Filter at build time with DITAVAL

Remove content for every reader before it reaches the content store, for example staff-only notes, with a DITAVAL file named in opend.config.yaml.

Write the DITAVAL file.

<val>
  <prop att="audience" val="internal" action="exclude"/>
</val>

Name it in opend.config.yaml.
```
buildFilter: filters/publish.ditaval
```

Mark the content.

<topicref href="../internal/maintainers.dita" audience="internal"/>
<p audience="internal">Ask in the team channel before changing this.</p>

Results

Excluded content is gone from the release snapshot, so no reader, preview or PDF can ever show it. This site keeps maintainer notes in internal/ this way.

What to do next

Supported rules:

prop with an action of include, exclude, flag or passthrough. Only exclude removes content; the others keep it.
The most specific rule wins: attribute and value, then attribute only (no val), then a global default (no att), then include.
Flagging styles and revprop are ignored.
The root must be <val>, and an unknown action is an error (invalid-ditaval).

Any filtering attribute can be filtered at build time, but excluding a product, feature or release value here removes it for every reader. To gate readers, rely on their entitlements instead.