ACE-041: PII masking (mask-else-refuse) - #128

Draft

sandeep-agami wants to merge 11 commits into

ACE-035-shared-guardrail-contractfrom

ACE-041-pii-masking

Commits on Jul 13, 2026

ACE-041 slice1: failing guard tests for maskable/index classification

sandeep-agami
and
claude
committed
ACE-041 slice1: check_sensitive_projection -> maskable + output index, tests green

sandeep-agami
and
claude
committed
ACE-041 slice2: failing policy tests

sandeep-agami
and
claude
committed
ACE-041 slice2: data_protection policy branch (mask/reject), tests green

sandeep-agami
and
claude
committed
ACE-041 slice3: failing mask e2e + executor + case-fold + unparseable tests

sandeep-agami
and
claude
committed
ACE-041 slice3: case-insensitive sensitive-name match (close SELECT "SSN" bypass)

sandeep-agami
and
claude
committed
ACE-041 slice3: redact at execute_guarded + mask plan wiring + applied[{mask}]

sandeep-agami
and
claude
committed
ACE-041 slice3: flip maskable-refuse tests to mask; widen _model_safety stubs; sync-lib

sandeep-agami
and
claude
committed

Commits on Jul 14, 2026