spanforge 2.0.0__tar.gz → 2.0.2__tar.gz

{spanforge-2.0.0 → spanforge-2.0.2}/CONFORMANCE.md

@@ -45,6 +45,8 @@ Each fixture carries a `clause` field mapping to a numbered requirement:
 | GA-03-REQ-02 | scan_payload MUST detect SSN patterns |
 | GA-03-REQ-03 | PIIScanHit MUST include match_count and sensitivity fields |
 | GA-03-REQ-04 | Credit card detection MUST apply Luhn validation |
+| GA-03-REQ-05 | SSN detection MUST reject invalid SSA ranges (area 000, 666, 900–999; group 00; serial 0000) |
+| GA-03-REQ-06 | date_of_birth detection MUST reject calendar-invalid dates (e.g. Feb 30, month 13) |
 | GA-04-REQ-01 | GDPR erasure MUST produce tombstone events preserving chain integrity |
 | GA-05-REQ-01 | v1_to_v2 MUST rename 'model' to 'model_id' and bump schema_version |
 | GA-05-REQ-02 | md5-prefixed checksums MUST be rehashed to SHA-256 |
@@ -76,6 +78,8 @@ Each fixture carries a `clause` field mapping to a numbered requirement:
 | C013 | PII scan detects SSN                      | GA-03-REQ-02 | GA-03   |
 | C014 | PII hit match_count and sensitivity       | GA-03-REQ-03 | GA-03   |
 | C015 | Credit card Luhn validation               | GA-03-REQ-04 | GA-03   |
+| C024 | SSN range validation rejects invalid ranges | GA-03-REQ-05 | GA-03   |
+| C025 | date_of_birth rejects calendar-invalid dates | GA-03-REQ-06 | GA-03   |
 | C016 | Key expiry returns (status, days) tuple   | GA-01-REQ-06 | GA-01   |
 | C017 | derive_key context isolation              | GA-01-REQ-07 | GA-01   |
 

{spanforge-2.0.0 → spanforge-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: spanforge
-Version: 2.0.0
+Version: 2.0.2
 Summary: SpanForge — AI lifecycle and governance platform (RFC-0001 SPANFORGE)
 Project-URL: Homepage, https://github.com/veerarag1973/spanforge
 Project-URL: Documentation, https://github.com/veerarag1973/spanforge/blob/main/docs/index.md
@@ -350,7 +350,7 @@ assert result.valid  # any tampering → False
 
 ### PII redaction
 
-Strip personal data before events leave your application boundary. Deep scanning with Luhn validation for credit card numbers.
+Strip personal data before events leave your application boundary. Deep scanning with Luhn and Verhoeff validation for credit cards and Aadhaar numbers, SSN range validation (`_is_valid_ssn`), calendar validation for dates of birth (`_is_valid_date`), and built-in patterns for `date_of_birth` and street `address`.
 
 ```python
 from spanforge.redact import RedactionPolicy, Sensitivity
@@ -605,7 +605,7 @@ spanforge/
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>
@@ -1430,7 +1430,7 @@ and opens it directly — useful for sharing trace snapshots offline.
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>

{spanforge-2.0.0 → spanforge-2.0.2}/README.md

@@ -252,7 +252,7 @@ assert result.valid  # any tampering → False
 
 ### PII redaction
 
-Strip personal data before events leave your application boundary. Deep scanning with Luhn validation for credit card numbers.
+Strip personal data before events leave your application boundary. Deep scanning with Luhn and Verhoeff validation for credit cards and Aadhaar numbers, SSN range validation (`_is_valid_ssn`), calendar validation for dates of birth (`_is_valid_date`), and built-in patterns for `date_of_birth` and street `address`.
 
 ```python
 from spanforge.redact import RedactionPolicy, Sensitivity
@@ -507,7 +507,7 @@ spanforge/
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>
@@ -1332,7 +1332,7 @@ and opens it directly — useful for sharing trace snapshots offline.
 </tr>
 <tr>
   <td><code>spanforge.redact</code></td>
-  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn validation, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
+  <td>PII detection, sensitivity levels, redaction policies, deep <code>scan_payload()</code> with Luhn / Verhoeff / SSN-range / date-calendar validation, built-in <code>date_of_birth</code> and <code>address</code> patterns, and <code>contains_pii()</code> / <code>assert_redacted()</code> with raw string scanning</td>
   <td>Data privacy / GDPR teams</td>
 </tr>
 <tr>

{spanforge-2.0.0 → spanforge-2.0.2}/docs/api/redact.md

@@ -183,7 +183,7 @@ The original event is **not** mutated.
 
 ## Module-level functions
 
-### `contains_pii(event: Event, *, scan_raw: bool = False) -> bool`
+### `contains_pii(event: Event, *, scan_raw: bool = True) -> bool`
 
 Return `True` if any payload value is a `Redactable` with
 `sensitivity >= Sensitivity.PII`.
@@ -193,13 +193,13 @@ Return `True` if any payload value is a `Redactable` with
 | Parameter | Type | Description |
 |-----------|------|-------------|
 | `event` | `Event` | The event to inspect. |
-| `scan_raw` | `bool` | When `True`, also run regex-based PII scanning on payload strings (via `scan_payload()`), not just check for `Redactable` wrappers. Default `False`. |
+| `scan_raw` | `bool` | When `True` (default), also run regex-based PII scanning on payload strings (via `scan_payload()`), not just check for `Redactable` wrappers. Pass `False` to check `Redactable` wrappers only. |
 
 **Returns:** `bool`
 
 ---
 
-### `assert_redacted(event: Event, context: str = "", *, scan_raw: bool = False) -> None`
+### `assert_redacted(event: Event, context: str = "", *, scan_raw: bool = True) -> None`
 
 Raise `PIINotRedactedError` if the event still contains unredacted PII or PHI.
 
@@ -211,7 +211,7 @@ Use this as a guardrail before exporting events.
 |-----------|------|-------------|
 | `event` | `Event` | The event to check. |
 | `context` | `str` | Optional context string embedded in the exception message. |
-| `scan_raw` | `bool` | When `True`, also run regex-based PII scanning. Default `False`. |
+| `scan_raw` | `bool` | When `True` (default), also run regex-based PII scanning. Pass `False` to check `Redactable` wrappers only. |
 
 **Raises:** `PIINotRedactedError` — if any `Redactable` PII/PHI values or raw PII patterns remain in the payload.
 
@@ -287,7 +287,7 @@ Scan a payload dictionary for PII using regex detectors.
 Walks the entire payload recursively (up to `max_depth`), testing every string
 value against the built-in pattern set plus any caller-supplied patterns.
 
-**Built-in detectors:** `email`, `phone`, `ssn`, `credit_card` (with Luhn validation), `ip_address`, `uk_national_insurance`.
+**Built-in detectors:** `email`, `phone`, `ssn` (with SSA range validation via `_is_valid_ssn`), `credit_card` (with Luhn validation), `ip_address`, `uk_national_insurance`, `date_of_birth` (global formats — ISO, US MDY, day-first DMY, written-month DMY/MDY — with calendar validation via `_is_valid_date`), `address`.
 
 **Args:**
 

{spanforge-2.0.0 → spanforge-2.0.2}/docs/changelog.md

@@ -6,7 +6,7 @@ this project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
-## 2.1.0 — 2026-06-XX
+## 2.0.2 — 2026-04-14
 
 **Compliance Integration Hardening & CostGuard Enhancements**
 
@@ -106,6 +106,45 @@ this project adheres to [Semantic Versioning](https://semver.org/).
 - Both types mapped to sensitivity `"high"` in `_SENSITIVITY_MAP`.
 - Exported from the top-level `spanforge` package.
 
+### Added — Extended PII Pattern Coverage
+
+- **`date_of_birth` pattern** — detects dates of birth across all major global
+  formats (centuries 1900–2099):
+  - ISO / year-first: `YYYY-MM-DD`, `YYYY/MM/DD`, `YYYY.MM.DD`
+  - US month-first: `MM/DD/YYYY`, `MM-DD-YYYY`, `MM.DD.YYYY`
+  - Day-first (UK, EU, Germany, Asia, Australia, Latin America): `DD/MM/YYYY`,
+    `DD-MM-YYYY`, `DD.MM.YYYY`
+  - Written day-first: `15 Jan 2000`, `15-Jan-2000`, `15 January 2000`
+  - Written month-first: `Jan 15, 2000`, `January 15 2000`
+
+  Secondary calendar validation via `_is_valid_date()` rejects impossible dates
+  (e.g. `02/30/1990`, `31/04/1990`).  Mapped to sensitivity `"high"`.
+- **`address` pattern** — detects street addresses (`<number> <name> <suffix>`)
+  with a curated suffix list (Street/St, Avenue/Ave, Road/Rd, Boulevard/Blvd,
+  Drive/Dr, Lane/Ln, Court/Ct, Way, Place/Pl, Circle/Cir, Trail/Trl,
+  Terrace/Ter, Parkway/Pkwy, Highway/Hwy, Route/Rte).  Mapped to sensitivity
+  `"medium"`.
+- **`_is_valid_ssn(ssn_str)`** — SSA range validator applied post-regex to every
+  SSN match in `scan_payload()`.  Rejects area `000`, area `666`, areas
+  `900–999` (ITIN-reserved), group `00`, and serial `0000`, eliminating the
+  most common false-positive ranges.
+- **`_is_valid_date(date_str)`** — calendar correctness validator applied
+  post-regex to every `date_of_birth` match.  Tries 15 `strptime` format
+  strings covering all numeric and written-month orderings; delegates to
+  `datetime.strptime` for accurate month-length and leap-year enforcement.
+- Both validators follow the same pattern as existing `_luhn_check()` and
+  `_verhoeff_check()` — applied inside `scan_payload._walk()` after the regex
+  pass.
+
+### Fixed — Compliance Attestation with Missing Signing Key
+
+- `generate_evidence_package()`, `to_pdf()`, and `verify_attestation_signature()`
+  previously raised `ValueError` when `SPANFORGE_SIGNING_KEY` was not set in
+  the environment.  They now emit a `logging.WARNING` and fall back to an
+  insecure internal default (`_INSECURE_DEFAULT_KEY`).  **Production
+  deployments must always set `SPANFORGE_SIGNING_KEY`; the default key exists
+  only for development and CI environments.**
+
 ### Added — Compliance Dashboard in SPA Viewer
 
 - **Clause pass/fail table** — clicking the compliance chip in the

{spanforge-2.0.0 → spanforge-2.0.2}/docs/cli.md

@@ -794,7 +794,8 @@ result = scan_payload(event.payload, extra_patterns=DPDP_PATTERNS)
 ```
 
 Built-in types: `email`, `phone`, `ssn`, `credit_card`, `ip_address`,
-`uk_national_insurance`. DPDP add-on types: `aadhaar` (high), `pan` (high).
+`uk_national_insurance`, `date_of_birth` (global formats: ISO, US, day-first
+DMY, written-month), `address`. DPDP add-on types: `aadhaar` (high), `pan` (high).
 
 ---
 

{spanforge-2.0.0 → spanforge-2.0.2}/docs/quickstart.md

@@ -163,6 +163,31 @@ for hit in result.hits:
 # pan: pan (sensitivity=high)
 ```
 
+### Date-of-birth and address detection
+
+`scan_payload()` also detects dates of birth and US street addresses out of the
+box — no extra patterns required:
+
+```python
+from spanforge.redact import scan_payload
+
+result = scan_payload({
+    "dob": "04/15/1990",
+    "home": "123 Maple Street",
+})
+for hit in result.hits:
+    print(f"{hit.pii_type}: {hit.path} (sensitivity={hit.sensitivity})")
+# date_of_birth: dob (sensitivity=high)
+# address: home (sensitivity=medium)
+```
+
+The `date_of_birth` detector recognises all major global formats: ISO
+(`YYYY-MM-DD`, `YYYY.MM.DD`), US month-first (`MM/DD/YYYY`, `MM.DD.YYYY`),
+day-first (UK/EU/Asia: `DD/MM/YYYY`, `DD.MM.YYYY`), and written-month forms
+(`15 Jan 2000`, `January 15, 2000`).  Calendar-invalid dates (e.g.
+`02/30/1990`, `31/04/1990`) and SSNs in reserved ranges (area `000`, `666`,
+`900–999`) are automatically filtered out to reduce false positives.
+
 ## Exporting events
 
 ```python

{spanforge-2.0.0 → spanforge-2.0.2}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "hatchling.build"
 # ---------------------------------------------------------------------------
 [project]
 name = "spanforge"
-version = "2.0.0"
+version = "2.0.2"
 description = "SpanForge — AI lifecycle and governance platform (RFC-0001 SPANFORGE)"
 readme = "README.md"
 license = { text = "MIT" }

{spanforge-2.0.0 → spanforge-2.0.2}/src/spanforge/__init__.py

@@ -399,7 +399,7 @@ from spanforge.explain import (
 )
 from spanforge.namespaces.consent import ConsentPayload
 from spanforge.namespaces.hitl import HITLPayload
-__version__: str = "2.0.0"
+__version__: str = "2.0.2"
 #: RFC-0001 SPANFORGE conformance profile label.
 from typing import Final as _Final
 CONFORMANCE_PROFILE: _Final[str] = "SPANFORGE-Enterprise-2.0"

{spanforge-2.0.0 → spanforge-2.0.2}/src/spanforge/core/compliance_mapping.py

@@ -39,6 +39,10 @@ __all__ = [
 
 _log = logging.getLogger("spanforge.core.compliance_mapping")
 
+# Fallback signing key used when SPANFORGE_SIGNING_KEY is absent.  Only
+# safe for development / CI — never use in production.
+_INSECURE_DEFAULT_KEY: str = "spanforge-insecure-default-do-not-use-in-production"
+
 # ---------------------------------------------------------------------------
 # Framework enum
 # ---------------------------------------------------------------------------
@@ -506,11 +510,12 @@ class ComplianceEvidencePackage:
         pdf_hash = hashlib.sha256(pdf_bytes).hexdigest()
         signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
         if not signing_key or signing_key == "spanforge-default":
-            raise ValueError(
+            _log.warning(
                 "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
                 "Set a strong secret before generating PDF attestations for production. "
                 "Example: export SPANFORGE_SIGNING_KEY=$(openssl rand -hex 32)"
             )
+            signing_key = _INSECURE_DEFAULT_KEY
         pdf_hmac = _hmac.new(
             signing_key.encode(),
             pdf_hash.encode(),
@@ -688,11 +693,12 @@ class ComplianceMappingEngine:
         )
         signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
         if not signing_key or signing_key == "spanforge-default":
-            raise ValueError(
+            _log.warning(
                 "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
                 "Set a strong secret before generating compliance attestations for production. "
                 "Example: export SPANFORGE_SIGNING_KEY=$(openssl rand -hex 32)"
             )
+            signing_key = _INSECURE_DEFAULT_KEY
         hmac_sig = _hmac.new(
             signing_key.encode(),
             sig_payload.encode(),
@@ -1004,11 +1010,12 @@ def verify_attestation_signature(attestation: ComplianceAttestation) -> bool:
     )
     signing_key = os.environ.get("SPANFORGE_SIGNING_KEY", "")
     if not signing_key or signing_key == "spanforge-default":
-        raise ValueError(
+        _log.warning(
             "SPANFORGE_SIGNING_KEY is not set or uses the insecure default value. "
             "Attestation verification requires the same key used at signing time. "
             "Example: export SPANFORGE_SIGNING_KEY=<your-secret>"
         )
+        signing_key = _INSECURE_DEFAULT_KEY
     expected = _hmac.new(
         signing_key.encode(),
         sig_payload.encode(),

{spanforge-2.0.0 → spanforge-2.0.2}/src/spanforge/redact.py

@@ -586,6 +586,41 @@ _PII_PATTERNS: Final[dict[str, re.Pattern[str]]] = {
         r"\b[A-CEGHJ-PR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b",
         re.IGNORECASE,
     ),
+    # Date of birth — numeric (/, -, .) and written-month forms covering
+    # ISO/YMD, US MDY, day-first DMY (Europe/Asia/Australia/etc.), and
+    # long/short written-month variants.  Years restricted to 19xx–20xx to
+    # limit false positives.  _is_valid_date() provides secondary calendar-
+    # correctness check (leap-year rules, month lengths, etc.).
+    "date_of_birth": re.compile(
+        # ISO / YMD: YYYY-MM-DD, YYYY/MM/DD, YYYY.MM.DD
+        r"\b(?:19|20)\d{2}[-/.](?:0?[1-9]|1[0-2])[-/.](?:0?[1-9]|[12]\d|3[01])\b"
+        r"|"
+        # US MDY: MM/DD/YYYY, MM-DD-YYYY, MM.DD.YYYY
+        r"\b(?:0?[1-9]|1[0-2])[-/.](?:0?[1-9]|[12]\d|3[01])[-/.](?:19|20)\d{2}\b"
+        r"|"
+        # Day-first DMY: DD/MM/YYYY, DD-MM-YYYY, DD.MM.YYYY (UK, EU, Asia, etc.)
+        r"\b(?:0?[1-9]|[12]\d|3[01])[-/.](?:0?[1-9]|1[0-2])[-/.](?:19|20)\d{2}\b"
+        r"|"
+        # Written DMY: "15 Jan 2000", "15-Jan-2000", "15 January 2000"
+        r"\b(?:0?[1-9]|[12]\d|3[01])[\s\-]"
+        r"(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?"
+        r"|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)"
+        r"[\s\-](?:19|20)\d{2}\b"
+        r"|"
+        # Written MDY: "Jan 15, 2000", "January 15 2000"
+        r"\b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?"
+        r"|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)"
+        r"\s+(?:0?[1-9]|[12]\d|3[01]),?\s+(?:19|20)\d{2}\b",
+        re.IGNORECASE,
+    ),
+    # Street address — house number + street name + recognised suffix
+    "address": re.compile(
+        r"\b\d{1,5}\s+(?:[A-Za-z0-9'.#\-]+\s+){1,5}"
+        r"(?:Street|St|Avenue|Ave|Road|Rd|Boulevard|Blvd|Drive|Dr|Lane|Ln|"
+        r"Court|Ct|Way|Place|Pl|Circle|Cir|Trail|Trl|Terrace|Ter|"
+        r"Parkway|Pkwy|Highway|Hwy|Route|Rte)\.?\b",
+        re.IGNORECASE,
+    ),
 }
 
 
@@ -663,8 +698,10 @@ _SENSITIVITY_MAP: dict[str, str] = {
     "credit_card": "high",
     "aadhaar": "high",
     "pan": "high",
+    "date_of_birth": "high",
     "email": "medium",
     "phone": "medium",
+    "address": "medium",
     "ip_address": "low",
     "uk_national_insurance": "low",
 }
@@ -703,6 +740,89 @@ def _luhn_check(number_str: str) -> bool:
     return total % 10 == 0
 
 
+def _is_valid_ssn(ssn_str: str) -> bool:
+    """Return ``False`` for SSNs in known-invalid SSA number ranges.
+
+    Filters out the following ranges that the SSA has *never* assigned:
+
+    * Area ``000`` — never issued.
+    * Area ``666`` — explicitly excluded by SSA policy.
+    * Areas ``900``–``999`` — reserved for Individual Taxpayer
+      Identification Numbers (ITINs); never used as SSNs.
+    * Group ``00`` — never issued within any valid area.
+    * Serial ``0000`` — never issued within any valid area/group.
+
+    Args:
+        ssn_str: Raw match string from :data:`_PII_PATTERNS` ``"ssn"``
+                 regex (e.g. ``"123-45-6789"``).
+
+    Returns:
+        ``True`` if the SSN passes all range checks; ``False`` otherwise.
+    """
+    digits = "".join(c for c in ssn_str if c.isdigit())
+    if len(digits) != 9:
+        return False
+    area = int(digits[:3])
+    group = int(digits[3:5])
+    serial = int(digits[5:])
+    if area == 0 or area == 666 or area >= 900:
+        return False
+    if group == 0:
+        return False
+    if serial == 0:
+        return False
+    return True
+
+
+def _is_valid_date(date_str: str) -> bool:
+    """Return ``True`` if *date_str* is a valid calendar date.
+
+    Accepts all numeric and written-month formats produced by the
+    ``"date_of_birth"`` regex in :data:`_PII_PATTERNS`.
+
+    Numeric formats (separators ``/``, ``-``, ``.``):
+
+    * ``YYYY/MM/DD``, ``YYYY-MM-DD``, ``YYYY.MM.DD`` — ISO / year-first
+    * ``MM/DD/YYYY``, ``MM-DD-YYYY``, ``MM.DD.YYYY`` — US month-first
+    * ``DD/MM/YYYY``, ``DD-MM-YYYY``, ``DD.MM.YYYY`` — day-first (Europe,
+      Asia, Australia, Latin America, etc.)
+
+    Written-month formats:
+
+    * ``DD Mon YYYY``, ``DD-Mon-YYYY``, ``DD Month YYYY`` (e.g. 15 Jan 2000)
+    * ``Mon DD, YYYY``, ``Mon DD YYYY``, ``Month DD, YYYY`` (e.g. Jan 15, 2000)
+
+    Delegates to :func:`datetime.datetime.strptime` so leap-year rules and
+    month-length limits are enforced (e.g. ``31/04/1990`` is rejected).
+
+    Args:
+        date_str: Raw match string from the ``"date_of_birth"`` regex.
+
+    Returns:
+        ``True`` if the string represents a real calendar date in any of the
+        recognised formats; ``False`` otherwise.
+    """
+    _FORMATS = (
+        # ISO / YMD
+        "%Y/%m/%d", "%Y-%m-%d", "%Y.%m.%d",
+        # US MDY
+        "%m/%d/%Y", "%m-%d-%Y", "%m.%d.%Y",
+        # Day-first DMY (Europe, Asia, Australia, Latin America, etc.)
+        "%d/%m/%Y", "%d-%m-%Y", "%d.%m.%Y",
+        # Written DMY: "15 Jan 2000", "15-Jan-2000", "15 January 2000"
+        "%d %b %Y", "%d-%b-%Y", "%d %B %Y", "%d-%B-%Y",
+        # Written MDY: "Jan 15, 2000", "Jan 15 2000", "January 15, 2000"
+        "%b %d, %Y", "%b %d %Y", "%B %d, %Y", "%B %d %Y",
+    )
+    for fmt in _FORMATS:
+        try:
+            datetime.datetime.strptime(date_str.strip(), fmt)
+            return True
+        except ValueError:
+            continue
+    return False
+
+
 def scan_payload(
     payload: dict[str, Any],
     *,
@@ -762,6 +882,24 @@ def scan_payload(
                     if not valid_matches:
                         continue
                     matches = valid_matches
+                # SSN range validation — drop known-invalid SSA ranges
+                if label == "ssn":
+                    valid_matches = [
+                        m for m in matches
+                        if _is_valid_ssn(m.group())
+                    ]
+                    if not valid_matches:
+                        continue
+                    matches = valid_matches
+                # Calendar validation for date_of_birth patterns
+                if label == "date_of_birth":
+                    valid_matches = [
+                        m for m in matches
+                        if _is_valid_date(m.group())
+                    ]
+                    if not valid_matches:
+                        continue
+                    matches = valid_matches
                 sensitivity = _SENSITIVITY_MAP.get(label, "medium")
                 hits.append(PIIScanHit(
                     pii_type=label,

{spanforge-2.0.0 → spanforge-2.0.2}/tests/test_phase11_security.py

@@ -252,4 +252,4 @@ class TestConfigureIntegration:
 
     def test_version_is_1_0_0(self):
         """spanforge.__version__ must match the current release."""
-        assert spanforge.__version__ == "2.0.0"
+        assert spanforge.__version__ == "2.0.2"