CipherGate v0.17.0

Policies can now be built in layers. A shipped baseline pack, a jurisdiction pack (US, EU or
India) and your own small file merge into one policy, and a later layer cannot quietly weaken
an earlier one. The packs are templates requiring review, not legal or compliance advice.

Added

• Policy layering: extends: [pack, ...] builds one effective policy from shipped packs plus
  your own file. Layers merge so that a later layer can never quietly weaken an earlier one.
  Conflicting context pins, weaker settings or requirements, disabled detectors, and rules or
  defaults that would override an earlier block, review or transform with something weaker
  fail validation. A rule may weaken an earlier rule or default only by naming it in the new
  relaxes field; this is reported as a warning. Earlier hard and guardrail rules can
  never be relaxed.
• Shipped packs (templates requiring review): healthcare_baseline, a strict global healthcare
  default, and us_hipaa, field classifications modelled on the HIPAA Safe Harbor identifier
  list, with ages over 89 shown as 90+. us_hipaa is not Safe Harbor or Expert Determination
  by itself.
• New template hospital_us_override, an example hospital layer on top of us_hipaa.
• Packs eu_gdpr and india_dpdp (templates requiring review, not legal advice). eu_gdpr
  blocks GDPR Art. 9 special-category fields toward external destinations and reviews them
  elsewhere, and finds member-state identifier fields plus Italian codice fiscale values.
  india_dpdp finds grouped Aadhaar numbers, ABHA numbers and addresses, PAN and Indian
  identifier fields, and blocks SPDI-style sensitive fields toward external destinations. One
  policy can extend several jurisdiction packs.

Changed

• When equally protective findings overlap in one value, the more confident one now names the
  redaction marker (for example a grouped Aadhaar number is marked pii.government_id, not
  pii.phone). What gets removed is unchanged.
• Reports list the policy's layers (name, kind, source, file digest), and each decision names
  the layer that made it. policy.digest now covers every layer. validate-policy prints the
  layer chain and adds layers to its JSON output. The terminal summary and the review page
  show the layer next to the rule id.

---

Install: pip install ciphergate-cli==0.17.0

CipherGate is not legal advice, a compliance system, or a certified de-identification service. The healthcare_baseline, us_hipaa, eu_gdpr and india_dpdp packs are templates requiring review. A successful run means the configured processing completed; it does not prove the output contains no sensitive information.