fix(manager): the guided setup dropped the holder's own visibility decision

[stormer78]

Reported from the live console: an attribute set to show it still rendered as ●●●● in "N attributes so far", with a Show button beside it.

Cause

One missing prop, at three call sites. Every AttributeValue in persona-setup.tsx passed type and value and never sensitivity, so treatmentFor fell through to the registry — and for an unregistered token like profile.github the registry's answer is the conservative floor, high/full.

The holder's answer existed, was stored, was returned by the agent, and was dropped on the way to the component.

This is the defect treatmentFor's own docstring records having fixed once already, arriving by a different route: there the decision lost to a fail-closed branch, here it never reached the function at all. AttributeValue documents that a surface holding a whole attribute should pass sensitivity — the guide held whole attributes and passed none of them.

onReveal is threaded in alongside, because without it a Show on a genuinely withheld value has nothing to call. The map and the list already had it; the guide never did.

Three tests, and the two that aren't the report matter as much

• The reported case — a holder's show it on an unregistered token is legible. Asserted on the value being present, not on the mask being absent: "no bullets" would also pass if the value vanished entirely.
• Absent is not a decision — an unregistered token the holder did not decide on stays masked, so this fix cannot quietly become "never mask".
• §3.3 stays intact — a declared token (email.work → emailLocal) keeps the registry's mask however the holder marks it, so the narrow unregistered exception does not widen into declared tokens.

Verified non-vacuous: removing the one prop again fails the first test with "the holder said show it and the guide hid it anyway".

extension 485/485.

[affinidi-appsecurity-bot]

🛡️ AI Agentic Security Code Review

🔎 A manual security review is recommended before merging. Please contact the Security team for specifics and remediation guidance.

ℹ️ Detailed findings are not published on public repositories; the Security team holds the complete report.