Split goal privacy spec into its own file; write skeleton of goal completeness specs.