ciphergate-cli 0.15.0__tar.gz → 0.17.0__tar.gz

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/CHANGELOG.md

@@ -6,6 +6,64 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-11-02
+
+Policies can now be built in layers. A shipped baseline pack, a jurisdiction pack (US, EU or
+India) and your own small file merge into one policy, and a later layer cannot quietly weaken
+an earlier one. The packs are templates requiring review, not legal or compliance advice.
+
+### Added
+
+- Policy layering: `extends: [pack, ...]` builds one effective policy from shipped packs plus
+  your own file. Layers merge so that a later layer can never quietly weaken an earlier one.
+  Conflicting context pins, weaker settings or requirements, disabled detectors, and rules or
+  defaults that would override an earlier block, review or transform with something weaker
+  fail validation. A rule may weaken an earlier rule or default only by naming it in the new
+  `relaxes` field; this is reported as a warning. Earlier `hard` and `guardrail` rules can
+  never be relaxed.
+- Shipped packs (templates requiring review): `healthcare_baseline`, a strict global healthcare
+  default, and `us_hipaa`, field classifications modelled on the HIPAA Safe Harbor identifier
+  list, with ages over 89 shown as `90+`. `us_hipaa` is not Safe Harbor or Expert Determination
+  by itself.
+- New template `hospital_us_override`, an example hospital layer on top of `us_hipaa`.
+- Packs `eu_gdpr` and `india_dpdp` (templates requiring review, not legal advice). `eu_gdpr`
+  blocks GDPR Art. 9 special-category fields toward external destinations and reviews them
+  elsewhere, and finds member-state identifier fields plus Italian codice fiscale values.
+  `india_dpdp` finds grouped Aadhaar numbers, ABHA numbers and addresses, PAN and Indian
+  identifier fields, and blocks SPDI-style sensitive fields toward external destinations. One
+  policy can extend several jurisdiction packs.
+
+### Changed
+
+- When equally protective findings overlap in one value, the more confident one now names the
+  redaction marker (for example a grouped Aadhaar number is marked `pii.government_id`, not
+  `pii.phone`). What gets removed is unchanged.
+- Reports list the policy's layers (name, kind, source, file digest), and each decision names
+  the layer that made it. `policy.digest` now covers every layer. `validate-policy` prints the
+  layer chain and adds `layers` to its JSON output. The terminal summary and the review page
+  show the layer next to the rule id.
+
+## [0.16.0] - 2026-11-02
+
+`ciphergate review` writes a local HTML page that shows, as a trace, what sanitize would change
+and how the run went. The CLI's other commands and the report format are unchanged.
+
+### Added
+
+- `ciphergate review INPUT --policy P -o page.html` writes one local HTML page that shows
+  what sanitize would change. It covers findings, how many are transformed, kept, blocked
+  or waiting for review, a per-category table, rescan results, possible partial finds,
+  and each record with its changes highlighted and labelled with category, action, rule
+  and reason code. No sanitized file is written. The page holds the would-be output; the
+  raw input is added only with `--include-input`. The page has no scripts, loads nothing,
+  is written atomically, and is not overwritten without `--force`. The exit code matches
+  `plan`. The page is laid out as a trace: a tree of the run, its steps with timings, and the
+  records; each record opens as Input and Output panels.
+- `scripts/benchmark/ner_names.py` measures the optional NER detector on generated log lines.
+  With `en_core_web_sm` it found any part of 57-59% of names and the whole name in 41%, missed
+  most lowercase and upper-case names, and flagged 3 of 16 name-free lines. Details and limits
+  are in `docs/detector-coverage.md`. The detector itself is unchanged.
+
 ## [0.15.0] - 2026-11-02
 
 JSON reports now include the next-step hints, so CI pipelines can act on them. The field is new;
@@ -395,7 +453,9 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.15.0...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.17.0...HEAD
+[0.17.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.16.0...v0.17.0
+[0.16.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.13.0...v0.14.0
 [0.13.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.12.0...v0.13.0

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.15.0
+Version: 0.17.0
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.15.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.17.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -91,6 +91,8 @@ inspect  ->  plan  ->  sanitize --apply  ->  rescan
   and its source, gates, key *status* (never key material), no raw values or fingerprints.
   A failed run's report lists `next_steps` as `{"code", "message"}` pairs, the same hints the
   terminal prints as `next:` lines, so CI can act on them.
+- **Review page:** `ciphergate review` writes one local HTML file that shows what sanitize
+  would change, record by record, with run metrics. See [Review page](#review-page).
 
 ## Install
 
@@ -230,14 +232,40 @@ controlled pipeline configuration.
 ## Shipped policy templates (review before use)
 
 `dev_local`, `stg_test`, `prd_external_ai`, `developer_logs`, `test_dataset`, `external_ai`,
-`healthcare_template`, `financial_template`, `local_debug`, and `multi_environment` (one policy
+`healthcare_template`, `financial_template`, `local_debug`, `hospital_us_override` (a layered example, see below), and `multi_environment` (one policy
 whose outcomes vary by environment *and* destination). All validate in CI. Templates named for
 healthcare or finance are starting points, **not** HIPAA/PCI controls.
 
+### Policy layering
+
+A policy can `extends:` shipped packs, so a team keeps only its own differences in a small file:
+
+```text
+healthcare_baseline  (global strict default)  ->  us_hipaa  (US identifier list)  ->  your file
+```
+
+```bash
+ciphergate init --template hospital_us_override --output my-hospital.yml
+ciphergate validate-policy my-hospital.yml
+#   layers: healthcare_baseline -> us_hipaa -> hospital-us-override
+```
+
+A later layer can add context, detectors, classifications and stricter rules. It cannot quietly
+weaken an earlier one: a weaker setting, a disabled detector or a rule that would override a
+block, review or redaction with something weaker fails validation unless the rule names what it
+relaxes (`relaxes: [rule-id]`), which is then reported as a warning. Hard and guardrail rules
+can never be relaxed. Reports list every layer with its digest and show which layer decided
+each value. Jurisdiction packs: `us_hipaa` (modelled on the HIPAA Safe Harbor identifier list
+but **not** Safe Harbor or Expert Determination by itself), `eu_gdpr` (GDPR special categories
+and member-state identifiers) and `india_dpdp` (Aadhaar, ABHA, PAN and sensitive fields). None
+of them is legal advice or makes processing lawful. A policy can extend several. See
+[docs/policy-schema.md](docs/policy-schema.md#layering-extends).
+
 ## Commands and exit codes
 
-`init`, `validate-policy`, `inspect`, `plan`, `sanitize` (needs `--apply`), `rescan`, `explain`
-(decision for a hypothetical finding — no data needed). All support `--help`.
+`init`, `validate-policy`, `inspect`, `plan`, `sanitize` (needs `--apply`), `rescan`, `review`
+(local HTML page, see below), `explain` (decision for a hypothetical finding — no data
+needed). All support `--help`.
 
 Common options: `--policy`, `--format csv|json|jsonl|text|logfmt|jsonlog|accesslog|syslog|stacktrace`, `--report PATH`,
 `--report-format json|text` (JSON without `--report` prints only JSON on stdout),
@@ -485,6 +513,50 @@ kubectl logs my-pod | ciphergate sanitize - --format text --policy policies/prd_
 | 8 | Unexpected internal error (safe message) |
 | 130 | Interrupted (no output published) |
 
+### Review page
+
+`ciphergate review` runs the same steps as `sanitize --apply`, including the rescan, but writes
+no sanitized file. It writes one HTML page instead:
+
+```bash
+ciphergate review app.log --policy policies/developer_logs.yml   --environment dev --destination local_dev -o build/review.html
+```
+
+Open the file in a browser. It is laid out like a trace: a tree on the left, details of the
+selected item on the right.
+
+- **review run:** a verdict, then metrics. These include findings and how many are
+  transformed, kept by an `allow` rule, need review or are blocked (with percentages), records
+  with findings, values changed, records dropped, rescan results and possible partial finds.
+- **Steps**, with measured timings: the plan pass (read input, detect, decide), transform,
+  rescan and output.
+  - *detect* shows counts by category, detector and confidence.
+  - *decide* shows the policy and context, what happened to each category, counts by action,
+    rule and reason code, plus gates and key status.
+- **Records with findings:** each one opens as Input and Output panels with a decisions table.
+  Changed parts are highlighted, and hovering over one shows its category, action, rule and
+  reason code. Values kept by an `allow` rule are underlined. A dashed outline marks a
+  *possible partial find*: a replaced name or address next to a capitalised word that stayed.
+  This is a hint, not a check.
+
+What the page contains, and how to handle it:
+
+- By default it contains the would-be **output**, not the input. Treat it like the sanitized
+  file: detectors can miss values.
+- `--include-input` also adds the **raw input** next to the output, with a warning banner. A
+  page made with it must be handled like the original file. Do not share, upload or commit it.
+- If the run is blocked, needs review or a key is missing, there is no output preview. The page
+  shows the plan and the decisions for each record. Planned transforms are labelled as not run.
+- There are no default locations: `-o` is required. `build/` is in `.gitignore`. The page is not
+  overwritten without `--force`, can't be the input or the policy file, and is written
+  atomically (0600 on POSIX). Directories and stdin/stdout are not supported.
+- The page has no scripts and a Content-Security-Policy that blocks all loads, so opening it
+  makes no network request. All text is escaped.
+- The exit code is the plan's: 0 ready, 1 blocked/review, 6 key/config, 7 rescan found gating
+  findings. Use `sanitize` and `rescan` as the CI gate. Up to 500 records are shown, each cut
+  to 4,000 characters; the counts include all records. It takes a little longer than
+  `sanitize` (about 15% on a 40,000-line synthetic log).
+
 ### Troubleshooting
 
 - `destination_required_but_missing` — pass `--destination` (and `--environment`).

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.15.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.17.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -52,6 +52,8 @@ inspect  ->  plan  ->  sanitize --apply  ->  rescan
   and its source, gates, key *status* (never key material), no raw values or fingerprints.
   A failed run's report lists `next_steps` as `{"code", "message"}` pairs, the same hints the
   terminal prints as `next:` lines, so CI can act on them.
+- **Review page:** `ciphergate review` writes one local HTML file that shows what sanitize
+  would change, record by record, with run metrics. See [Review page](#review-page).
 
 ## Install
 
@@ -191,14 +193,40 @@ controlled pipeline configuration.
 ## Shipped policy templates (review before use)
 
 `dev_local`, `stg_test`, `prd_external_ai`, `developer_logs`, `test_dataset`, `external_ai`,
-`healthcare_template`, `financial_template`, `local_debug`, and `multi_environment` (one policy
+`healthcare_template`, `financial_template`, `local_debug`, `hospital_us_override` (a layered example, see below), and `multi_environment` (one policy
 whose outcomes vary by environment *and* destination). All validate in CI. Templates named for
 healthcare or finance are starting points, **not** HIPAA/PCI controls.
 
+### Policy layering
+
+A policy can `extends:` shipped packs, so a team keeps only its own differences in a small file:
+
+```text
+healthcare_baseline  (global strict default)  ->  us_hipaa  (US identifier list)  ->  your file
+```
+
+```bash
+ciphergate init --template hospital_us_override --output my-hospital.yml
+ciphergate validate-policy my-hospital.yml
+#   layers: healthcare_baseline -> us_hipaa -> hospital-us-override
+```
+
+A later layer can add context, detectors, classifications and stricter rules. It cannot quietly
+weaken an earlier one: a weaker setting, a disabled detector or a rule that would override a
+block, review or redaction with something weaker fails validation unless the rule names what it
+relaxes (`relaxes: [rule-id]`), which is then reported as a warning. Hard and guardrail rules
+can never be relaxed. Reports list every layer with its digest and show which layer decided
+each value. Jurisdiction packs: `us_hipaa` (modelled on the HIPAA Safe Harbor identifier list
+but **not** Safe Harbor or Expert Determination by itself), `eu_gdpr` (GDPR special categories
+and member-state identifiers) and `india_dpdp` (Aadhaar, ABHA, PAN and sensitive fields). None
+of them is legal advice or makes processing lawful. A policy can extend several. See
+[docs/policy-schema.md](docs/policy-schema.md#layering-extends).
+
 ## Commands and exit codes
 
-`init`, `validate-policy`, `inspect`, `plan`, `sanitize` (needs `--apply`), `rescan`, `explain`
-(decision for a hypothetical finding — no data needed). All support `--help`.
+`init`, `validate-policy`, `inspect`, `plan`, `sanitize` (needs `--apply`), `rescan`, `review`
+(local HTML page, see below), `explain` (decision for a hypothetical finding — no data
+needed). All support `--help`.
 
 Common options: `--policy`, `--format csv|json|jsonl|text|logfmt|jsonlog|accesslog|syslog|stacktrace`, `--report PATH`,
 `--report-format json|text` (JSON without `--report` prints only JSON on stdout),
@@ -446,6 +474,50 @@ kubectl logs my-pod | ciphergate sanitize - --format text --policy policies/prd_
 | 8 | Unexpected internal error (safe message) |
 | 130 | Interrupted (no output published) |
 
+### Review page
+
+`ciphergate review` runs the same steps as `sanitize --apply`, including the rescan, but writes
+no sanitized file. It writes one HTML page instead:
+
+```bash
+ciphergate review app.log --policy policies/developer_logs.yml   --environment dev --destination local_dev -o build/review.html
+```
+
+Open the file in a browser. It is laid out like a trace: a tree on the left, details of the
+selected item on the right.
+
+- **review run:** a verdict, then metrics. These include findings and how many are
+  transformed, kept by an `allow` rule, need review or are blocked (with percentages), records
+  with findings, values changed, records dropped, rescan results and possible partial finds.
+- **Steps**, with measured timings: the plan pass (read input, detect, decide), transform,
+  rescan and output.
+  - *detect* shows counts by category, detector and confidence.
+  - *decide* shows the policy and context, what happened to each category, counts by action,
+    rule and reason code, plus gates and key status.
+- **Records with findings:** each one opens as Input and Output panels with a decisions table.
+  Changed parts are highlighted, and hovering over one shows its category, action, rule and
+  reason code. Values kept by an `allow` rule are underlined. A dashed outline marks a
+  *possible partial find*: a replaced name or address next to a capitalised word that stayed.
+  This is a hint, not a check.
+
+What the page contains, and how to handle it:
+
+- By default it contains the would-be **output**, not the input. Treat it like the sanitized
+  file: detectors can miss values.
+- `--include-input` also adds the **raw input** next to the output, with a warning banner. A
+  page made with it must be handled like the original file. Do not share, upload or commit it.
+- If the run is blocked, needs review or a key is missing, there is no output preview. The page
+  shows the plan and the decisions for each record. Planned transforms are labelled as not run.
+- There are no default locations: `-o` is required. `build/` is in `.gitignore`. The page is not
+  overwritten without `--force`, can't be the input or the policy file, and is written
+  atomically (0600 on POSIX). Directories and stdin/stdout are not supported.
+- The page has no scripts and a Content-Security-Policy that blocks all loads, so opening it
+  makes no network request. All text is escaped.
+- The exit code is the plan's: 0 ready, 1 blocked/review, 6 key/config, 7 rescan found gating
+  findings. Use `sanitize` and `rescan` as the CI gate. Up to 500 records are shown, each cut
+  to 4,000 characters; the counts include all records. It takes a little longer than
+  `sanitize` (about 15% on a 40,000-line synthetic log).
+
 ### Troubleshooting
 
 - `destination_required_but_missing` — pass `--destination` (and `--environment`).

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/docs/architecture.md

@@ -33,6 +33,7 @@ Report (reporting/)            privacy-safe JSON / text summary
 | `readers/` | Parse and write each format; limits; encodings; JSON Pointer paths | decide actions |
 | `detectors/` | Produce candidate findings; per-run `DetectorSet` (no global registry) | decide actions |
 | `policy/loader.py` | Safe YAML (no tags, no aliases, no duplicate keys, size limit) | execute code |
+| `policy/layers.py` | Resolve `extends` (shipped packs by name), merge layers, reject weakening | read local files by name |
 | `policy/validator.py` | Schema + semantic checks, compile into immutable `Policy` | — |
 | `policy/precedence.py` | Computed precedence levels and static overlap analysis | — |
 | `policy/context.py` | Pinned vs caller context, run-level gates | infer one context dimension from another |
@@ -40,6 +41,7 @@ Report (reporting/)            privacy-safe JSON / text summary
 | `transforms/` | Execute approved actions; HMAC pseudonyms; key lookup | log values or keys |
 | `pipeline/` | Orchestration, two passes, rescan, atomic output, path safety | publish on any failure |
 | `reporting/` | Report building, control-char escaping, field-path masking, rendering | include values/fingerprints |
+| `pipeline/review.py`, `reporting/review_page.py` | `review`: sanitize steps without publishing, per-record changes, local HTML page | publish output, add input without `--include-input`, load anything |
 | `cli.py` | Typer CLI, exit codes, safe error rendering, SIGTERM -> interrupt | enable rich tracebacks (they print locals) |
 
 ## Why two passes

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/docs/detector-coverage.md

@@ -32,8 +32,31 @@ in `tests/unit/test_presidio_ner.py` use a fake engine. `tests/integration/test_
 runs the real Presidio with `en_core_web_sm`: it finds a common synthetic name and place, ignores
 text with no entities, removes them in a `sanitize` run with network access disabled, and fails
 closed when the model is missing. CI runs it in the `ner` job (not a required check). These are
-smoke tests on a few sentences: accuracy on real text has not been measured by this project,
-and the small model misses names that the larger `en_core_web_lg` may find.
+smoke tests on a few sentences.
+
+`scripts/benchmark/ner_names.py` measures name detection on 320 generated log lines (8 regions x
+5 ways of writing a name x 8 lines) plus 16 name-free lines. With `en_core_web_sm` (spaCy 3.8,
+Presidio 2.2.366), seeds 7 and 11:
+
+| | seed 7 | seed 11 |
+|---|---|---|
+| names with any part found | 184/320 (57%) | 190/320 (59%) |
+| names found in full | 130/320 (41%) | 132/320 (41%) |
+| name-free lines flagged | 3/16 | 3/16 |
+
+- When only part of a name is found, the rest stays in the output (for example the family name).
+- `First Last` and `Last, First` are found most often (50-61 of 64). Lowercase (27/64) and
+  upper-case (15/64) names are mostly missed.
+- English, Chinese and German names were found more often (27-35 of 40) than Indian and West
+  African names (12-17 of 40).
+- The false alarms were product names (`Kafka`, `Jenkins`, `Grafana`).
+- `min_score` from 0.4 to 0.85 changed nothing: Presidio gives these spaCy entities one fixed
+  score, so the threshold cannot trade misses against false alarms with this model.
+- The default `en_core_web_lg` was not measured. Run the script with `--model en_core_web_lg`
+  after installing it.
+
+These are synthetic lines written by the project, not a public accuracy claim. Treat the NER
+detector as an extra layer: do not rely on it alone to remove names, especially from free text.
 
 ## Text/log specifics
 

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/docs/limitations.md

@@ -17,6 +17,23 @@
 - Environment, target environment and destination are declared by the caller or policy and are
   not verified. CipherGate does not inspect cloud identity or control deployments.
 
+## Policy layering
+
+- `extends` names shipped packs only; a policy cannot extend a local file in this release.
+- The weakening check compares rule selectors statically and conservatively: it can reject a
+  rule that would never actually override the earlier one (narrow the selectors or use
+  `relaxes`), and it cannot see differences that depend on detector behaviour.
+- The `us_hipaa` pack does not implement the 3-digit ZIP allowance (whole ZIP codes are
+  redacted), cannot check the Safe Harbor "no actual knowledge" condition, does not parse
+  photos or biometric data, and cannot know every "other unique identifying number". It is
+  not Safe Harbor or Expert Determination by itself.
+- The `eu_gdpr` pack finds most national identifiers by field name only (the Italian codice
+  fiscale also by value). It cannot decide a lawful basis, an Art. 9(2) condition or whether a
+  destination is outside the EEA.
+- The `india_dpdp` pack finds Aadhaar numbers by value only when written in groups and does not
+  verify the Verhoeff checksum; voter ID, passport and licence numbers are found by field name
+  only. It cannot check consent, purpose limitation, retention or cross-border rules.
+
 ## Formats and processing
 
 - JSON is parsed as a whole document (default limit 32 MiB). CSV/JSONL/text are streamed with

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/docs/policy-schema.md

@@ -10,6 +10,7 @@ Validate with `ciphergate validate-policy FILE` (never reads data).
 |---|---|---|---|
 | `policy_version` | `1` | required | other versions rejected |
 | `name` | slug `[a-z0-9][a-z0-9_.-]{0,63}` | required | also the default pseudonym namespace |
+| `extends` | list of shipped pack names (max 4) | `[]` | build on [policy packs](#layering-extends) |
 | `metadata` | mapping | `{}` | free-form extension namespace; not interpreted |
 | `context` | [Context](#context) | all unset | pinned context |
 | `requirements` | `{environment, target_environment, destination}` booleans | `true, false, true` | which context must be present (a run without a destination is still treated as untrusted; turning the requirement off warns) |
@@ -181,6 +182,77 @@ future. Requires `strict: true` and the rescan gate; validation always warns, an
 expire automatically — review them. No shipped policy contains an
 approval. Rules still apply — an approval does not allow raw data through.
 
+## Layering (`extends`)
+
+A policy can build on shipped **packs** instead of repeating them:
+
+```yaml
+policy_version: 1
+name: my-hospital
+extends: [us_hipaa]          # us_hipaa itself extends healthcare_baseline
+context: {environment: prd, target_environment: external, destination: external_ai}
+classifications:
+  - {id: local-ids, field_names: [visit_number], category: pii.customer_identifier}
+```
+
+Shipped packs (`policies/packs/`, all **templates requiring review**):
+
+| Pack | Extends | What it adds |
+|---|---|---|
+| `healthcare_baseline` | — | Strict default for healthcare-style data anywhere: credentials hard-blocked; clinical values blocked toward external/unknown destinations and sent to review elsewhere; identifiers redacted; DOB and clinical dates cut to the year; internal infrastructure redacted; everything else review. Needs no key. |
+| `us_hipaa` | `healthcare_baseline` | Field classifications modelled on the 18 HIPAA Safe Harbor identifier types (geography, dates, ages, record/plan/account numbers, licenses, vehicles, devices, URLs, biometrics, photos); ages banded with 90 and over as `90+`. It is **not** Safe Harbor or Expert Determination by itself: the 3-digit ZIP allowance and the "no actual knowledge" condition are not implemented, binary photos/biometrics are not parsed, and free-text detection is incomplete. |
+| `eu_gdpr` | `healthcare_baseline` | GDPR Art. 9 special-category fields (genetic, biometric, ethnic origin, religion, political opinion, trade union, sex life/orientation) blocked toward external/unknown destinations and reviewed elsewhere; national and health-insurance id fields from several member states plus an Italian codice fiscale value pattern; ages banded. It cannot decide a lawful basis or Chapter V transfers, and pseudonymised data is still personal data, so it redacts by default. |
+| `india_dpdp` | `healthcare_baseline` | Aadhaar (field name, and value when grouped as `1234 5678 9012`; no Verhoeff check; unseparated 12 digits by field name only), ABHA numbers and `@abdm`/`@sbx` addresses, PAN (value and field), EPIC/passport/licence/ration card/UHID fields, PIN codes as address; SPDI-style sensitive fields blocked toward external/unknown destinations and reviewed elsewhere; ages banded. It cannot decide consent, purpose, retention or cross-border rules. |
+
+`policies/hospital_us_override.yml` is an example third layer (`ciphergate init --template
+hospital_us_override`). A policy may extend several jurisdiction packs at once (for example
+`extends: [us_hipaa, eu_gdpr, india_dpdp]` for a hospital group); the strictest combination
+applies.
+
+**Resolution.** Names are compared to the shipped packs and never used as paths; local files
+cannot be extended in this release. Packs may extend packs (at most 4 levels, 8 layers; cycles
+are rejected). Layers are ordered base first, your policy last; a pack reached twice is used once.
+Every check in this document then runs on the merged policy.
+
+**Merge rules — a later layer can never quietly weaken an earlier one:**
+
+| Part | Merge | Rejected (validation error) |
+|---|---|---|
+| `context` | later layers may pin unset fields | pinning a different value (`layer_context_conflict`); `allow_cli_override` for a field an earlier layer pinned without allowing overrides (`layer_weakens_context`) |
+| `requirements` | any layer requiring a field requires it | setting `false` where an earlier layer has `true` (`layer_weakens_setting`) |
+| `settings` | stricter value kept: `strict`, `fail_on_parse_error`, `scan_json_keys`, `rescan.enabled` (true), `unknown_sensitive_behavior` (`block` > `review`), `csv_duplicate_headers` (`reject`), `malformed_record_action` (unset); `rescan.fail_on_categories` lists are combined (an unset value contributes every high-risk category) | a weaker value (`layer_weakens_setting`) |
+| `detectors` | custom detectors and internal host suffixes are added; enabling Presidio is allowed | disabling a detector or Presidio that an earlier layer runs, or turning off `reject_risky_regex` (`layer_weakens_detectors` / `layer_weakens_setting`) |
+| `custom_categories`, `transfers` | combined | — |
+| `classifications`, `rules` | combined | reusing an id from an earlier layer (`duplicate_id`) |
+| `defaults` | a later default replaces an earlier one for the same selector | a later default that would take over a category from an earlier default with a weaker action (`layer_weakens_default`) |
+| `name`, `metadata` | the last layer's | — |
+
+**Rules.** Actions are ranked `block` > `review` > any transform > `allow`. A later rule that
+[outranks](#precedence-deterministic) an earlier rule it may overlap with and picks a lower-ranked
+action fails with `layer_weakens_rule`. To do it on purpose, name the earlier rule in
+`relaxes`:
+
+```yaml
+rules:
+  - id: hospital-keep-state
+    priority: 300
+    match: {categories: [location.coarse], field_names: [state]}
+    action: allow
+    relaxes: ["defaults:location.*"]    # or an earlier rule id
+```
+
+Each relaxation is printed as a validation warning and appears in every run report's warnings.
+`hard` and `guardrail` rules from an earlier layer can **never** be relaxed. A later `allow` rule
+over categories an earlier non-allow default handles needs `relaxes: ["defaults:<selector>"]`.
+Swapping one transform for another (for example `pseudonymize` instead of `redact`) needs no
+`relaxes`. `relaxes` is rejected in a policy without `extends`, and must name a rule or default
+from an earlier layer.
+
+**Provenance.** `validate-policy` prints the layer chain. Reports add `policy.layers` (each
+layer's name, kind, source and file digest) and each decision's `layer`; `policy.digest` covers
+every layer in order, so editing any pack changes it. With `--path-display redacted` your own
+policy file name is hidden; shipped pack names are kept.
+
 ## Invalid examples
 
 ```yaml

{ciphergate_cli-0.15.0 → ciphergate_cli-0.17.0}/docs/security-and-privacy.md

@@ -75,6 +75,21 @@ values are replaced with `<redacted-key>`; control and bidi characters are escap
 Logging uses the standard library and never receives values. `--verbose` lists more items;
 `--debug` adds traceback frame locations for internal errors without exception messages.
 
+## Review page
+
+`ciphergate review` is the only command that puts data into a file other than the output. By
+default the page holds the would-be sanitized output, so it is as sensitive as that output.
+With `--include-input` it also holds the raw input and must be handled like the input; the
+page and the command's stderr both say so. The JSON report never contains either.
+
+The would-be output is written to a `mkstemp` file in the page's directory, rescanned, and
+always removed; it is never published. The page itself uses the same atomic,
+no-overwrite-by-default writer as outputs and refuses the input and policy paths. It contains
+no scripts. A Content-Security-Policy (`default-src 'none'`) and `no-referrer` stop any load
+or request, and every text is HTML-escaped with control and bidi characters shown as escapes.
+Field paths in the decision tables use the same masking as reports. The possible-partial-find
+mark is a heuristic and can miss partial finds or flag whole ones.
+
 ## Files
 
 Inputs must be regular files (FIFOs/devices refused). A directory INPUT starts a batch run:

ciphergate_cli-0.17.0/policies/hospital_us_override.yml

@@ -0,0 +1,46 @@
+# TEMPLATE REQUIRING REVIEW. Example of the third policy layer: one hospital's own small file on
+# top of the shipped packs (healthcare_baseline -> us_hipaa -> this file). Replace the synthetic
+# formats and field names below with your own. Using it does NOT perform HIPAA Safe Harbor or
+# Expert Determination and is not legal or compliance advice.
+#
+# A layer like this can add context, detectors, classifications and stricter rules. It cannot
+# quietly weaken the packs: a weaker setting or a rule that would override a pack's block,
+# review or redaction with something weaker fails validation unless it names that rule (or
+# default) in `relaxes`, which is then printed as a warning and recorded in every report.
+policy_version: 1
+name: hospital-us-override
+extends: [us_hipaa]
+metadata:
+  description: "Example hospital layer for PRD logs going to an external AI assistant. Template requiring review."
+context:
+  environment: prd
+  target_environment: external
+  destination: external_ai
+  use_case: debugging
+requirements:
+  target_environment: true
+detectors:
+  custom:
+    # Synthetic local record-number format; replace with the hospital's real format.
+    - id: hospital-record-number
+      category: pii.customer_identifier
+      pattern: '\bHRN-[0-9]{8}\b'
+      confidence: 0.9
+classifications:
+  - id: hospital-local-ids
+    field_names: [visit_number, encounter_id, bed_assignment, wristband_id]
+    category: pii.customer_identifier
+  - id: hospital-state
+    field_names: [state, state_code]
+    category: location.coarse
+rules:
+  # Safe Harbor keeps the state; the baseline redacts all locations by default, so keeping it
+  # is a deliberate, recorded relaxation.
+  - id: hospital-keep-state
+    priority: 300
+    match:
+      categories: [location.coarse]
+      field_names: [state, state_code]
+    action: allow
+    relaxes: ["defaults:location.*"]
+    reason: state_is_kept_for_regional_debugging

ciphergate_cli-0.17.0/policies/packs/eu_gdpr.yml

@@ -0,0 +1,78 @@
+# TEMPLATE REQUIRING REVIEW. Layering pack for EU healthcare-style data, built on
+# healthcare_baseline. It is modelled on GDPR concepts but using it does NOT make processing
+# lawful and is not legal or compliance advice. GDPR has no fixed identifier list like HIPAA
+# Safe Harbor: whether data is personal depends on whether a person is identifiable by any
+# means reasonably likely to be used (Recital 26). Detection is incomplete, especially in free
+# text and in languages other than English.
+#
+# What this pack adds on top of the baseline:
+#  * Art. 9 special categories (health is already covered by the baseline; this adds genetic,
+#    biometric, racial or ethnic origin, political opinions, religious or philosophical
+#    beliefs, trade union membership, sex life and sexual orientation fields): blocked toward
+#    external/unknown destinations, human review everywhere else;
+#  * national and health-insurance identifier fields from several member states, plus a value
+#    pattern for the Italian codice fiscale; other national numbers are found by field name only;
+#  * ages banded by 10 (90 and over as "90+"), like the other jurisdiction packs.
+#
+# Things this pack cannot decide for you:
+#  * a lawful basis and an Art. 9(2) condition for the processing;
+#  * Chapter V international transfers: an `external_ai` or `external_vendor` destination may
+#    be outside the EEA, and CipherGate does not know where a destination is;
+#  * whether a keyed pseudonym is acceptable: pseudonymised data is still personal data
+#    (Art. 4(5), Recital 26), so this pack redacts rather than pseudonymizes by default.
+policy_version: 1
+name: eu-gdpr
+extends: [healthcare_baseline]
+metadata:
+  description: "EU healthcare pack modelled on GDPR special categories and member-state identifiers. Template requiring review; not legal advice."
+  pack_version: 1
+custom_categories:
+  - pii.age
+  - pii.special_category
+  - pii.biometric_identifier
+detectors:
+  custom:
+    # Italian codice fiscale: 6 letters, 2 digits, month letter, 2 digits, letter, 3 digits, letter.
+    - id: eu-it-codice-fiscale
+      category: pii.government_id
+      pattern: '\b[A-Z]{6}[0-9]{2}[ABCDEHLMPRST][0-9]{2}[A-Z][0-9]{3}[A-Z]\b'
+      confidence: 0.85
+classifications:
+  - id: eu-special-categories
+    field_names: [ethnicity, ethnic_origin, race, racial_origin, religion, religious_belief, philosophical_belief, political_opinion, political_party, party_affiliation, trade_union, union_membership, sexual_orientation, sex_life, gender_identity, genetic_data, genotype, dna_sequence, genetic_test_result]
+    category: pii.special_category
+  - id: eu-biometrics
+    field_names: [fingerprint, face_template, facial_image, iris_scan, retina_scan, voiceprint, biometric_template]
+    category: pii.biometric_identifier
+  - id: eu-national-ids
+    field_names: [codice_fiscale, steuer_id, steueridentifikationsnummer, bsn, burgerservicenummer, nir, numero_securite_sociale, dni, nie, nif, pesel, personnummer, henkilotunnus, cpr_number, rodne_cislo, ppsn, ehic_number, health_insurance_number, krankenversicherungsnummer, carte_vitale_number]
+    category: pii.government_id
+  - id: eu-age
+    field_names: [age, patient_age, age_years, alter, edad, eta]
+    category: pii.age
+rules:
+  - id: eu-block-special-categories-external
+    priority: 800
+    match:
+      destinations: [external_vendor, external_ai, public_repository, unknown]
+      categories: [pii.special_category, pii.biometric_identifier]
+    action: block
+    reason: special_category_data_needs_review_before_external_release
+
+  - id: eu-review-special-categories
+    priority: 400
+    match:
+      categories: [pii.special_category, pii.biometric_identifier]
+    action: review
+    reason: special_category_data_requires_human_decision
+
+  - id: eu-age-band
+    priority: 300
+    match:
+      categories: [pii.age]
+    action: generalize
+    params:
+      strategy: age_band
+      band_size: 10
+      max_age: 90
+    reason: ages_banded