spanforge 2.0.0__tar.gz → 2.0.1__tar.gz

{spanforge-2.0.0 → spanforge-2.0.1}/CONFORMANCE.md

@@ -45,6 +45,8 @@ Each fixture carries a `clause` field mapping to a numbered requirement:
 | GA-03-REQ-02 | scan_payload MUST detect SSN patterns |
 | GA-03-REQ-03 | PIIScanHit MUST include match_count and sensitivity fields |
 | GA-03-REQ-04 | Credit card detection MUST apply Luhn validation |
+| GA-03-REQ-05 | SSN detection MUST reject invalid SSA ranges (area 000, 666, 900–999; group 00; serial 0000) |
+| GA-03-REQ-06 | date_of_birth detection MUST reject calendar-invalid dates (e.g. Feb 30, month 13) |
 | GA-04-REQ-01 | GDPR erasure MUST produce tombstone events preserving chain integrity |
 | GA-05-REQ-01 | v1_to_v2 MUST rename 'model' to 'model_id' and bump schema_version |
 | GA-05-REQ-02 | md5-prefixed checksums MUST be rehashed to SHA-256 |
@@ -76,6 +78,8 @@ Each fixture carries a `clause` field mapping to a numbered requirement:
 | C013 | PII scan detects SSN                      | GA-03-REQ-02 | GA-03   |
 | C014 | PII hit match_count and sensitivity       | GA-03-REQ-03 | GA-03   |
 | C015 | Credit card Luhn validation               | GA-03-REQ-04 | GA-03   |
+| C024 | SSN range validation rejects invalid ranges | GA-03-REQ-05 | GA-03   |
+| C025 | date_of_birth rejects calendar-invalid dates | GA-03-REQ-06 | GA-03   |
 | C016 | Key expiry returns (status, days) tuple   | GA-01-REQ-06 | GA-01   |
 | C017 | derive_key context isolation              | GA-01-REQ-07 | GA-01   |
 

{spanforge-2.0.0 → spanforge-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spanforge
-Version: 2.0.0
+Version: 2.0.1
 Summary: SpanForge — AI lifecycle and governance platform (RFC-0001 SPANFORGE)
 Project-URL: Homepage, https://github.com/veerarag1973/spanforge
 Project-URL: Documentation, https://github.com/veerarag1973/spanforge/blob/main/docs/index.md
@@ -350,7 +350,7 @@ assert result.valid  # any tampering → False
 
 ### PII redaction
 
-Strip personal data before events leave your application boundary. Deep scanning with Luhn validation for credit card numbers.
+Strip personal data before events leave your application boundary. Deep scanning with Luhn and Verhoeff validation for credit cards and Aadhaar numbers, SSN range validation (`_is_valid_ssn`), calendar validation for dates of birth (`_is_valid_date`), and built-in patterns for `date_of_birth` and street `address`.
 
 ```python
 from spanforge.redact import RedactionPolicy, Sensitivity
@@ -605,7 +605,7 @@ spanforge/
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>
@@ -1430,7 +1430,7 @@ and opens it directly — useful for sharing trace snapshots offline.
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>

{spanforge-2.0.0 → spanforge-2.0.1}/README.md

@@ -252,7 +252,7 @@ assert result.valid  # any tampering → False
 
 ### PII redaction
 
-Strip personal data before events leave your application boundary. Deep scanning with Luhn validation for credit card numbers.
+Strip personal data before events leave your application boundary. Deep scanning with Luhn and Verhoeff validation for credit cards and Aadhaar numbers, SSN range validation (`_is_valid_ssn`), calendar validation for dates of birth (`_is_valid_date`), and built-in patterns for `date_of_birth` and street `address`.
 
 ```python
 from spanforge.redact import RedactionPolicy, Sensitivity
@@ -507,7 +507,7 @@ spanforge/
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>
@@ -1332,7 +1332,7 @@ and opens it directly — useful for sharing trace snapshots offline.
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>

{spanforge-2.0.0 → spanforge-2.0.1}/docs/api/redact.md

@@ -287,7 +287,7 @@ Scan a payload dictionary for PII using regex detectors.
 Walks the entire payload recursively (up to `max_depth`), testing every string
 value against the built-in pattern set plus any caller-supplied patterns.
 
-**Built-in detectors:** `email`, `phone`, `ssn`, `credit_card` (with Luhn validation), `ip_address`, `uk_national_insurance`.
+**Built-in detectors:** `email`, `phone`, `ssn` (with SSA range validation via `_is_valid_ssn`), `credit_card` (with Luhn validation), `ip_address`, `uk_national_insurance`, `date_of_birth` (with calendar validation via `_is_valid_date`), `address`.
 
 **Args:**
 

{spanforge-2.0.0 → spanforge-2.0.1}/docs/changelog.md

@@ -6,7 +6,7 @@ this project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
-## 2.1.0 — 2026-06-XX
+## 2.0.1 — 2026-04-14
 
 **Compliance Integration Hardening & CostGuard Enhancements**
 
@@ -106,6 +106,37 @@ this project adheres to [Semantic Versioning](https://semver.org/).
 - Both types mapped to sensitivity `"high"` in `_SENSITIVITY_MAP`.
 - Exported from the top-level `spanforge` package.
 
+### Added — Extended PII Pattern Coverage
+
+- **`date_of_birth` pattern** — detects dates of birth in `MM/DD/YYYY`,
+  `MM-DD-YYYY`, `YYYY-MM-DD`, and `YYYY/MM/DD` formats (centuries 1900–2099).
+  Secondary calendar validation via `_is_valid_date()` rejects impossible dates
+  (e.g. `02/30/1990`, `13/01/1990`).  Mapped to sensitivity `"high"`.
+- **`address` pattern** — detects US street addresses (`<number> <name> <suffix>`)
+  with a curated suffix list (Street/St, Avenue/Ave, Road/Rd, Boulevard/Blvd,
+  Drive/Dr, Lane/Ln, Court/Ct, Way, Place/Pl, Circle/Cir, Trail/Trl,
+  Terrace/Ter, Parkway/Pkwy, Highway/Hwy, Route/Rte).  Mapped to sensitivity
+  `"medium"`.
+- **`_is_valid_ssn(ssn_str)`** — SSA range validator applied post-regex to every
+  SSN match in `scan_payload()`.  Rejects area `000`, area `666`, areas
+  `900–999` (ITIN-reserved), group `00`, and serial `0000`, eliminating the
+  most common false-positive ranges.
+- **`_is_valid_date(date_str)`** — calendar correctness validator applied
+  post-regex to every `date_of_birth` match.  Delegates to
+  `datetime.strptime` for accurate month-length and leap-year enforcement.
+- Both validators follow the same pattern as existing `_luhn_check()` and
+  `_verhoeff_check()` — applied inside `scan_payload._walk()` after the regex
+  pass.
+
+### Fixed — Compliance Attestation with Missing Signing Key
+
+- `generate_evidence_package()`, `to_pdf()`, and `verify_attestation_signature()`
+  previously raised `ValueError` when `SPANFORGE_SIGNING_KEY` was not set in
+  the environment.  They now emit a `logging.WARNING` and fall back to an
+  insecure internal default (`_INSECURE_DEFAULT_KEY`).  **Production
+  deployments must always set `SPANFORGE_SIGNING_KEY`; the default key exists
+  only for development and CI environments.**
+
 ### Added — Compliance Dashboard in SPA Viewer
 
 - **Clause pass/fail table** — clicking the compliance chip in the

{spanforge-2.0.0 → spanforge-2.0.1}/docs/cli.md

@@ -794,7 +794,7 @@ result = scan_payload(event.payload, extra_patterns=DPDP_PATTERNS)
 ```
 
 Built-in types: `email`, `phone`, `ssn`, `credit_card`, `ip_address`,
-`uk_national_insurance`. DPDP add-on types: `aadhaar` (high), `pan` (high).
+`uk_national_insurance`, `date_of_birth`, `address`. DPDP add-on types: `aadhaar` (high), `pan` (high).
 
 ---
 

{spanforge-2.0.0 → spanforge-2.0.1}/docs/quickstart.md

@@ -163,6 +163,28 @@ for hit in result.hits:
 # pan: pan (sensitivity=high)
 ```
 
+### Date-of-birth and address detection
+
+`scan_payload()` also detects dates of birth and US street addresses out of the
+box — no extra patterns required:
+
+```python
+from spanforge.redact import scan_payload
+
+result = scan_payload({
+    "dob": "04/15/1990",
+    "home": "123 Maple Street",
+})
+for hit in result.hits:
+    print(f"{hit.pii_type}: {hit.path} (sensitivity={hit.sensitivity})")
+# date_of_birth: dob (sensitivity=high)
+# address: home (sensitivity=medium)
+```
+
+Calendar-invalid dates (e.g. `02/30/1990`) and SSNs in reserved ranges
+(area `000`, `666`, `900–999`) are automatically filtered out to reduce false
+positives.
+
 ## Exporting events
 
 ```python

{spanforge-2.0.0 → spanforge-2.0.1}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "hatchling.build"
 # ---------------------------------------------------------------------------
 [project]
 name = "spanforge"
-version = "2.0.0"
+version = "2.0.1"
 description = "SpanForge — AI lifecycle and governance platform (RFC-0001 SPANFORGE)"
 readme = "README.md"
 license = { text = "MIT" }

{spanforge-2.0.0 → spanforge-2.0.1}/src/spanforge/__init__.py

@@ -399,7 +399,7 @@ from spanforge.explain import (
 )
 from spanforge.namespaces.consent import ConsentPayload
 from spanforge.namespaces.hitl import HITLPayload
-__version__: str = "2.0.0"
+__version__: str = "2.0.1"
 #: RFC-0001 SPANFORGE conformance profile label.
 from typing import Final as _Final
 CONFORMANCE_PROFILE: _Final[str] = "SPANFORGE-Enterprise-2.0"

{spanforge-2.0.0 → spanforge-2.0.1}/src/spanforge/core/compliance_mapping.py

@@ -39,6 +39,10 @@ __all__ = [
 
 _log = logging.getLogger("spanforge.core.compliance_mapping")
 
+# Fallback signing key used when SPANFORGE_SIGNING_KEY is absent.  Only
+# safe for development / CI — never use in production.
+_INSECURE_DEFAULT_KEY: str = "spanforge-insecure-default-do-not-use-in-production"
+
 # ---------------------------------------------------------------------------
 # Framework enum
 # ---------------------------------------------------------------------------
@@ -506,11 +510,12 @@ class ComplianceEvidencePackage:
         pdf_hash = hashlib.sha256(pdf_bytes).hexdigest()
         signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
         if not signing_key or signing_key == "spanforge-default":
-            raise ValueError(
+            _log.warning(
                 "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
                 "Set a strong secret before generating PDF attestations for production. "
                 "Example: export SPANFORGE_SIGNING_KEY=$(openssl rand -hex 32)"
             )
+            signing_key = _INSECURE_DEFAULT_KEY
         pdf_hmac = _hmac.new(
             signing_key.encode(),
             pdf_hash.encode(),
@@ -688,11 +693,12 @@ class ComplianceMappingEngine:
         )
         signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
         if not signing_key or signing_key == "spanforge-default":
-            raise ValueError(
+            _log.warning(
                 "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
                 "Set a strong secret before generating compliance attestations for production. "
                 "Example: export SPANFORGE_SIGNING_KEY=$(openssl rand -hex 32)"
             )
+            signing_key = _INSECURE_DEFAULT_KEY
         hmac_sig = _hmac.new(
             signing_key.encode(),
             sig_payload.encode(),
@@ -1004,11 +1010,12 @@ def verify_attestation_signature(attestation: ComplianceAttestation) -> bool:
     )
     signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
     if not signing_key or signing_key == "spanforge-default":
-        raise ValueError(
+        _log.warning(
             "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
             "Attestation verification requires the same key used at signing time. "
             "Example: export SPANFORGE_SIGNING_KEY=<your-secret>"
         )
+        signing_key = _INSECURE_DEFAULT_KEY
     expected = _hmac.new(
         signing_key.encode(),
         sig_payload.encode(),

{spanforge-2.0.0 → spanforge-2.0.1}/src/spanforge/redact.py

@@ -586,6 +586,21 @@ _PII_PATTERNS: Final[dict[str, re.Pattern[str]]] = {
         r"\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b",
         re.IGNORECASE,
     ),
+    # Date of birth — MM/DD/YYYY, MM-DD-YYYY, YYYY-MM-DD, YYYY/MM/DD
+    # _is_valid_date() provides secondary calendar correctness check.
+    "date_of_birth": re.compile(
+        r"\b(?:0?[1-9]|1[0-2])[/\-](?:0?[1-9]|[12]\d|3[01])[/\-](?:19|20)\d{2}\b"
+        r"|"
+        r"\b(?:19|20)\d{2}[/\-](?:0?[1-9]|1[0-2])[/\-](?:0?[1-9]|[12]\d|3[01])\b"
+    ),
+    # Street address — house number + street name + recognised suffix
+    "address": re.compile(
+        r"\b\d{1,5}\s+(?:[A-Za-z0-9'.#\-]+\s+){1,5}"
+        r"(?:Street|St|Avenue|Ave|Road|Rd|Boulevard|Blvd|Drive|Dr|Lane|Ln|"
+        r"Court|Ct|Way|Place|Pl|Circle|Cir|Trail|Trl|Terrace|Ter|"
+        r"Parkway|Pkwy|Highway|Hwy|Route|Rte)\.?\b",
+        re.IGNORECASE,
+    ),
 }
 
 
@@ -663,8 +678,10 @@ _SENSITIVITY_MAP: dict[str, str] = {
     "credit_card": "high",
     "aadhaar": "high",
     "pan": "high",
+    "date_of_birth": "high",
     "email": "medium",
     "phone": "medium",
+    "address": "medium",
     "ip_address": "low",
     "uk_national_insurance": "low",
 }
@@ -703,6 +720,68 @@ def _luhn_check(number_str: str) -> bool:
     return total % 10 == 0
 
 
+def _is_valid_ssn(ssn_str: str) -> bool:
+    """Return ``False`` for SSNs in known-invalid SSA number ranges.
+
+    Filters out the following ranges that the SSA has *never* assigned:
+
+    * Area ``000`` — never issued.
+    * Area ``666`` — explicitly excluded by SSA policy.
+    * Areas ``900``–``999`` — reserved for Individual Taxpayer
+      Identification Numbers (ITINs); never used as SSNs.
+    * Group ``00`` — never issued within any valid area.
+    * Serial ``0000`` — never issued within any valid area/group.
+
+    Args:
+        ssn_str: Raw match string from :data:`_PII_PATTERNS` ``"ssn"``
+                 regex (e.g. ``"123-45-6789"``).
+
+    Returns:
+        ``True`` if the SSN passes all range checks; ``False`` otherwise.
+    """
+    digits = "".join(c for c in ssn_str if c.isdigit())
+    if len(digits) != 9:
+        return False
+    area = int(digits[:3])
+    group = int(digits[3:5])
+    serial = int(digits[5:])
+    if area == 0 or area == 666 or area >= 900:
+        return False
+    if group == 0:
+        return False
+    if serial == 0:
+        return False
+    return True
+
+
+def _is_valid_date(date_str: str) -> bool:
+    """Return ``True`` if *date_str* is a valid calendar date.
+
+    Accepts the four formats produced by the ``"date_of_birth"`` regex in
+    :data:`_PII_PATTERNS`:
+
+    * ``MM/DD/YYYY`` and ``MM-DD-YYYY``
+    * ``YYYY/MM/DD`` and ``YYYY-MM-DD``
+
+    Delegates to :func:`datetime.datetime.strptime` so leap-year rules and
+    month-length limits are enforced (e.g. ``02/30/2000`` is rejected).
+
+    Args:
+        date_str: Raw match string from the ``"date_of_birth"`` regex.
+
+    Returns:
+        ``True`` if the string represents a real calendar date; ``False``
+        if no known format matches or the date is not calendar-valid.
+    """
+    for fmt in ("%m/%d/%Y", "%m-%d-%Y", "%Y/%m/%d", "%Y-%m-%d"):
+        try:
+            datetime.datetime.strptime(date_str.strip(), fmt)
+            return True
+        except ValueError:
+            continue
+    return False
+
+
 def scan_payload(
     payload: dict[str, Any],
     *,
@@ -762,6 +841,24 @@ def scan_payload(
                     if not valid_matches:
                         continue
                     matches = valid_matches
+                # SSN range validation — drop known-invalid SSA ranges
+                if label == "ssn":
+                    valid_matches = [
+                        m for m in matches
+                        if _is_valid_ssn(m.group())
+                    ]
+                    if not valid_matches:
+                        continue
+                    matches = valid_matches
+                # Calendar validation for date_of_birth patterns
+                if label == "date_of_birth":
+                    valid_matches = [
+                        m for m in matches
+                        if _is_valid_date(m.group())
+                    ]
+                    if not valid_matches:
+                        continue
+                    matches = valid_matches
                 sensitivity = _SENSITIVITY_MAP.get(label, "medium")
                 hits.append(PIIScanHit(
                     pii_type=label,

{spanforge-2.0.0 → spanforge-2.0.1}/tests/test_redact.py

@@ -22,6 +22,8 @@ from spanforge.redact import (
     Sensitivity,
     _count_redactable,
     _has_redactable,
+    _is_valid_date,
+    _is_valid_ssn,
     _utcnow_iso,
     _verhoeff_check,
     assert_redacted,
@@ -819,3 +821,201 @@ class TestDDPDPatternsWithBuiltins:
         types = {h.pii_type for h in result.hits}
         assert "ssn" in types
         assert "pan" in types
+
+
+# ===========================================================================
+# SSN range validation — _is_valid_ssn
+# ===========================================================================
+
+
+@pytest.mark.unit
+class TestIsValidSSN:
+    """Unit tests for the _is_valid_ssn range-validation helper."""
+
+    def test_valid_ssn_passes(self) -> None:
+        assert _is_valid_ssn("123-45-6789") is True
+
+    def test_valid_ssn_no_separators(self) -> None:
+        assert _is_valid_ssn("123456789") is True
+
+    def test_area_000_rejected(self) -> None:
+        assert _is_valid_ssn("000-12-3456") is False
+
+    def test_area_666_rejected(self) -> None:
+        assert _is_valid_ssn("666-12-3456") is False
+
+    def test_area_900_rejected(self) -> None:
+        assert _is_valid_ssn("900-12-3456") is False
+
+    def test_area_999_rejected(self) -> None:
+        assert _is_valid_ssn("999-12-3456") is False
+
+    def test_group_00_rejected(self) -> None:
+        assert _is_valid_ssn("123-00-3456") is False
+
+    def test_serial_0000_rejected(self) -> None:
+        assert _is_valid_ssn("123-45-0000") is False
+
+    def test_too_short_rejected(self) -> None:
+        assert _is_valid_ssn("123-45-678") is False
+
+    def test_non_digit_only_rejected(self) -> None:
+        assert _is_valid_ssn("abc-de-fghi") is False
+
+
+@pytest.mark.unit
+class TestSSNRangeValidationInScanPayload:
+    """scan_payload must use _is_valid_ssn to drop false-positive SSNs."""
+
+    def test_valid_ssn_detected(self) -> None:
+        result = scan_payload({"id": "123-45-6789"})
+        assert any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_area_000_not_flagged(self) -> None:
+        result = scan_payload({"id": "000-12-3456"})
+        assert not any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_area_666_not_flagged(self) -> None:
+        result = scan_payload({"id": "666-12-3456"})
+        assert not any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_area_900_not_flagged(self) -> None:
+        result = scan_payload({"id": "900-12-3456"})
+        assert not any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_group_00_not_flagged(self) -> None:
+        result = scan_payload({"id": "123-00-3456"})
+        assert not any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_serial_0000_not_flagged(self) -> None:
+        result = scan_payload({"id": "123-45-0000"})
+        assert not any(h.pii_type == "ssn" for h in result.hits)
+
+    def test_ssn_sensitivity_is_high(self) -> None:
+        result = scan_payload({"id": "123-45-6789"})
+        hit = next(h for h in result.hits if h.pii_type == "ssn")
+        assert hit.sensitivity == "high"
+
+
+# ===========================================================================
+# Date-of-birth calendar validation — _is_valid_date
+# ===========================================================================
+
+
+@pytest.mark.unit
+class TestIsValidDate:
+    """Unit tests for the _is_valid_date calendar-validation helper."""
+
+    def test_mm_slash_dd_slash_yyyy(self) -> None:
+        assert _is_valid_date("01/15/1990") is True
+
+    def test_mm_dash_dd_dash_yyyy(self) -> None:
+        assert _is_valid_date("01-15-1990") is True
+
+    def test_yyyy_slash_mm_slash_dd(self) -> None:
+        assert _is_valid_date("1990/01/15") is True
+
+    def test_yyyy_dash_mm_dash_dd(self) -> None:
+        assert _is_valid_date("1990-01-15") is True
+
+    def test_leap_day_valid(self) -> None:
+        assert _is_valid_date("02/29/2000") is True
+
+    def test_feb_30_rejected(self) -> None:
+        assert _is_valid_date("02/30/2000") is False
+
+    def test_month_13_rejected(self) -> None:
+        assert _is_valid_date("13/01/1990") is False
+
+    def test_day_00_rejected(self) -> None:
+        assert _is_valid_date("01/00/1990") is False
+
+    def test_non_leap_feb29_rejected(self) -> None:
+        assert _is_valid_date("02/29/2001") is False
+
+    def test_unrecognised_format_rejected(self) -> None:
+        assert _is_valid_date("15-Jan-1990") is False
+
+    def test_empty_string_rejected(self) -> None:
+        assert _is_valid_date("") is False
+
+
+@pytest.mark.unit
+class TestDateOfBirthDetectionInScanPayload:
+    """scan_payload must detect date_of_birth patterns and reject invalid dates."""
+
+    def test_detects_us_slash_format(self) -> None:
+        result = scan_payload({"dob": "01/15/1990"})
+        assert any(h.pii_type == "date_of_birth" for h in result.hits)
+
+    def test_detects_iso_format(self) -> None:
+        result = scan_payload({"dob": "1990-01-15"})
+        assert any(h.pii_type == "date_of_birth" for h in result.hits)
+
+    def test_detects_dashed_us_format(self) -> None:
+        result = scan_payload({"dob": "03-22-1985"})
+        assert any(h.pii_type == "date_of_birth" for h in result.hits)
+
+    def test_rejects_invalid_feb30(self) -> None:
+        result = scan_payload({"dob": "02/30/1990"})
+        assert not any(h.pii_type == "date_of_birth" for h in result.hits)
+
+    def test_rejects_month_13(self) -> None:
+        result = scan_payload({"dob": "13/01/1990"})
+        assert not any(h.pii_type == "date_of_birth" for h in result.hits)
+
+    def test_sensitivity_is_high(self) -> None:
+        result = scan_payload({"dob": "06/15/1985"})
+        hit = next(h for h in result.hits if h.pii_type == "date_of_birth")
+        assert hit.sensitivity == "high"
+
+    def test_detects_dob_in_nested_dict(self) -> None:
+        result = scan_payload({"patient": {"demographics": {"dob": "1975-08-20"}}})
+        assert any(h.pii_type == "date_of_birth" for h in result.hits)
+        hit = next(h for h in result.hits if h.pii_type == "date_of_birth")
+        assert "patient.demographics.dob" in hit.path
+
+
+# ===========================================================================
+# Address pattern detection
+# ===========================================================================
+
+
+@pytest.mark.unit
+class TestAddressDetectionInScanPayload:
+    """scan_payload must detect street address patterns."""
+
+    def test_detects_street(self) -> None:
+        result = scan_payload({"addr": "123 Main Street"})
+        assert any(h.pii_type == "address" for h in result.hits)
+
+    def test_detects_avenue(self) -> None:
+        result = scan_payload({"addr": "456 Oak Avenue"})
+        assert any(h.pii_type == "address" for h in result.hits)
+
+    def test_detects_abbreviated_suffix(self) -> None:
+        result = scan_payload({"addr": "789 Elm Dr"})
+        assert any(h.pii_type == "address" for h in result.hits)
+
+    def test_detects_blvd(self) -> None:
+        result = scan_payload({"addr": "1600 Pennsylvania Ave"})
+        assert any(h.pii_type == "address" for h in result.hits)
+
+    def test_detects_lane(self) -> None:
+        result = scan_payload({"addr": "42 Sunrise Lane"})
+        assert any(h.pii_type == "address" for h in result.hits)
+
+    def test_no_false_positive_on_plain_text(self) -> None:
+        result = scan_payload({"note": "This is a completely normal sentence."})
+        assert not any(h.pii_type == "address" for h in result.hits)
+
+    def test_sensitivity_is_medium(self) -> None:
+        result = scan_payload({"addr": "100 Maple Road"})
+        hit = next(h for h in result.hits if h.pii_type == "address")
+        assert hit.sensitivity == "medium"
+
+    def test_detects_address_in_list(self) -> None:
+        result = scan_payload({"addresses": ["100 Maple Road", "clean"]})
+        assert any(h.pii_type == "address" for h in result.hits)
+        hit = next(h for h in result.hits if h.pii_type == "address")
+        assert "addresses[0]" in hit.path