Tighten basic PII redaction boundaries

[dd3ok]

Summary

• expand the basic PII redaction profile to basic-contact-v2
• redact common dashed Korean resident/foreigner registration number patterns and dotted Korean mobile formats
• document the basic-contact-v2 redaction-policy cache cold-start impact
• document current limits and alternative boundaries for PII redaction, URL input, cache privacy, concurrency, provider adapters, benchmark estimates, embedding caches, prompt caching, LlamaIndex, and custom Redis/SHA256 caches
• add tests for the new PII scope, redaction policy id, cache-key policy examples, and README boundary wording

Self-review

• Scope is intentionally small: no broad DLP scanner, URL fetcher, process lock, provider telemetry, or non-OpenAI adapter was added.
• Cache-key safety is preserved by changing the redaction policy id to basic-contact-v2; existing document/output cache keys include redaction_policy_id.
• Documentation says the registration-id support is for common dashed Korean resident/foreigner registration patterns, matching the actual regex instead of implying complete Korean PII detection.
• Changelog notes that PII-redacted document-summary and rendered-output cache entries cold-start after the policy id change.
• Existing untracked .agent/, .superpowers/, and historical plan files were not staged.

Validation

• .\.venv\Scripts\python.exe -m pytest -q -p no:cacheprovider -> 172 passed, 2 skipped
• .\.venv\Scripts\python.exe scripts\validate_skill.py --run-evals -> OK
• ruff check . -> All checks passed
• git diff --check -> no whitespace errors; CRLF conversion warnings only

[gemini-code-assist]

Code Review

This pull request upgrades the PII redaction profile from basic-contact-v1 to basic-contact-v2, adding support for redacting Korean Resident Registration Numbers (RRN) and dotted Korean mobile phone formats. It also documents system limitations and alternative boundaries in the README files and updates the test suite to reflect these changes. Feedback on the PR suggests expanding the RRN regular expression to also cover Alien Registration Numbers (ARNs) by changing the gender/century digit range from [1-4] to [1-8] to ensure complete compliance with Korean PII regulations.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The current regular expression for Korean Resident Registration Numbers (RRN) uses [1-4] for the gender/century digit. While this covers Korean citizens born in the 1900s and 2000s, it completely misses Alien Registration Numbers (ARNs) for foreign residents in Korea, whose gender digits are 5, 6, 7, or 8. Under Korean PII regulations (PIPA), ARNs are treated with the same level of sensitivity as RRNs. To ensure complete coverage of sensitive resident/alien registration numbers for all residents, please expand the range to [1-8].

Suggested change

	("kr-rrn", re.compile(r"(?<!\d)\d{6}-[1-4]\d{6}(?!\d)"), "[REDACTED:kr-rrn]"),
	("kr-rrn", re.compile(r"(?<!\d)\d{6}-[1-8]\d{6}(?!\d)"), "[REDACTED:kr-rrn]"),

[dd3ok]

Self-review completed.

Findings:

• No remaining blocking findings in the PR diff.
• During review I found one missing operational note: changing redaction_policy_id to basic-contact-v2 cold-starts PII-redacted document-summary and rendered-output cache entries. Fixed in the amended commit and PR body.

Checks performed locally on the final branch state:

• .\.venv\Scripts\python.exe -m pytest -q -p no:cacheprovider -> 172 passed, 2 skipped
• ruff check . -> All checks passed
• .\.venv\Scripts\python.exe scripts\validate_skill.py --run-evals -> OK
• git diff --check -> no whitespace errors; CRLF conversion warnings only

Scope review:

• The implementation only adds narrow regex coverage for common dashed Korean RRN patterns and dotted Korean mobile separators.
• It does not add broad DLP, account-number detection, URL fetching, cross-process locking, provider telemetry, or new LLM providers.
• The docs state these boundaries explicitly.

[dd3ok]

Follow-up self-review update: addressed the Gemini Code Assist note by expanding the Korean registration-id regex from [1-4] to [1-8], covering common dashed resident and foreigner registration number patterns. Added a regression assertion for 900101-5123456 and updated README/README.ko/best-practices/CHANGELOG wording so the documented scope matches the implementation.

Fresh local validation after the amendment:

• .\.venv\Scripts\python.exe -m pytest -q -p no:cacheprovider -> 172 passed, 2 skipped
• .\.venv\Scripts\python.exe scripts\validate_skill.py --run-evals -> OK
• ruff check . -> All checks passed
• git diff --check -> no whitespace errors; CRLF conversion warnings only