mixin-sensitivity 0.4.0__tar.gz

mixin_sensitivity-0.4.0/.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Install Python
+        run: uv python install ${{ matrix.python-version }}
+      - name: Sync dependencies
+        run: uv sync --all-extras
+      - name: Test
+        run: uv run pytest -v --cov --cov-fail-under=95
+
+  mypy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Install Python 3.12
+        run: uv python install 3.12
+      - name: Sync dependencies
+        run: uv sync --all-extras
+      - name: Type-check
+        run: uv run mypy mixin_sensitivity/

mixin_sensitivity-0.4.0/.github/workflows/cleanup-guard.yml

@@ -0,0 +1,30 @@
+name: Cleanup Guard
+
+on:
+  push:
+    branches: [main, "refactor/*", "feat/*"]
+  pull_request:
+    branches: [main, "refactor/*", "feat/*"]
+
+jobs:
+  cleanup-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check audit and review artifacts
+        run: |
+          audit_count=$(find docs/audits -maxdepth 1 -name "*.md" -type f | wc -l)
+          review_count=$(find docs/reviews -maxdepth 1 -name "*.md" -type f | wc -l)
+
+          if [ "$audit_count" -eq 0 ]; then
+            echo "❌ FAIL: docs/audits/ contains no .md files (expected security audit)"
+            exit 1
+          fi
+
+          if [ "$review_count" -eq 0 ]; then
+            echo "❌ FAIL: docs/reviews/ contains no .md files (expected code review)"
+            exit 1
+          fi
+
+          echo "✓ Audit count: $audit_count"
+          echo "✓ Review count: $review_count"

mixin_sensitivity-0.4.0/.github/workflows/dto-strict.yml

@@ -0,0 +1,35 @@
+name: dto-strict
+
+# DTO-discipline lint (frozen+slots, facade-ban, R001-R008 rules).
+# Lint step: whole package (native test-file exemption via R007/R008 rules).
+# LOC-cap step: source dirs only (test density exempt from cap per review record).
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Install Python 3.12
+        run: uv python install 3.12
+      - name: Run dto-strict
+        run: uvx --python 3.12 dto-strict@0.4.0 mixin_sensitivity/ --format github
+      - name: Check LOC cap
+        run: |
+          for dir in mixin_sensitivity/common mixin_sensitivity/config mixin_sensitivity/decorators/classes mixin_sensitivity/decorators/constants mixin_sensitivity/decorators/sensitive mixin_sensitivity/services/classify; do
+            uvx --python 3.12 dto-strict@0.4.0 loc-cap "$dir"
+          done

mixin_sensitivity-0.4.0/.github/workflows/no-ai-attribution.yml

@@ -0,0 +1,73 @@
+name: Attribution Gate
+
+# Server-side enforcement: rejects pushes/PRs whose commit messages contain
+# Claude/Anthropic attribution. Catches GitHub squash-merge propagation that
+# bypasses local commit-msg, pre-push, and PreToolUse hooks.
+#
+# Per-repo copy of the canonical attribution gate.
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  scan:
+    name: Scan commit messages for attribution
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine commit range
+        id: range
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE: ${{ github.event.before }}
+          PUSH_AFTER: ${{ github.event.after }}
+        run: |
+          set -euo pipefail
+          if [ "$EVENT_NAME" = "pull_request" ]; then
+            BASE="$PR_BASE"
+            HEAD="$PR_HEAD"
+          else
+            BASE="$PUSH_BEFORE"
+            HEAD="$PUSH_AFTER"
+            if [ "$BASE" = "0000000000000000000000000000000000000000" ] || [ -z "$BASE" ]; then
+              git fetch origin main:refs/remotes/origin/main 2>/dev/null || true
+              BASE=$(git merge-base origin/main "$HEAD" 2>/dev/null || git rev-list --max-parents=0 "$HEAD" | tail -1)
+            fi
+          fi
+          echo "base=$BASE" >> "$GITHUB_OUTPUT"
+          echo "head=$HEAD" >> "$GITHUB_OUTPUT"
+
+      - name: Scan for Claude/Anthropic attribution
+        env:
+          BASE: ${{ steps.range.outputs.base }}
+          HEAD: ${{ steps.range.outputs.head }}
+          PATTERN: 'co-authored-by.*(claude|anthropic)|generated with claude|@claude|noreply@anthropic|🤖'
+        run: |
+          set -uo pipefail
+          OFFENDING=""
+          for sha in $(git rev-list "$BASE..$HEAD"); do
+            MSG=$(git log -1 --pretty=format:"%B" "$sha")
+            if echo "$MSG" | grep -qiE "$PATTERN"; then
+              AUTHOR=$(git log -1 --pretty=format:"%an" "$sha")
+              SUBJECT=$(git log -1 --pretty=format:"%s" "$sha")
+              OFFENDING="${OFFENDING}  ${sha:0:8} | author=${AUTHOR} | ${SUBJECT}"$'\n'
+            fi
+          done
+          if [ -n "$OFFENDING" ]; then
+            echo "::error::Claude/Anthropic attribution detected in commit messages"
+            echo "Offending commits in range $BASE..$HEAD:"
+            printf '%s' "$OFFENDING"
+            exit 1
+          fi
+          echo "OK: no attribution detected in $BASE..$HEAD"

mixin_sensitivity-0.4.0/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    name: Build + publish
+    runs-on: ubuntu-latest
+    environment: pypi  # second-layer GitHub deployment-environment gate
+    permissions:
+      id-token: write  # OIDC trusted publisher
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install build deps
+        run: python -m pip install --upgrade build
+
+      - name: Build sdist + wheel
+        run: python -m build
+
+      - name: Publish via OIDC
+        uses: pypa/gh-action-pypi-publish@release/v1
+        # No password/token — OIDC trusted publisher does the auth

mixin_sensitivity-0.4.0/.github/workflows/ruff.yml

@@ -0,0 +1,29 @@
+name: Ruff
+
+# Ruff lint + format check. Pinned to 0.15.14 to match local version.
+# Format drift was previously undetected; this gate prevents future drift.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Ruff lint
+        run: uvx ruff@0.15.14 check mixin_sensitivity/
+      - name: Ruff format check
+        run: uvx ruff@0.15.14 format --check mixin_sensitivity/

mixin_sensitivity-0.4.0/.gitignore

@@ -0,0 +1,131 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+Pipfile.lock
+
+# PEP 582
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store

mixin_sensitivity-0.4.0/CHANGELOG.md

@@ -0,0 +1,167 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Deprecated
+
+### Removed
+
+### Fixed
+
+### Security
+
+## [0.4.0] - 2026-07-06
+
+### Changed
+
+- Package renamed from `sensitivity-mixin` to `mixin-sensitivity` following the suite's category-first naming convention. Import root changes from `sensitivity_mixin` to `mixin_sensitivity`; all public symbols (`Sensitivity`, `classify`, `@sensitive`, `@classified`, `@phi_aware` backward compatibility) are unchanged.
+- GitHub repository renamed to `jekhator/mixin-sensitivity`; the old URL redirects.
+- The `sensitivity-mixin` distribution remains live on PyPI at 0.3.1; existing pins keep working. New releases publish as `mixin-sensitivity`.
+
+## [0.3.1] - 2026-06-10
+
+### Fixed
+
+- Documentation code examples used uppercase sensitivity metadata values that raise ValueError at runtime; all examples corrected to the lowercase enum values and verified by execution.
+
+### Added
+
+- README badges; contributing guide, security policy, and code of conduct; changelog project URL.
+
+## [0.3.0] - 2026-06-10
+
+### BREAKING CHANGES
+
+Package renamed from `pii-aware-mixin` to `sensitivity-mixin`. Decorator and API scope broadened to support multiple sensitivity classifications.
+
+### Changed
+
+- **Package name:** `pii-aware-mixin` → `sensitivity-mixin` (import: `sensitivity_mixin`)
+- **Decorator:** `@phi_aware` → `@sensitive` (works with broadened taxonomy)
+- **Metadata key:** `"phi"` → `"sensitivity"` with values: `"PHI"`, `"PII"`, `"PCI"`, `"SECRET"`
+- **Default placeholder:** `<phi:redacted>` → `***` (simpler, more readable)
+- **API:** `SensitiveDecorator` accepts optional `policies` tuple for per-class masking customization
+
+### Added
+
+- `@sensitive` decorator with optional policy wiring via `SensitiveDecorator(policies=...)`
+- `classify(instance)` → `SensitivityProfile`: introspect field-level sensitivity
+- `Sensitivity` enum (PHI, PII, PCI, SECRET): taxonomy-driven classification
+- `SensitivityProfile` value object with methods: `has()`, `fields_of()`, `sensitivity_of()`, `is_empty`
+- `Compliance` enum (HIPAA, GDPR, PCI_DSS, NONE): governance regime labels for policies
+- `ClassMakerAware` protocol: contract all sensitivity policies implement
+- Four policy value objects: `PhiPolicyAware`, `PiiPolicyAware`, `PciPolicyAware`, `SecretPolicyAware`
+- `SensitiveFieldSet` value object: field introspection + policy-driven masking
+
+### Removed
+
+- `mask_for_logging()` helper: use `repr()` on decorated instances instead
+- `to_dict()` helper: use `dataclasses.asdict()` directly
+- Previous masking strategy removed; focus shifted to classification + repr-layer policies
+
+### Documentation
+
+- `docs/apps/decorators/sensitive.md`: @sensitive decorator and SensitiveFieldSet
+- `docs/apps/decorators/compliance.md`: Compliance enum and ClassMakerAware protocol
+- `docs/apps/decorators/policies.md`: Four policy value objects with usage examples
+
+### Why
+
+Broadened scope from PHI-only masking to a taxonomy-driven sensitivity framework supporting healthcare (PHI), personal data (PII), payment data (PCI), and secrets. Per-class policy value objects enable compliance-aware customization (HIPAA, GDPR, PCI-DSS) while keeping the decorator simple by default.
+
+## [0.2.0] - 2026-05-21
+
+### BREAKING CHANGES
+
+API redesigned from mixin-inheritance to decorator-based. Consumers must migrate.
+
+### Removed
+
+- `PiiAwareMixin` class: replaced by `@phi_aware` decorator
+- `ReprMixin` class: functionality folded into `@phi_aware` decorator
+- `ToDictMixin` class: replaced by module-level `to_dict()` helper
+- Requirement for `repr=False` in consumer dataclasses (decorator works on plain `@dataclass(frozen=True, slots=True)`)
+
+### Added
+
+- `@phi_aware` decorator: injects PHI-masking `__repr__` on frozen dataclasses
+- `mask_for_logging(instance)` module-level helper: returns dict with PHI fields masked
+- `to_dict(instance)` module-level helper: alias for `dataclasses.asdict()` for consistency
+- Field metadata key renamed `"sensitive"` → `"phi"` (healthcare-aligned)
+- 26 comprehensive tests covering decorator, helpers, edge cases, integration
+
+### Why
+
+Compatible with the canonical "no mixin inheritance on data DTOs" pattern established in downstream QHCG project (2026-05-09). 
+
+v0.1.0 mixin-inheritance API (`class User(PiiAwareMixin, ReprMixin, ToDictMixin)`) caused R003 false-positives in dto-strict v0.2.x when consumers tried to adopt the "no mixin inheritance" rule. The new decorator API allows clean adoption:
+- No inheritance, no MRO issues
+- Works on plain frozen dataclasses (no `repr=False` boilerplate)
+- Explicit module-level helpers (not instance methods)
+- Compatible with static analysis tools
+
+### Migration Guide
+
+**v0.1.0 (old, deprecated):**
+```python
+from pii_aware_mixin import PiiAwareMixin, ReprMixin, ToDictMixin
+
+@dataclass(frozen=True, slots=True, repr=False)
+class User(PiiAwareMixin, ReprMixin, ToDictMixin):
+    id: int
+    api_token: str = field(metadata={"sensitive": True})
+
+user = User(id=1, api_token="sk-123")
+user.mask_for_logging()    # instance method
+repr(user)                 # mixin's __repr__
+user.to_dict()             # instance method
+```
+
+**v0.2.0 (new):**
+```python
+from pii_aware_mixin import phi_aware, mask_for_logging, to_dict
+
+@phi_aware
+@dataclass(frozen=True, slots=True)
+class User:
+    id: int
+    api_token: str = field(metadata={"phi": True})
+
+user = User(id=1, api_token="sk-123")
+mask_for_logging(user)  # module-level helper
+repr(user)              # decorator's __repr__
+to_dict(user)           # module-level helper
+```
+
+**Changes per file:**
+1. Remove mixin inheritance from class definition
+2. Add `@phi_aware` decorator above `@dataclass`
+3. Remove `repr=False` from `@dataclass` (no longer needed)
+4. Change `metadata={"sensitive": True}` → `metadata={"phi": True}`
+5. Replace `instance.mask_for_logging()` → `mask_for_logging(instance)`
+6. Replace `instance.to_dict()` → `to_dict(instance)`
+
+## [0.1.0] - 2026-05-18
+
+### Added
+
+- `PiiAwareMixin`: metadata-driven masking via `mask_for_logging()` instance method
+- `ReprMixin`: structured `__repr__()` with automatic field masking
+- `ToDictMixin`: JSON serialization via `to_dict()` and `from_dict()` instance methods
+- Field metadata key `"sensitive"` to mark fields for masking
+- Comprehensive tests for all three mixins and composition patterns
+- README with quick start, API reference, logging integration examples
+
+### Design
+
+Three composable mixin classes for frozen dataclasses, using Python's MRO for clean composition.
+All work independently or together. Full-mask strategy: sensitive fields become `<MASKED>` in logs and `<masked: sensitive>` in reprs.

mixin_sensitivity-0.4.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+## My Commitment
+
+I maintain this project solo, and I am committed to keeping it a welcoming space for everyone who participates in issues, pull requests, and discussions. I pledge to treat every participant with respect and dignity, regardless of age, body size, caste, disability, ethnicity, sex characteristics, gender, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, sexual identity and orientation, or any other dimension of diversity.
+
+## Standards
+
+Behavior that keeps this a positive space:
+
+- Welcoming and inclusive language
+- Respect for differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the project
+- Empathy toward other participants
+
+Behavior I will not accept:
+
+- Harassment or insulting or derogatory comments
+- Personal attacks
+- Public or private harassment
+- Publishing someone's private information without consent
+- Conduct that could reasonably be considered inappropriate
+
+## Enforcement
+
+Report unacceptable behavior to me through GitHub, either by opening an issue or, where discretion is warranted, through private vulnerability reporting. I review and act on every report promptly and fairly, and I respect the privacy and security of anyone who reports.
+
+## Attribution
+
+This Code of Conduct is adapted from the Contributor Covenant, version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.

mixin_sensitivity-0.4.0/CONTRIBUTING.md

@@ -0,0 +1,65 @@
+# Contributing
+
+Thank you for your interest in contributing! I welcome pull requests, bug reports, and feature suggestions.
+
+## Development Setup
+
+### Prerequisites
+
+- Python 3.11+
+- [uv](https://docs.astral.sh/uv/) for dependency management
+
+### Getting Started
+
+1. Clone the repository:
+   ```bash
+   git clone https://github.com/jekhator/mixin-sensitivity.git
+   cd mixin-sensitivity
+   ```
+
+2. Sync dependencies with uv:
+   ```bash
+   uv sync --all-extras
+   ```
+
+3. Run tests to verify setup:
+   ```bash
+   uv run pytest
+   ```
+
+## Code Quality
+
+### Testing
+
+Run the test suite:
+```bash
+uv run pytest
+```
+
+For coverage:
+```bash
+uv run pytest --cov
+```
+
+### Linting and Formatting
+
+Format code with ruff:
+```bash
+uv run ruff format
+```
+
+Check for linting issues:
+```bash
+uv run ruff check
+```
+
+## Pull Requests
+
+- Open PRs against the `main` branch.
+- Include a clear description of the change and the problem it solves.
+- Ensure all tests pass and code is formatted before requesting review.
+- The CI pipeline will verify linting, formatting, and test coverage.
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the Apache 2.0 License.