suaveplan/openspec/archive/2026-04-19-enterprise-data-masking/tasks.md

Tasks: enterprise-data-masking

1. Scaffold

• 1.1 universal/data/data-masking/; 100/100/100/100; guard tests; CLAUDE/README/FOLDERS.

2. Errors + schemas

• 2.1 src/error-codes.ts + side-effect register.
• 2.2 Zod schemas for MaskingConfig, MaskingRule, MaskingPolicy, AuditEntry.

3. Strategies

• 3.1 src/strategies/strategies.ts — hash (HMAC-SHA256), partial, redact, maskEmail, maskPhone, maskIp, maskCreditCard (Luhn-aware).

4. Detection

• 4.1 src/detection/type-detector.ts — TypeDetector with built-in SensitiveDataType patterns.

5. Patterns

• 5.1 src/patterns/pattern-masker.ts.

6. Registry

• 6.1 src/registry/registry.ts — MaskingRegistry + registry error codes.

7. Conditional rules

• 7.1 src/rules/conditional-masker.ts — role + field permissions.

8. Masker façade

• 8.1 src/masker/masker.ts — DataMasker orchestrator; OTel instrumentation.
• 8.2 src/types/masking-hooks.ts — hook surface.

9. Audit

• 9.1 src/audit/masking-audit.ts — MaskingAudit, AuditSink interface, filter helpers.

10. Docs / barrel / subpath exports / README

11. Benchmarks

• 11.1 mask.bench.ts on 10 k-record JSON trees.

12. Ship gate

• 12.1 Verification sequence; fold + archive.