Repository navigation
feat(sequencer): middleware.pii_mask op and boundary stack (#58) - #90
Merged
rosspeili merged 1 commit intoOct 11, 2026
Merged
Conversation
- Introduce two-tier PII sanitization engine: - Tier 1 zero-dependency stdlib regex with algorithmic Luhn check for credit cards, RFC emails, global international phones (E.164, UK/EU, NANP, compact format), SSNs, IPv4/IPv6, API keys/JWTs/UUIDs, and IBAN. - Tier 2 pluggable PiiMaskerProvider protocol and callable support for contextual NER models (Skillware, micro-f1-mask, Presidio) with configurable on_error fault-tolerance (fallback, fail, pass). - Support masking strategies: redact, mask (preserving country codes), and pseudonymize/tokenize with deterministic session-scoped tokens. - Add SequencerRunner op middleware.pii_mask and MiddlewareStack per_step boundary interception (inbound/outbound) with strict mode. - Emit middleware.applied on audit spine with zero raw PII leakage. - Integrate audit report scorecard (scorecard.middleware) and surface PII_MASKED finding (severity: info). - Add Example 15 (examples/15-sequencer-pii-mask/), stress simulation (scripts/aura_pii_stress_sim.py), 29 dedicated tests, and documentation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements issue #58: sequencer middleware stack and
middleware.pii_maskoperation for automated data sanitization across agent execution pipelines.Key Capabilities
PiiMaskerProviderand callable functions for contextual NER models (Skillware NER, ARPAmicro-f1-mask270M, Presidio) with configurableon_errorfault-tolerance (fallback,fail,pass).redact(default, e.g.[EMAIL]),mask(partial obfuscation retaining operational shape & country code), andpseudonymize/tokenize(deterministic session-scoped pseudonym tokens<EMAIL_REF_...>preserving entity equivalence across multi-step agent reasoning).type: op, ref: middleware.pii_mask) and step boundary interceptors (MiddlewarePolicy/MiddlewareStackatscope: per_step, inbound/outbound). Strict mode (strict: true) raisesConstraintViolationon detection.middleware.appliedcontaining detection metrics only (strictly zero raw PII on the spine). Audit report populatesscorecard.middleware = {applied, pii_redactions}and surfaces thePII_MASKEDfinding (severity: info).examples/15-sequencer-pii-mask/demonstrating step op sanitization and audit receipt generation.Type
Checklist
Fixes #58)pytestpasses (284/284 passed in 47s)black aura tests scripts examples— no diff (133 files unchanged)flake8 aura tests scripts examples— clean (0 warnings)CHANGELOG.mdupdated under[Unreleased]->Addedscripts/aura_pii_stress_sim.py) passing 5/5 scenariosTest plan
pytest tests/test_sequencer_pii_mask.py tests/test_pii_stress_sim.py -v: 29 passed.python scripts/aura_pii_stress_sim.py: 2,000 entities across deep trees sanitized in 26.8ms.python examples/15-sequencer-pii-mask/main.py: verified pseudonymization and audit report scorecard/findings.pytest: 284 passed in 47.54s (zero regressions).