port reuse, or production
  scheduling.
- Use TEEU simulation for educational or quick-start validation, not as a
  production security proof.

## Bundled files

- `references/privacy-orchestration.md` — PSI, deployment, Kuscia, and TEEU notes.
- `scripts/kuscia_config_smoke.py` — tiny Kuscia config parsing helper.