redact-pii

Files (15)

• SKILL.md
• ambiguous-name-needs-review.yaml · fixtures/
• composes-in-graph.yaml · fixtures/
• direct-leakage-stops.yaml · fixtures/
• obfuscated-email-stops.yaml · fixtures/
• redact-pii-blocked.yaml · fixtures/
• redact-pii-needs-content.yaml · fixtures/
• redact-pii-ready.yaml · fixtures/
• composed.graph · fixtures/support/
• tokenize-stable-placeholders.yaml · fixtures/
• mark.svg
• redact-pii.mjs
• catalog.md · references/
• mark-license.md · references/
• run.yaml

SKILL.md (first lines)

# Redact PII

Treat the verdict as a boundary gate. Only `ready` returns content that may cross the boundary. `needs_review` and `blocked` return no residual content.

## Procedure

1. Resolve `mode`: `redact`, `tokenize`, or `block`. Resolve target classes from `classes`; omitted classes use the broad default policy.
2. Inspect the supplied content and return PII detections as class, UTF-16 code-unit span, and confidence. Never copy a matched value into the report or reasoning.
3. Use semantic judgment for names, addresses, quasi-identifiers, and whether removal destroys meaning. Choose `needs_review` when confidence is insufficient.
4. The deterministic finalizer validates spans and policy, performs the replacements itself, scans the residual for direct and obfuscated high-confidence identifiers, computes source and residual digests, and strips residual content unless the final decision is `ready`.
5. A `block` policy always returns `blocked`. This skill never sends, exports, logs, or stores content.

The finalizer, not the agent, owns replacement text and digests. `redact` emits `[REDACTED:CLASS]`; `tokenize` emits stable per-document `[TOKEN:CLASS:N]` placeholders. Invalid or overlapping spans fail closed.

## Output

```yaml
redaction_report:
  decision: ready | needs_review | blocked
  detected:
    - class: string
      span: [integer, integer]
      confidence: number
  source_digest: sha256:...
  redacted_digest: sha256:... | null
  residual_risk:
    level: low | medium | high
    reason_code: string
    reason: string
  scanner:
    status: pass | hold | block
    findings:
      - class: string
        span: [integer, integer]
        rule: string
  policy:
    classes: array
    mode: redact | tokenize | block
    locale: string
redacted_content: string
```

Scanner findings contain locations and rule names, never matched values. A clean scanner does not prove that semantic identifiers cannot exist; that uncertainty remains the reviewer agent's job and must produce `needs_review` when material.

## Agent task contracts

### `redact-pii-detect`

Inspect only the supplied content. Return redaction_draft with decision (ready, needs_review, or
blocked), detected spans as class, UTF-16 start/end offsets, and confidence, plus residual_risk
with level and reason_code. Never include matched values. Use reason_code none,
ambiguous_semantics, scrubbing_destroys_meaning, policy_block, or insufficient_context. The
deterministic finalizer owns all replacements, scanning, digests, and the final pass gate.

From runxhq/runx, Apache-2.0.

More from runxhq/runx