Emit JSON like you're going to share it — support-bundle data hygiene

The shape of a trustworthy bundle

$bundle = [ordered]@{
  schema  = 'prooftune-support-bundle/1'
  created = [DateTime]::UtcNow.ToString('o')
  os      = @{ product = (Get-CimInstance Win32_OperatingSystem).Caption
               build   = [int](Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber }
  exclusions = 'user-names,machine-name,serials,secrets,file-paths,command-lines'
}
$bundle | ConvertTo-Json -Depth 6

Hygiene rules with teeth

• Fixed schema forever: define field names and never accept arbitrary input into them. If a field's missing for this machine, emit 'unavailable' — don't grow the schema because a run deviated.
• Compute summaries, not dumps: count, top-N, status enums. A bundle of “823 files, 12.4 GB” supports analysis; a file-path list supports nothing but exposure.
• State exclusions in the bundle itself: naming what's deliberately left out (names, serials, paths) converts “trust us” into an auditable contract the reviewer can spot-check.

Final step before any share: re-read what you're about to send. If there's a line you'd redact, the emitter shouldn't have produced it.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.