@staix/vault-mem 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.0] - 2026-10-30
+
+- Fine-grained PII policy: `vault.pii` can set `allow`, `warn` or `deny` per category (email, phone, the global `piiPatterns`, named per-vault patterns) and per surface (notes, log, promotion), with an allow list of exact addresses, domains and phone numbers. The `allow`/`deny` shorthand keeps its previous meaning.
+- `vmem vaults pii <id>` shows the effective policy; `--set` previews a change and lists every loosened cell, and `--confirm` applies it. `vaults list` and `vmem_status` report the matrix as `piiPolicy`.
+- `vmem tidy --log` redacts only PII that the policy denies on the log surface, so personal vaults keep historical email addresses; secrets are still redacted everywhere.
+- Org promotion reports a `warn` cell in the target policy as a warning instead of refusing.
+
 ## [0.1.3] - 2026-10-30
 
 - `vmem tidy --log` fixes legacy log lines that fail lint L09: a trailing seconds field is dropped, and any other malformed line is kept verbatim behind `# legacy: `.

package/README.md

@@ -31,10 +31,51 @@ Durability: the temporary file is fsynced before the rename and the home directo
 
 Crash recovery: the lock file records the writer's pid, host and start time. Nothing is cleaned up automatically. `vmem recover` previews the state; `vmem recover --confirm` removes the lock only when it names this host and a pid that no longer runs, and then removes leftover `.config-<uuid>.tmp` files. A live lock, a lock from another host, or an unreadable (older-format) lock is never removed and the command exits 1; confirm no writer runs, then delete `config.lock` by hand. No other file in the home or any vault is touched. If cleanup fails after an operation (for example the lock cannot be removed), the original error is kept and the cleanup failure, including a retained lock, is appended to it.
 
-Vault fields: `id`, absolute `path` (must contain a real `notes/` directory), `kind` (`personal|org`), `write` (`mcp|cli|none`), optional `pii` (`allow|deny`; default `allow` for personal and `deny` for org, and `status`/`vaults list` always report the effective value, including for unhealthy entries), optional `remote` (any nonempty string such as an `https://` or `git@host:path` URL; stored only) and optional `registry` (absolute path; stored only). No sync exists yet, so `remote` and `registry` are not validated against a server and doctor does not check them; reachability checks apply once sync is implemented. Policy fields are stored for later note-writing stages, not enforced by the read commands. Writer commands enforce write/channel policy and configured deny/PII screening.
+Vault fields: `id`, absolute `path` (must contain a real `notes/` directory), `kind` (`personal|org`), `write` (`mcp|cli|none`), optional `pii` (the `allow|deny` shorthand or a policy object, see PII policy below; default `allow` for personal and `deny` for org, and `status`/`vaults list` always report the effective shorthand and `piiPolicy` matrix, including for unhealthy entries), optional `remote` (any nonempty string such as an `https://` or `git@host:path` URL; stored only) and optional `registry` (absolute path; stored only). No sync exists yet, so `remote` and `registry` are not validated against a server and doctor does not check them; reachability checks apply once sync is implemented. Policy fields are stored for later note-writing stages, not enforced by the read commands. Writer commands enforce write/channel policy and configured deny/PII screening.
 
 The only runtime dependency is the exact first-party pin `@staix/agent-mem@0.11.0`; it is not loaded by registry commands. Public library exports cover configuration, home resolution, registry operations, frontmatter, link resolution and the derived index. No console bin or UI contract is advertised before its implementation.
 
+# PII policy
+
+`pii` is either the shorthand `allow`/`deny` (every category on every surface) or an object that sets an action per category and, optionally, per surface:
+
+```json
+{"email": {"notes": "allow", "log": "deny"}, "phone": "warn", "custom": "deny",
+ "patterns": [{"name": "student-id", "regex": "S\\d{6}", "action": {"notes": "deny", "log": "allow"}}],
+ "allow": ["owner@example.org", "@example.org", "+82 10 0000 0000"]}
+```
+
+- Categories:
+  - `email`;
+  - `phone`;
+  - `custom`, the global `piiPatterns`;
+  - named per-vault `patterns` (at most 32; names `[a-z][a-z0-9-]{0,31}`, regexes compiled with the `u` flag).
+- Surfaces:
+  - `notes`: note and report writes, frontmatter screening, tidy value echo;
+  - `log`: log appends and `tidy --log` on existing lines;
+  - `promotion`: the screen `vmem promote` applies when this vault is the target.
+- Actions:
+  - `allow`: not screened.
+  - `warn`: the write proceeds with a V07 warning, and tidy echo prints the value as `[redacted]`.
+  - `deny`: V07 error, and `tidy --log` replaces matches in existing lines.
+  - Org promotion refuses only `deny` cells and secrets. The promoted note's write into the target vault is screened with the target's `promotion` cells, not its `notes` cells.
+  - `tidy --log` replaces the raw denied matches and leaves allow-listed values intact. Screening also checks the NFKC form. If a denied match is zero-length, or the replaced line still contains a denied match (for example a form only NFKC normalization reveals, or a pattern that matches the `[redacted]` marker), the whole line is redacted (fail closed).
+- An omitted category or surface takes the vault default: `allow` for personal vaults, `deny` for org vaults.
+- `allow` entries (at most 64) are exempt everywhere:
+  - an exact address, compared case-insensitively;
+  - an `@domain` suffix;
+  - a phone number standing alone, compared by its digits. Several numbers run together with spaces are never exempt (fail closed);
+  - an exact match of a pattern.
+- Secret detection is separate from this policy and always applies.
+
+```sh
+vmem vaults pii personal                                   # effective matrix and allow list
+vmem vaults pii personal --set '{"email":{"log":"deny"}}'  # preview: changed cells and every loosened cell
+vmem vaults pii personal --set '{"email":{"log":"deny"}}' --confirm
+```
+
+The policy is changed only through the CLI, under the config lock. MCP clients can read it in `vmem_status` but cannot set it.
+
 # Indexed reads
 
 ```sh
@@ -111,7 +152,7 @@ The vault set is read once at startup: every tool's `vault` property is an enum
 
 | tool | arguments (caps) |
 |---|---|
-| `vmem_status` | none; vaults with health, write policy and effective pii |
+| `vmem_status` | none; vaults with health, write policy, effective pii and `piiPolicy` (read-only) |
 | `vmem_search` | `query`<=1000, `vault`, `limit`<=50, `type`, `domain` |
 | `vmem_read` | `path` (stem, alias or `notes/` path), `vault`, `maxBytes`<=65536; returns `{path, frontmatter, body, sha256, truncated}` |
 | `vmem_read_many` | `paths`<=20 (8 KiB each), `vault` |
@@ -192,7 +233,7 @@ vmem sync team --confirm --fingerprint <sha>
 `vmem promote` copies one note from a personal vault into the local clone of a writable org vault (`kind: org`, `write` not `none`):
 
 - **Transform.** The last prose `## Topics` section (never one inside a code fence) is replaced with the target topics, which must name MOCs that already exist in the org vault (source topics by default, `--topics` to override); a missing section is appended. Body wiki links that do not resolve in the org vault become plain text (their label, if any); wiki-valued frontmatter (`project`, `supersedes`, `superseded_by`, `source_ref`) pointing outside it is dropped. All of this is listed in `droppedLinks`. The org note gets `promoted_from: "<personal>:notes/x.md"` and `promoted_at`.
-- **Screen (fail closed).** It refuses: secrets; PII under the org vault's policy (org defaults to `deny`, plus configured `piiPatterns`); `type: person` or `domain: people` records; private correspondence (`source`/`source_ref` from `inbox/`, `outlook:`, `telegram(`, `kakao`); and internal meeting notes (`source` under `meetings/`). These are keyword heuristics; the org clone's `git diff` before `vmem sync` is the review surface. Body links that are dropped are also resolved in the personal vault: a link to a person/people, meeting or correspondence note refuses the promotion (reporting only the category and count), so their names never reach the org vault. A refusal or a preview writes nothing in either vault.
+- **Screen (fail closed).** It refuses: secrets; PII denied by the org vault's `promotion` cells (org defaults to `deny`, plus configured `piiPatterns`; a `warn` cell is reported, not refused); `type: person` or `domain: people` records; private correspondence (`source`/`source_ref` from `inbox/`, `outlook:`, `telegram(`, `kakao`); and internal meeting notes (`source` under `meetings/`). These are keyword heuristics; the org clone's `git diff` before `vmem sync` is the review surface. Body links that are dropped are also resolved in the personal vault: a link to a person/people, meeting or correspondence note refuses the promotion (reporting only the category and count), so their names never reach the org vault. A refusal or a preview writes nothing in either vault.
 - **Confirm.** It requires the current fingerprint. Then it creates the org note through `applyWrite`, records `promoted_to: "<org>:notes/x.md"` on the source, and appends `SYNC  <project>  personal:notes/x.md → <org>:notes/x.md  <em-dash> promoted: <type>` to both vault logs (`--log-project` sets the project, default `-`). The note is also linted against the org vault (`lintVault` over the org snapshot with the note overlaid, scoped to that note): any L01/L02/L13 error refuses the preview, and the lint result is returned again after the write. Vault-wide warnings do not block. A second promotion of the same note needs `--again`, and an existing org note is never overwritten. If the source provenance write failed after the org note was created, a rerun detects the org note's matching `promoted_from` and offers a provenance-only preview and confirm.
 - **MCP.** `vmem_promote` does the same over MCP and needs `write: mcp` on both vaults.
 
@@ -234,7 +275,7 @@ Runtime changes intentionally make `release:verify` report stale historical rele
 
 - **Two steps.** Without `--confirm` it prints per-rule `counts`, a per-note change list (`key: old -> new`, dropped keys with their values, sections added) and `reported` items that were left unchanged; nothing is written. With `--confirm` the fingerprint must match: it covers the rules, the map file, and the before/after sha of every touched file (and of the log). Each note is then written through `applyWrite` (atomic per note, under the vault lock) and one `LINT` event is appended, for example `tidy: escapes 1, enums 13, keys 78, ...`.
 - **Never blocked by one note.** A sanitized note that the writer would still refuse (for example an unknown key) is left unchanged, listed under `skipped` and `reported`, and the rest of the run proceeds. Counts and the `LINT` event cover only notes that are written.
-- **No value leaks.** Every value echoed into a change line or report is screened: secret-looking values, and email/phone values in `pii: deny` vaults, print as `[redacted]`.
+- **No value leaks.** Every value echoed into a change line or report is screened: secret-looking values, and PII values that the `notes` surface warns on or denies, print as `[redacted]`.
 - **Restart-safe.** If a run is interrupted, every note is either fully old or fully new; a rerun previews only the rest. A second `--all` run previews zero changes.
 - **Scope.** Only flat `notes/*.md` and, for `--log`, the vault `log` are touched; `.obsidian/`, `templates/` and `self/` never are. Nothing is committed; commit the receipt paths yourself.
 
@@ -247,6 +288,6 @@ Runtime changes intentionally make `release:verify` report stale historical rele
 | `--topics` | append `## Topics` listing the frontmatter topics where no such heading exists; mismatched sections are reported |
 | `--connections` | fold `## Connections (...)` headings into `## Relevant Notes` |
 | `--secrets` | replace V06 secret matches with `[redacted]`: in the body the match itself, in frontmatter the whole field value (the key stays, so the YAML stays valid). A match outside a field value, such as a YAML comment, is reported for manual repair. The preview names note and line, never the value. PII in personal vaults is left alone |
-| `--log` | replace secret-looking substrings and email addresses in existing log lines with `[redacted]`, under the log lock (refused with V06 when `denyPaths` covers the log). A line that fails the lint L09 structure check loses a trailing seconds field when that makes it valid, and is otherwise kept verbatim behind `# legacy: ` (readers skip `#` lines); no time, zone or TYPE is guessed. Other lines are kept byte for byte. Git history is not rewritten: rotate exposed credentials |
+| `--log` | replace secret-looking substrings in existing log lines with `[redacted]`, and PII values that the vault policy denies on the `log` surface (allow-list entries excepted), under the log lock (refused with V06 when `denyPaths` covers the log). A line that fails the lint L09 structure check loses a trailing seconds field when that makes it valid, and is otherwise kept verbatim behind `# legacy: ` (readers skip `#` lines); no time, zone or TYPE is guessed. Other lines are kept byte for byte. Git history is not rewritten: rotate exposed credentials |
 
 `--map <file>` overrides defaults with strict JSON `{"enums": {"confidence|status|type": {"from": "to"}}, "keys": {"key": "drop" | "keep" | {"rename": "key"}}}` (at most 64 KiB and 1000 entries). For `tidy`, `--log` selects the log rule; tidy always writes its own `LINT` event.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@staix/vault-mem",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Validated Obsidian-compatible knowledge vaults for agents and people",
   "license": "MIT",
   "type": "module",

package/src/cli.ts

@@ -7,7 +7,8 @@ import { version } from "../package.json";
 import { completionScript, help } from "./commands-table.ts";
 import { runSetup, type SetupMode } from "./setup.ts";
 import { resolveHome } from "./home.ts";
-import { addVault, effectivePii, loadRegistry, recoverRegistry, registryStatus, removeVault } from "./registry.ts";
+import { addVault, effectivePii, loadRegistry, recoverRegistry, registryStatus, removeVault, setVaultPii } from "./registry.ts";
+import { piiPolicy } from "./pii.ts";
 function parse(args: string[], allowed: string[], values: string[]) {
   const flags: Record<string, string | boolean> = {}, positional: string[] = [];
   for (let i = 0; i < args.length; i++) {
@@ -43,8 +44,8 @@ export function run(args: string[], env: NodeJS.ProcessEnv = process.env): { tex
   if (isReadCommand(args[0]!)) return runReadCommand(args[0]!, args.slice(1), resolveHome(env).home);
   const command = args[0] === "vaults" ? `vaults ${args[1] ?? ""}` : args[0];
   const tail = args.slice(args[0] === "vaults" ? 2 : 1);
-  const options = command === "vaults add" ? ["--kind", "--write", "--pii", "--remote", "--registry"] : [];
-  const { flags, positional } = parse(tail, ["--json", ...options, ...(command === "vaults remove" || command === "recover" ? ["--confirm"] : [])], options);
+  const options = command === "vaults add" ? ["--kind", "--write", "--pii", "--remote", "--registry"] : command === "vaults pii" ? ["--set"] : [];
+  const { flags, positional } = parse(tail, ["--json", ...options, ...(command === "vaults remove" || command === "vaults pii" || command === "recover" ? ["--confirm"] : [])], options);
   const home = resolveHome(env);
   let result: unknown, code = 0;
   switch (command) {
@@ -62,7 +63,7 @@ export function run(args: string[], env: NodeJS.ProcessEnv = process.env): { tex
       break;
     case "vaults list":
       if (positional.length) throw new Error("vaults list: unexpected arguments");
-      result = loadRegistry(home.home).vaults.map(v => ({ ...v, pii: effectivePii(v) }));
+      result = loadRegistry(home.home).vaults.map(v => ({ ...v, pii: effectivePii(v), piiPolicy: piiPolicy(v) }));
       break;
     case "vaults add": {
       if (positional.length !== 2) throw new Error("vaults add: requires id and absolute path");
@@ -71,6 +72,15 @@ export function run(args: string[], env: NodeJS.ProcessEnv = process.env): { tex
       result = { applied: true, vault: addVault(home.home, value) };
       break;
     }
+    case "vaults pii": {
+      if (positional.length !== 1) throw new Error("vaults pii: requires id");
+      const raw = flags["--set"];
+      if (raw === undefined && flags["--confirm"] === true) throw new Error("vaults pii: --confirm requires --set");
+      let value: unknown;
+      if (typeof raw === "string") { if (raw === "allow" || raw === "deny") value = raw; else { try { value = JSON.parse(raw); } catch { throw new Error("vaults pii: --set expects allow, deny or a JSON policy object"); } } }
+      result = setVaultPii(home.home, positional[0]!, value, flags["--confirm"] === true);
+      break;
+    }
     case "vaults remove":
       if (positional.length !== 1) throw new Error("vaults remove: requires id");
       result = removeVault(home.home, positional[0]!, flags["--confirm"] === true);

package/src/commands-table.ts

@@ -12,6 +12,7 @@ export const COMMANDS = [
   { name: "vaults list", usage: "vaults list [--json]", mutates: false },
   { name: "vaults add", usage: "vaults add <id> <absolute-path> --kind personal|org --write mcp|cli|none [--pii allow|deny] [--remote URL] [--registry PATH] [--json]", mutates: true },
   { name: "vaults remove", usage: "vaults remove <id> [--confirm] [--json]", mutates: "confirm" },
+  { name: "vaults pii", usage: "vaults pii <id> [--set allow|deny|JSON] [--confirm] [--json]", mutates: "confirm" },
   { name: "new", usage: "new <vault> <stem> --type TYPE --domain DOMAIN --topics a,b --description TEXT [--title TEXT] [--source TEXT|JSON] [--confidence TEXT] [--status TEXT] [--body file|-] [--extra JSON] [--dry-run] [--json]", mutates: true },
   { name: "patch", usage: "patch <vault> <note> --old TEXT --new TEXT [--expected-sha SHA] [--dry-run] [--json]", mutates: true },
   { name: "append", usage: "append <vault> <note> --section SECTION --markdown TEXT [--expected-sha SHA] [--dry-run] [--json]", mutates: true },

package/src/config.ts

@@ -8,10 +8,17 @@ export interface VaultSpec {
   path: string;
   kind: "personal" | "org";
   write: "mcp" | "cli" | "none";
-  pii?: "allow" | "deny";
+  pii?: "allow" | "deny" | PiiSpec;
   remote?: string;
   registry?: string;
 }
+export type PiiAction = "allow" | "warn" | "deny";
+export const PII_SURFACES = ["notes", "log", "promotion"] as const;
+export type PiiSurface = typeof PII_SURFACES[number];
+export type PiiCell = PiiAction | Partial<Record<PiiSurface, PiiAction>>;
+export interface PiiPattern { name: string; regex: string; action?: PiiCell }
+/** Fine-grained PII policy: per category, optionally per surface; omitted cells take the vault default. */
+export interface PiiSpec { email?: PiiCell; phone?: PiiCell; custom?: PiiCell; patterns?: PiiPattern[]; allow?: string[] }
 export interface VmemConfig { home?: string; vaults: VaultSpec[]; denyPaths?: string[]; piiPatterns?: string[] }
 const controls = /[\x00-\x1f\x7f]/;
 function object(value: unknown, keys: string[], label: string): Record<string, unknown> {
@@ -38,6 +45,41 @@ function strings(value: unknown, label: string): string[] | undefined {
     return text;
   });
 }
+const ACTIONS = new Set(["allow", "warn", "deny"]);
+function cell(value: unknown, label: string): PiiCell {
+  if (typeof value === "string") {
+    if (!ACTIONS.has(value)) throw new Error(`${label}: expected allow, warn or deny`);
+    return value as PiiAction;
+  }
+  const record = object(value, [...PII_SURFACES], label), result: Partial<Record<PiiSurface, PiiAction>> = {};
+  for (const surface of PII_SURFACES) if (record[surface] !== undefined) {
+    if (typeof record[surface] !== "string" || !ACTIONS.has(record[surface] as string)) throw new Error(`${label}.${surface}: expected allow, warn or deny`);
+    result[surface] = record[surface] as PiiAction;
+  }
+  return result;
+}
+/** Validate `vault.pii`: the `allow`/`deny` shorthand or a PiiSpec object. */
+export function parsePii(value: unknown): "allow" | "deny" | PiiSpec {
+  if (value === "allow" || value === "deny") return value;
+  if (typeof value === "string") throw new Error("vault.pii: expected allow, deny or a policy object");
+  const raw = object(value, ["email", "phone", "custom", "patterns", "allow"], "vault.pii"), spec: PiiSpec = {};
+  for (const key of ["email", "phone", "custom"] as const) if (raw[key] !== undefined) spec[key] = cell(raw[key], `vault.pii.${key}`);
+  if (raw.patterns !== undefined) {
+    if (!Array.isArray(raw.patterns) || raw.patterns.length > 32) throw new Error("vault.pii.patterns: expected at most 32 patterns");
+    const names = new Set<string>();
+    spec.patterns = raw.patterns.map((item, index) => {
+      const p = object(item, ["name", "regex", "action"], `vault.pii.patterns[${index}]`);
+      const name = string(p.name, "vault.pii.patterns.name"), regex = string(p.regex, "vault.pii.patterns.regex");
+      if (!/^[a-z][a-z0-9-]{0,31}$/.test(name) || names.has(name)) throw new Error(`vault.pii.patterns: invalid or duplicate name ${name.slice(0, 40)}`);
+      if (Buffer.byteLength(regex) > 256) throw new Error("vault.pii.patterns.regex: exceeds 256 bytes");
+      try { new RegExp(regex, "u"); } catch { throw new Error(`vault.pii.patterns.${name}: invalid regular expression`); }
+      names.add(name);
+      return { name, regex, ...(p.action !== undefined ? { action: cell(p.action, `vault.pii.patterns.${name}.action`) } : {}) };
+    });
+  }
+  if (raw.allow !== undefined) spec.allow = strings(raw.allow, "vault.pii.allow");
+  return spec;
+}
 export function parseVault(value: unknown): VaultSpec {
   const v = object(value, ["id", "path", "kind", "write", "pii", "remote", "registry"], "vault");
   const id = string(v.id, "vault.id");
@@ -45,10 +87,7 @@ export function parseVault(value: unknown): VaultSpec {
   if (v.kind !== "personal" && v.kind !== "org") throw new Error("vault.kind: expected personal or org");
   if (v.write !== "mcp" && v.write !== "cli" && v.write !== "none") throw new Error("vault.write: expected mcp, cli or none");
   const result: VaultSpec = { id, path: absolute(v.path, "vault.path"), kind: v.kind, write: v.write };
-  if (v.pii !== undefined) {
-    if (v.pii !== "allow" && v.pii !== "deny") throw new Error("vault.pii: expected allow or deny");
-    result.pii = v.pii;
-  }
+  if (v.pii !== undefined) result.pii = parsePii(v.pii);
   if (v.remote !== undefined) result.remote = string(v.remote, "vault.remote");
   if (v.registry !== undefined) result.registry = absolute(v.registry, "vault.registry");
   return result;

package/src/log-format.ts

@@ -1,4 +1,6 @@
 import { screenContent } from "./write-validation.ts";
+import { parsePii } from "./config.ts";
+function validPii(value: unknown): boolean { try { parsePii(value); return true; } catch { return false; } }
 import type { LogContext, LogEvent } from "./log-types.ts";
 import type { WriteIssue } from "./write-types.ts";
 
@@ -31,7 +33,7 @@ export function formatLogEvent(event: LogEvent, context: LogContext): { line?: s
   }
   if ((context.channel !== undefined && context.channel !== "cli" && context.channel !== "mcp") ||
       !record(context.vault) || !["personal", "org"].includes(context.vault.kind) ||
-      (context.vault.pii !== undefined && context.vault.pii !== "allow" && context.vault.pii !== "deny") ||
+      (context.vault.pii !== undefined && !validPii(context.vault.pii)) ||
       !record(context.config) || !Array.isArray(context.config.vaults) ||
       (context.config.piiPatterns !== undefined && (!Array.isArray(context.config.piiPatterns) || context.config.piiPatterns.some(value => typeof value !== "string"))) ||
       (context.now !== undefined && !(context.now instanceof Date)) ||
@@ -51,7 +53,7 @@ export function formatLogEvent(event: LogEvent, context: LogContext): { line?: s
   const env = context.env ?? process.env;
   const agent = context.channel === "mcp" || AGENT_MARKERS.some(marker => typeof env[marker] === "string" && env[marker]!.length > 0);
   const line = `${timestamp}  ${event.type}  ${event.project}  ${event.source}${event.dest === undefined ? "" : ` → ${event.dest}`}  — ${event.note}${agent ? " (vmem:agent)" : ""}\n`;
-  const issues = screenContent(line, context.vault, context.config);
+  const issues = screenContent(line, context.vault, context.config, "log");
   if (Buffer.byteLength(line, "utf8") > 1000) issues.push(error("V09", "log line exceeds 1000 UTF-8 bytes including attribution and newline"));
   return issues.some(issue => issue.severity === "error") ? { issues } : { line, issues };
 }

package/src/mcp-vault.ts

@@ -35,7 +35,7 @@ export function vaultTools(ids: readonly string[], orgIds: readonly string[] = [
   const twoStep = { confirm: { type: "boolean" }, fingerprint: sha };
   const orgVault = orgIds.length ? { type: "string", enum: [...orgIds] } : string(32);
   return [
-    tool("vmem_status", "Registered vaults with health, write policy and effective pii.", object({})),
+    tool("vmem_status", "Registered vaults with health, write policy, effective pii and the piiPolicy matrix (read-only).", object({})),
     tool("vmem_search", "Full-text (BM25) search over indexed notes. Literal AND terms.", object({ query: string(1000), vault, limit: integer(1, 50), type: string(64), domain: string(64) }, ["query"])),
     tool("vmem_read", "Read one note by stem, alias or notes/ path: frontmatter, body, sha256. Bounded by maxBytes; section selects an exact H2, offset pages UTF-8 byte ranges, and truncated reads list H2 headings/nextOffset.", object({ path: note, vault, maxBytes: integer(1, 65536), section: string(1024), offset: integer(0, MAX_NOTE_BYTES) }, ["path"])),
     tool("vmem_read_many", "Read up to 20 notes (8 KiB each).", object({ paths: { type: "array", minItems: 1, maxItems: 20, items: note }, vault }, ["paths"])),

package/src/org-promote.ts

@@ -61,7 +61,8 @@ const MEETING = [/(^|\/)meetings\//i];
  * meeting sources. Returns error issues only; any issue refuses promotion.
  */
 export function screenForOrg(text: string, data: Record<string, unknown>, target: VaultSpec, config: VmemConfig): WriteIssue[] {
-  const issues: WriteIssue[] = screenContent(text, target, config).map(found => ({ ...found, severity: "error" as const }));
+  // Secrets and deny cells refuse; a warn cell in the target policy is reported without refusing.
+  const issues: WriteIssue[] = screenContent(text, target, config, "promotion");
   if (data.type === "person" || data.domain === "people") issues.push(issue("SCREEN", "personal_data: person or people records are never promoted"));
   const sources = [...strings(data.source), ...strings(data.source_ref)];
   if (sources.some(value => MEETING.some(pattern => pattern.test(value)))) issues.push(issue("SCREEN", "internal_meeting_notes: source under meetings/"));
@@ -230,9 +231,10 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
   const text = emitFrontmatter(parseFrontmatter(parsed.source.slice(0, parsed.source.length - parsed.body.length) + body), frontmatter);
   result.target = `${target.id}:${targetPath}`; result.text = text; result.droppedLinks = transformed.dropped;
   const screen = [...screenForOrg(text, parsed.data, target, config), ...screenDroppedLinks(home, source, all, transformed.dropped.filter(link => !link.includes(":")))];
-  result.screen = { passed: screen.length === 0, issues: screen };
-  if (screen.length) return { ...result, issues: screen };
-  const planned = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env });
+  const refusing = screen.filter(found => found.severity === "error");
+  result.screen = { passed: refusing.length === 0, issues: screen };
+  if (refusing.length) return { ...result, issues: screen };
+  const planned = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env, piiSurface: "promotion" });
   const provenanceSet = { promoted_to: prior.length ? [...prior.filter(p => p !== promotedTo), promotedTo] : promotedTo };
   const provenanceText = emitFrontmatter(parsed, provenanceSet);
   const provenancePlan = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", dryRun: true }, { env: options.env });
@@ -245,7 +247,7 @@ export function promoteToOrg(home: string, request: OrgPromoteRequest, options:
   if (request.confirm !== true) return { ...result, ok: true, preview: true, issues: [...planned.issues, ...provenancePlan.issues] };
   if (request.fingerprint !== result.fingerprint) return { ...result, issues: [issue("V09", "stale or missing preview fingerprint")] };
   const event = { type: "SYNC", project: request.logProject ?? "-", source: `${source.id}:${path}`, dest: `${target.id}:${targetPath}`, note: `promoted: ${typeof parsed.data.type === "string" ? parsed.data.type : "note"}` };
-  const note = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", log: false }, { env: options.env });
+  const note = applyWrite(home, { vault: target.id, operation: { op: "create", path: targetPath, frontmatter: {}, body: text }, channel: request.channel ?? "cli", log: false }, { env: options.env, piiSurface: "promotion" });
   if (!note.ok || !note.applied) return { ...result, note, issues: note.issues };
   const provenance = applyWrite(home, { vault: source.id, operation: { op: "frontmatter", path, set: provenanceSet }, channel: request.channel ?? "cli", log: false }, { env: options.env });
   const logs = { source: null as LogReceipt | null, target: null as LogReceipt | null };

package/src/pii.ts

@@ -0,0 +1,133 @@
+import { PII_SURFACES, type PiiAction, type PiiCell, type PiiSurface, type VaultSpec, type VmemConfig } from "./config.ts";
+import type { WriteIssue } from "./write-types.ts";
+
+export const PII_CATEGORIES = ["email", "phone", "custom"] as const;
+export type PiiCategory = typeof PII_CATEGORIES[number];
+export type PiiRow = Record<PiiSurface, PiiAction>;
+/** Effective policy: every category and surface resolved, plus named patterns and the allow list. */
+export interface PiiMatrix { email: PiiRow; phone: PiiRow; custom: PiiRow; patterns: { name: string; regex: string; action: PiiRow }[]; allow: string[] }
+
+export const EMAIL_PATTERN = /[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9](?:[A-Z0-9.-]*[A-Z0-9])?\.[A-Z]{2,}/i;
+const RANK: Record<PiiAction, number> = { allow: 0, warn: 1, deny: 2 };
+
+function row(value: PiiCell | undefined, fallback: PiiAction): PiiRow {
+  const out = {} as PiiRow;
+  for (const surface of PII_SURFACES) out[surface] = typeof value === "string" ? value : value?.[surface] ?? fallback;
+  return out;
+}
+/** Resolve a vault's policy. Omitted cells default to allow for personal and deny for org vaults. */
+export function piiPolicy(vault: VaultSpec): PiiMatrix {
+  const fallback: PiiAction = vault.kind === "org" ? "deny" : "allow";
+  const pii = vault.pii;
+  if (pii === undefined || typeof pii === "string") {
+    const action = pii ?? fallback;
+    return { email: row(action, action), phone: row(action, action), custom: row(action, action), patterns: [], allow: [] };
+  }
+  return {
+    email: row(pii.email, fallback), phone: row(pii.phone, fallback), custom: row(pii.custom, fallback),
+    patterns: (pii.patterns ?? []).map(p => ({ name: p.name, regex: p.regex, action: row(p.action, fallback) })),
+    allow: [...(pii.allow ?? [])],
+  };
+}
+/** `allow`/`warn`/`deny` when every cell agrees and nothing else is set, else `custom`. */
+export function piiShorthand(vault: VaultSpec): PiiAction | "custom" {
+  const m = piiPolicy(vault), cells = PII_CATEGORIES.flatMap(c => PII_SURFACES.map(s => m[c][s]));
+  return m.patterns.length || m.allow.length || cells.some(a => a !== cells[0]) ? "custom" : cells[0]!;
+}
+/** Cells (and allow-list or pattern changes) where `next` is more permissive than `prev`. */
+export function loosenedCells(prev: PiiMatrix, next: PiiMatrix): string[] {
+  const out: string[] = [];
+  for (const c of PII_CATEGORIES) for (const s of PII_SURFACES) if (RANK[next[c][s]] < RANK[prev[c][s]]) out.push(`${c}.${s}: ${prev[c][s]} -> ${next[c][s]}`);
+  for (const p of prev.patterns) {
+    const n = next.patterns.find(q => q.name === p.name);
+    if (!n) { out.push(`patterns.${p.name}: removed`); continue; }
+    if (n.regex !== p.regex) out.push(`patterns.${p.name}: regex changed`);
+    for (const s of PII_SURFACES) if (RANK[n.action[s]] < RANK[p.action[s]]) out.push(`patterns.${p.name}.${s}: ${p.action[s]} -> ${n.action[s]}`);
+  }
+  for (const value of next.allow) if (!prev.allow.includes(value)) out.push(`allow: + ${value}`);
+  return out;
+}
+
+const digitsOf = (value: string) => value.replace(/\D/g, "");
+const TIMESTAMP = /\b[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])[ T](?:[01][0-9]|2[0-3]):[0-5][0-9](?::[0-5][0-9](?:\.[0-9]{1,3})?)?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])?\b/g;
+/**
+ * Phone runs: exact source ranges that hold a 9-15 digit number. `single` is set when the run is exactly one number
+ * (the only form the allow list can exempt). An oversized run (numbers separated by spaces) is screened by each
+ * contiguous run of digit-bearing groups and stops at the first valid one; it is never exempt (fails closed).
+ */
+export function phoneRuns(text: string): { start: number; end: number; single?: string }[] {
+  // A complete ISO calendar timestamp is metadata, not a phone-number candidate; the newline keeps neighbours apart.
+  const cleaned = text.replace(TIMESTAMP, match => "\n".repeat(match.length)), out: { start: number; end: number; single?: string }[] = [];
+  for (const match of cleaned.matchAll(/(?<![\p{L}\p{N}])\+?\d(?:[\d ().-]{6,}\d)(?![\p{L}\p{N}])/gu)) {
+    const digits = digitsOf(match[0]), range = { start: match.index!, end: match.index! + match[0].length };
+    if (digits.length >= 9 && digits.length <= 15) { out.push({ ...range, single: digits }); continue; }
+    if (digits.length <= 15) continue;
+    const groups = match[0].split(/\s+/).map(digitsOf).filter(Boolean);
+    search: for (let from = 0; from < groups.length; from++) {
+      let total = 0;
+      for (let to = from; to < groups.length && total <= 15; to++) { total += groups[to]!.length; if (total >= 9 && total <= 15) { out.push(range); break search; } }
+    }
+  }
+  return out;
+}
+function allowedEmail(value: string, allow: string[]): boolean {
+  const lower = value.toLowerCase();
+  return allow.some(entry => entry.includes("@") && (entry.startsWith("@") ? lower.endsWith(entry.toLowerCase()) : lower === entry.toLowerCase()));
+}
+function allowedPhone(digits: string, allow: string[]): boolean {
+  return allow.some(entry => !entry.includes("@") && digitsOf(entry).length >= 9 && digitsOf(entry) === digits);
+}
+interface Rule { label: string; action: PiiAction; invalid?: boolean; matches: (text: string) => { start: number; end: number }[]; detect: (text: string) => boolean }
+/** The non-allow rules for one surface. `detect` short-circuits; `matches` lists raw non-exempt ranges (zero-length included). */
+function rules(vault: VaultSpec, config: VmemConfig, surface: PiiSurface): Rule[] {
+  const m = piiPolicy(vault), out: Rule[] = [];
+  const regexRule = (label: string, action: PiiAction, make: () => RegExp, exempt: (value: string) => boolean): Rule => ({
+    label, action,
+    matches: text => [...text.matchAll(make())].filter(x => !x[0] || !exempt(x[0])).map(x => ({ start: x.index!, end: x.index! + x[0].length })),
+    detect: text => { for (const source of [text, text.normalize("NFKC")]) for (const x of source.matchAll(make())) if (!x[0] || !exempt(x[0])) return true; return false; },
+  });
+  if (m.email[surface] !== "allow") out.push(regexRule("email", m.email[surface], () => new RegExp(EMAIL_PATTERN.source, "gi"), v => allowedEmail(v, m.allow)));
+  if (m.phone[surface] !== "allow") {
+    const flagged = (text: string) => phoneRuns(text).filter(r => !(r.single && allowedPhone(r.single, m.allow)));
+    out.push({ label: "phone", action: m.phone[surface], matches: flagged, detect: text => flagged(text).length > 0 || flagged(text.normalize("NFKC")).length > 0 });
+  }
+  const custom = (config.piiPatterns ?? []).map((regex, i) => ({ name: `custom-${i + 1}`, regex, action: m.custom[surface], flags: "" }));
+  for (const p of [...custom, ...m.patterns.map(p => ({ name: p.name, regex: p.regex, action: p.action[surface], flags: "u" }))]) {
+    if (p.action === "allow") continue;
+    try { new RegExp(p.regex, p.flags); } catch { out.push({ label: p.name, action: "deny", invalid: true, matches: () => [], detect: () => true }); continue; }
+    out.push(regexRule(p.name, p.action, () => new RegExp(p.regex, `${p.flags}g`), v => m.allow.some(a => a.toLowerCase() === v.toLowerCase())));
+  }
+  return out;
+}
+/** V07 issues for one surface: deny cells are errors, warn cells warnings. Matched values are never returned. */
+export function screenPii(text: string, vault: VaultSpec, config: VmemConfig, surface: PiiSurface): WriteIssue[] {
+  const issues: WriteIssue[] = [];
+  for (const rule of rules(vault, config, surface)) {
+    if (rule.invalid) { if (!issues.some(i => i.message === "invalid PII screening configuration")) issues.push({ code: "V07", severity: "error", message: "invalid PII screening configuration" }); continue; }
+    if (!rule.detect(text)) continue;
+    const builtin = rule.label === "email" || rule.label === "phone", custom = rule.label.startsWith("custom-");
+    const message = rule.action === "deny"
+      ? builtin ? "PII is refused by the vault policy" : custom ? "configured PII pattern matched" : `PII pattern ${rule.label} matched`
+      : `PII flagged by the vault policy (${builtin || custom ? rule.label.replace(/-\d+$/, "") : `pattern ${rule.label}`}, warn)`;
+    if (!issues.some(i => i.message === message)) issues.push({ code: "V07", severity: rule.action === "deny" ? "error" : "warning", message });
+  }
+  return issues;
+}
+/**
+ * Replace raw ranges that a deny cell refuses on this surface with `[redacted]` (tidy --log), leaving allow-listed
+ * values intact. Fails closed to a fully redacted text when a denied match is zero-length, or when the returned text
+ * itself still contains a denied match (for example a form only NFKC normalization reveals, or a pattern that matches
+ * the marker).
+ */
+export function redactPii(text: string, vault: VaultSpec, config: VmemConfig, surface: PiiSurface): { text: string; hits: number } {
+  const denied = rules(vault, config, surface).filter(rule => rule.action === "deny" && !rule.invalid);
+  if (!denied.some(rule => rule.detect(text))) return { text, hits: 0 };
+  const ranges = denied.flatMap(rule => rule.matches(text));
+  if (ranges.some(r => r.end === r.start)) return { text: "[redacted]", hits: 1 };
+  const merged: { start: number; end: number }[] = [];
+  for (const r of ranges.sort((a, b) => a.start - b.start || b.end - a.end)) { const last = merged.at(-1); if (last && r.start < last.end) last.end = Math.max(last.end, r.end); else merged.push({ ...r }); }
+  let out = "", at = 0;
+  for (const r of merged) { out += text.slice(at, r.start) + "[redacted]"; at = r.end; }
+  out += text.slice(at);
+  return denied.some(rule => rule.detect(out)) ? { text: "[redacted]", hits: 1 } : { text: out, hits: merged.length };
+}

package/src/registry.ts

@@ -2,7 +2,8 @@ import { closeSync, constants, fsyncSync, mkdirSync, openSync, readdirSync, read
 import { hostname } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { CONFIG_FILE, MAX_CONFIG_BYTES, parseConfig, parseVault, readConfig, type VaultSpec, type VmemConfig } from "./config.ts";
+import { CONFIG_FILE, MAX_CONFIG_BYTES, parseConfig, parsePii, parseVault, readConfig, type VaultSpec, type VmemConfig } from "./config.ts";
+import { loosenedCells, piiPolicy, piiShorthand } from "./pii.ts";
 export const LOCK_FILE = "config.lock";
 const TEMP = /^\.config-[0-9a-f-]{36}\.tmp$/;
 export interface LockOwner { pid: number; host: string; created: string }
@@ -11,8 +12,8 @@ export function loadRegistry(home: string): VmemConfig {
   if (config.home) throw new Error(`${join(home, CONFIG_FILE)}: redirected home cannot contain another home pointer`);
   return config;
 }
-/** Effective pii policy: explicit value, else deny for org and allow for personal. */
-export function effectivePii(vault: VaultSpec): "allow" | "deny" { return vault.pii ?? (vault.kind === "org" ? "deny" : "allow"); }
+/** Effective pii shorthand (`custom` for a mixed policy); the full matrix is `piiPolicy`. */
+export function effectivePii(vault: VaultSpec): "allow" | "warn" | "deny" | "custom" { return piiShorthand(vault); }
 function message(error: unknown): string { return error instanceof Error ? error.message : String(error); }
 /**
  * Directory fsync makes the rename durable on Linux. On macOS fsync(2) on a directory
@@ -157,10 +158,25 @@ export function removeVault(home: string, id: string, confirm = false): { applie
   };
   return confirm ? mutate(home, remove) : remove(loadRegistry(home));
 }
+/** Show or change a vault's PII policy. Without `confirm` it previews; loosened cells are listed either way. */
+export function setVaultPii(home: string, id: string, value: unknown, confirm = false) {
+  const next = value === undefined ? undefined : parsePii(value);
+  const change = (config: VmemConfig) => {
+    const vault = config.vaults.find(v => v.id === id);
+    if (!vault) throw new Error(`${join(home, CONFIG_FILE)}: unknown vault id ${id}`);
+    const before = piiPolicy(vault);
+    if (next === undefined) return { vault: id, pii: piiShorthand(vault), piiPolicy: before };
+    const updated: VaultSpec = { ...vault, pii: next }, after = piiPolicy(updated);
+    const loosened = loosenedCells(before, after), changed = JSON.stringify(before) !== JSON.stringify(after);
+    if (confirm && changed) vault.pii = next;
+    return { vault: id, applied: confirm && changed, changed, loosened, pii: piiShorthand(updated), piiPolicy: after, ...(confirm ? {} : { preview: true }) };
+  };
+  return confirm && next !== undefined ? mutate(home, change) : change(loadRegistry(home));
+}
 export function registryStatus(home: string) {
   const config = loadRegistry(home);
   return config.vaults.map(vault => {
-    const base = { ...vault, pii: effectivePii(vault) };
+    const base = { ...vault, pii: effectivePii(vault), piiPolicy: piiPolicy(vault) };
     try {
       const root = realpathSync(vault.path), notes = join(root, "notes");
       if (root !== vault.path || realpathSync(notes) !== notes || !statSync(notes).isDirectory()) throw new Error("changed");

package/src/tidy.ts

@@ -11,7 +11,8 @@ import { loadRegistry, syncDirectory } from "./registry.ts";
 import { normalizeSource, sourceReferences, sourceWorkspaceRoot, missingSourceWarnings } from "./source.ts";
 import { appendLog, LOG_LOCK } from "./vault-log.ts";
 import { appendSection, foldConnections, h2Sections } from "./write-operations.ts";
-import { EMAIL_PATTERN, SCHEMA_KEYS, SECRET_PATTERNS, TYPED_KEYS, screenContent } from "./write-validation.ts";
+import { SCHEMA_KEYS, SECRET_PATTERNS, TYPED_KEYS, screenContent } from "./write-validation.ts";
+import { redactPii } from "./pii.ts";
 import { applyWrite, sha256, snapshot } from "./writer.ts";
 import type { WriteIssue } from "./write-types.ts";
 
@@ -281,13 +282,14 @@ function normalizeLogLine(line: string): string | undefined {
   if (seconds && LOG_STRUCTURE.test(seconds[1]! + seconds[2]!)) return seconds[1]! + seconds[2]! + line.slice(body.length);
   return `# legacy: ${line}`;
 }
-function sanitizeLog(text: string): { text: string; lines: number; redactions: number; formats: number; changes: string[] } {
+/** PII is redacted where the vault policy denies it on the log surface; secrets always are. */
+function sanitizeLog(text: string, vault: VaultSpec, config: VmemConfig): { text: string; lines: number; redactions: number; formats: number; changes: string[] } {
   let lines = 0, redactions = 0, formats = 0;
   const changes: string[] = [];
   const out = text.split("\n").map((line, index) => {
     const secret = redact(line);
     let hits = secret.hits, next = secret.text;
-    next = next.replace(new RegExp(EMAIL_PATTERN.source, "gi"), () => { hits++; return "[redacted]"; });
+    const pii = redactPii(next, vault, config, "log"); hits += pii.hits; next = pii.text;
     const normalized = normalizeLogLine(next);
     if (normalized !== undefined) { next = normalized; formats++; }
     if (hits || normalized !== undefined) {
@@ -359,7 +361,7 @@ export function tidyVault(home: string, request: TidyRequest, options: { env?: N
   if (rules.includes("log")) {
     const before = readLogFile(root);
     if (before !== null) {
-      const sanitized = sanitizeLog(before);
+      const sanitized = sanitizeLog(before, vault, config);
       result.log = { lines: sanitized.lines, redactions: sanitized.redactions, formats: sanitized.formats, changes: sanitized.changes };
       if (sanitized.text !== before) { logPlan = { before, ...sanitized }; result.counts.log = sanitized.redactions + sanitized.formats; }
     }

package/src/vault-log.ts

@@ -78,6 +78,7 @@ export function appendLog(home: string, request: LogRequest, options: { env?: No
     }
     const formatted = formatLogEvent(request.event, { ...ctx, env: options.env ?? process.env, now: options.now });
     if (!formatted.line || formatted.issues.some(issue => issue.severity === "error")) { result.issues.push(...formatted.issues); return result; }
+    result.issues.push(...formatted.issues); // nonblocking warnings (for example a log-surface PII warn cell)
     const buffer = Buffer.from(formatted.line), root = ctx.vault.path;
     lockFile = join(root, LOG_LOCK);
     const deadline = Date.now() + 2000, sleeper = new Int32Array(new SharedArrayBuffer(4));

package/src/write-types.ts

@@ -1,3 +1,4 @@
+import type { PiiSurface } from "./config.ts";
 import type { LogEvent, LogReceipt } from "./log-types.ts";
 import type { VaultSpec, VmemConfig } from "./config.ts";
 export type WriteOp =
@@ -32,6 +33,8 @@ export interface ValidationContext {
   /** Original flat notes snapshot, paths prefixed with notes/. */
   notes: Map<string, string>;
   operation: WriteOp;
+  /** PII surface for content screening; `notes` unless an internal caller (org promotion) sets it. */
+  piiSurface?: PiiSurface;
 }
 export interface ChangeReceipt { path: string; beforeSha: string | null; sha256: string | null; bytes: number }
 export interface WriteReceipt {

package/src/write-validation.ts

@@ -6,6 +6,8 @@ import { parseFrontmatter } from "./frontmatter.ts";
 import { extractLinks, normalizeTarget, proseLines, resolveLinks, type Link, type LinkNote, type ResolvedLink } from "./links.ts";
 import { canonicalPath, isDenied } from "./platform.ts";
 import type { PlannedChange, ValidationContext, WriteIssue } from "./write-types.ts";
+import type { PiiSurface } from "./config.ts";
+import { screenPii } from "./pii.ts";
 import { moveSourcePath } from "./write-operations.ts";
 
 const TYPES = new Set(["insight", "decision", "observation", "person", "project", "method", "moc", "reference"]);
@@ -30,50 +32,16 @@ const WIKI_FIELDS = ["topics", "project", "superseded_by", "supersedes", "source
 const SECRETS = [/-----BEGIN [A-Z ]*PRIVATE KEY-----/, /\bAKIA[0-9A-Z]{16}\b/, /\bgh[pousr]_[A-Za-z0-9]{30,}/, /\bgithub_pat_[A-Za-z0-9_]{40,}/, /\bsk-[A-Za-z0-9_-]{20,}/,
   /\bxox[abprs]-[A-Za-z0-9-]{10,}/, /\bAIza[0-9A-Za-z_-]{35}\b/, /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, /\b(?:password|passwd|secret|api[_-]?key|token)\s*[:=]\s*\S{8,}/i];
 export const SECRET_PATTERNS: readonly RegExp[] = SECRETS;
-const EMAIL = /[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9](?:[A-Z0-9.-]*[A-Z0-9])?\.[A-Z]{2,}/i;
-export const EMAIL_PATTERN = EMAIL;
+export { EMAIL_PATTERN } from "./pii.ts";
 const MAX_BYTES = 256 * 1024;
-
 function issue(code: string, message: string, severity: WriteIssue["severity"] = "error", path?: string): WriteIssue {
   return { code, severity, message, ...(path ? { path } : {}) };
 }
-function hasPhone(text: string): boolean {
-  // A complete ISO calendar timestamp is metadata, not a phone-number candidate.
-  const withoutTimestamps = text.replace(/\b[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])[ T](?:[01][0-9]|2[0-3]):[0-5][0-9](?::[0-5][0-9](?:\.[0-9]{1,3})?)?(?:Z|[+-](?:[01][0-9]|2[0-3]):[0-5][0-9])?\b/g, "\n");
-  // The newline replacement is outside the candidate class, so neighbours of a timestamp never merge.
-  const digits = (value: string) => value.replace(/\D/g, "").length;
-  for (const match of withoutTimestamps.matchAll(/(?<![\p{L}\p{N}])\+?\d(?:[\d ().-]{6,}\d)(?![\p{L}\p{N}])/gu)) {
-    const count = digits(match[0]);
-    if (count >= 9 && count <= 15) return true;
-    if (count <= 15) continue;
-    // Oversized run, e.g. two phones separated by spaces: evaluate every contiguous run of
-    // whitespace-separated groups alone so each embedded phone is screened (fails closed).
-    const groups = match[0].split(/\s+/).filter(Boolean);
-    for (let start = 0; start < groups.length; start++) {
-      let total = 0;
-      for (let end = start; end < groups.length && total <= 15; end++) {
-        total += digits(groups[end]!);
-        if (total >= 9 && total <= 15) return true;
-      }
-    }
-  }
-  return false;
-}
-/** Screen the whole prospective text, including frontmatter, without returning matched values. */
-export function screenContent(text: string, vault: VaultSpec, config: VmemConfig): WriteIssue[] {
+/** Screen the whole prospective text, including frontmatter, without returning matched values. Secrets are always refused; PII follows the vault policy for this surface. */
+export function screenContent(text: string, vault: VaultSpec, config: VmemConfig, surface: PiiSurface = "notes"): WriteIssue[] {
   const issues: WriteIssue[] = [];
   if (SECRETS.some(pattern => pattern.test(text))) issues.push(issue("V06", "secret-looking content is refused"));
-  const pii = vault.pii ?? (vault.kind === "org" ? "deny" : "allow");
-  if (pii === "deny") {
-    const normalized = text.normalize("NFKC");
-    if (EMAIL.test(normalized) || hasPhone(normalized)) issues.push(issue("V07", "PII is refused by the vault policy"));
-    for (const pattern of config.piiPatterns ?? []) {
-      try {
-        if (new RegExp(pattern).test(text)) { issues.push(issue("V07", "configured PII pattern matched")); break; }
-      } catch { issues.push(issue("V07", "invalid PII screening configuration")); break; }
-    }
-  }
-  return issues;
+  return [...issues, ...screenPii(text, vault, config, surface)];
 }
 
 /** Quoted escapes must not hide semantic metadata from the same content policy. */
@@ -81,7 +49,8 @@ function screenMetadata(data:Record<string,unknown>,context:ValidationContext,pa
   const found=new Map<string,WriteIssue>(),active=new WeakSet<object>();let nodes=0,bytes=0;
   const inspect=(text:string)=>{
     bytes+=Buffer.byteLength(text);if(bytes>MAX_BYTES*4)throw new Error("budget");
-    for(const item of screenContent(text,context.vault,context.config))found.set(item.code,{...item,path});
+    // One issue per code; an error is never downgraded by a later warning of the same code.
+    for(const item of screenContent(text,context.vault,context.config,context.piiSurface)){const prior=found.get(item.code);if(!prior||(prior.severity!=="error"&&item.severity==="error"))found.set(item.code,{...item,path});}
   };
   const visit=(value:unknown,key:string|undefined,depth:number):void=>{
     if(++nodes>10000||depth>32)throw new Error("budget");
@@ -241,7 +210,7 @@ export function validateWrite(changes: PlannedChange[], context: ValidationConte
     else if (change.path.startsWith("notes/")) final.set(change.path, change.after);
     if (change.after === null) continue;
     if (Buffer.byteLength(change.after) > MAX_BYTES) issues.push(issue("V09", "prospective file exceeds 256 KiB", "error", change.path));
-    issues.push(...screenContent(change.after, context.vault, context.config).map(value => ({ ...value, path: change.path })));
+    issues.push(...screenContent(change.after, context.vault, context.config, context.piiSurface).map(value => ({ ...value, path: change.path })));
     try{issues.push(...screenMetadata(parseFrontmatter(change.after).data,context,change.path));}catch{ /* Invalid note YAML is reported separately; reports remain schema-exempt. */ }
   }
   const sourceRoot=sourceWorkspaceRoot(context.vault);

package/src/writer.ts

@@ -11,6 +11,7 @@ import { parseFrontmatter } from "./frontmatter.ts";
 import { canonicalPath, isDenied } from "./platform.ts";
 import { moveSourcePath, notePath, planOperation, refuse, WriteRefusal } from "./write-operations.ts";
 import { validateWrite } from "./write-validation.ts";
+import type { PiiSurface } from "./config.ts";
 import type { ChangeReceipt, PlannedChange, WriteIssue, WriteReceipt, WriteRequest } from "./write-types.ts";
 export const MUTATION_LOCK = "mutation.lock";
 export const MAX_WRITE_BYTES = 256 * 1024;
@@ -111,7 +112,7 @@ function duplicateWarnings(request: WriteRequest, notes: Map<string, string>, ch
   } finally { db.close(); }
 }
 /** Single mutation entry point. Preview/dry-run perform no writes, including locks and caches. */
-export function applyWrite(home: string, request: WriteRequest, options: { env?: NodeJS.ProcessEnv } = {}): WriteReceipt {
+export function applyWrite(home: string, request: WriteRequest, options: { env?: NodeJS.ProcessEnv; piiSurface?: PiiSurface } = {}): WriteReceipt {
   let lockFd: number | undefined, lockFile: string | undefined, lockIdentity: { ino: number; dev: number } | undefined;
   let index: VaultIndex | undefined;
   const temps = new Set<string>(), createdDirs: string[] = [], committed: PlannedChange[] = [];
@@ -150,11 +151,11 @@ export function applyWrite(home: string, request: WriteRequest, options: { env?:
     }
     changes = planOperation(request.operation, notes, reportBefore);
     for (const change of changes) if (isDenied(join(root, change.path), config.denyPaths)) refuse("V06", "planned mutation path is denied", change.path);
-    issues = validateWrite(changes, { vault, config, notes, operation: request.operation });
+    issues = validateWrite(changes, { vault, config, notes, operation: request.operation, ...(options.piiSurface ? { piiSurface: options.piiSurface } : {}) });
     if (!issues.some(issue => issue.severity === "error")) issues.push(...duplicateWarnings(request, notes, changes));
     const input = { vault: request.vault, channel: request.channel ?? "cli", operation: request.operation, expectedShas: request.expectedShas ?? {}, log: request.log ?? null };
     const identity = lstatSync(root);
-    fingerprint = sha256(canonical({ input, vault, policy: { denyPaths: config.denyPaths ?? [], piiPatterns: config.piiPatterns ?? [] }, root, identity: [identity.dev, identity.ino], files: [...notes].map(([path, text]) => [path, sha256(text)]), changes: receipts(changes) }));
+    fingerprint = sha256(canonical({ input, vault, policy: { denyPaths: config.denyPaths ?? [], piiPatterns: config.piiPatterns ?? [], piiSurface: options.piiSurface ?? "notes" }, root, identity: [identity.dev, identity.ino], files: [...notes].map(([path, text]) => [path, sha256(text)]), changes: receipts(changes) }));
     if (twoStep && request.confirm === true && (typeof request.fingerprint !== "string" || request.fingerprint !== fingerprint)) refuse("V09", "stale or missing preview fingerprint");
     if (issues.some(issue => issue.severity === "error")) return result = { ok: false, applied: false, issues, changes: receipts(changes), fingerprint, indexUpdated: false };
     if (preview) return result = { ok: true, applied: false, preview: true, ...(request.operation.op === "link" && !changes.length ? {unchanged:true} : {}), issues, changes: receipts(changes), fingerprint, indexUpdated: false };