First Australian structured-detector micro-slice: HPI-I and VSN

Status: owner-approved for experimental implementation (G0); see section 17 for the recorded decisions and the implementation. Observe and redact only, through G2; no production blocking. Evidence cut-off: 3 October 2026 (Australia/Sydney) Machine-readable companion: au-structured-detector-micro-slice.json (pinned sources, proposed definitions, 79 synthetic cases) Governing decisions: ADR 0003, ADR 0007, ADR 0010, and the proposed ADR 0011

This document specifies the first real detector pair. Sections 1–16 are the specification as reviewed; section 17 records the owner decisions and how the built-in detectors implement it. Every rule here is written so the expected output can be derived without the Go implementation.

1. RecommendationCopy Anchor Link

Keep the pair:

Research since the inventory produced three refinements, none of which changes the choice:

1. VSN has an unpublished check digit. The 2027 Victorian VET collection guidelines say the nine-digit format includes a check digit and refer to an algorithm on the VSN website. No public algorithm was found. VCAA still describes the VSN as randomly generated, which fits a random body plus a check digit. VSN therefore remains context-bound and can never be validated from local evidence. Groundskeeper must not guess the algorithm (compare OD-016 and OD-018).
2. VSN has published non-identifiers. Valid values are 000000001–999999999. 888888888 is a temporary code for a student who has not yet received a VSN. Both 000000000 and 888888888 are rejected. The standard enrolment form groups the number as 3-3-3, so that grouping is supported.
3. HPI-I is also legally protected. Section 26(1)(d) of the current compilation (C2026C00415, 19 September 2026) covers the identifier of an individual healthcare provider, not only a patient's IHI. Redacting HPI-I therefore has real privacy value.

Alternatives consideredCopy Anchor Link

2. Compatibility boundaryCopy Anchor Link

• Detectors consume only the canonical segments passed to the existing Detect(ctx, []model.Segment) interface: content_path, media_type, text, and optional role/source. They never read payload or adapter_attributes. This holds whether the concurrent API-drift work keeps payload-only requests or derives segments from them. This proposal assumes no outcome for that work.
• Output uses only existing finding fields: category, entity_type, severity, confidence, detector_id, detector_version, detector_class, validation_state, location, and evidence. All evidence kinds already exist in common.schema.json. No schema change is needed.
• The proposed detector IDs are builtin.pii.au.hpi-i and builtin.pii.au-vic.vsn. Both satisfy the current ID pattern. Each detector has one class, its own coverage and version, and can be rolled back independently. The builtin.pii.au detector in policies/examples/au-baseline.yaml remains illustrative.
• Detectors require no network, filesystem, clock, or randomness permissions. They are deterministic and idempotent, and their runtime is linear in the segment length.

3. Pinned sourcesCopy Anchor Link

Full records, including claims, licences, and freshness notes, are in the JSON sources object.

Licensing: only the HL7 guide is CC0, so its invariants may be embedded in machine-readable definitions. All other sources are cited as facts and are not reproduced. Labels such as "Victorian Student Number" are names, not protected expression. Do not use licensed HI Service test data.

4. Taxonomy and identityCopy Anchor Link

Rationale: the Healthcare Identifiers Act treats HPI-I as a healthcare identifier. Placing it under health_id, beside ihi, lets a policy that selects all Australian healthcare identifiers include it. The subdivision is a taxonomy level (au.vic) so policies can select Victorian identifiers. ISO 3166-2 remains in metadata (AU-VIC), as ADR 0011 requires.

5. Shared recognition rulesCopy Anchor Link

• Digits: ASCII 0–9 only. Fullwidth digits, other Unicode Nd digits, and format characters (Cf, including zero-width characters) are not folded or skipped in v0. They are measured as known gaps (section 10).
• Word character: any code point in Unicode category L*, N*, or M*, or Pc (which includes _).
• Surface forms: contiguous digits, or the documented grouping (HPI-I 4-4-4-4; VSN 3-3-3). Groups are joined by one repeated separator from U+0020, U+00A0, U+202F, U+002D, U+2010, or U+2011. A value cannot mix separators.
• Value boundary:
  • The code points immediately before and after the value are not word characters.
  • The value is not preceded by . or , with a digit before it, and is not followed by . or , with a digit after it. This excludes decimals and thousands grouping.
  • For grouped forms only, the value is not preceded by a group separator with a digit before it, and is not followed by a group separator with a digit after it. This is the maximal-run rule.
• Normalization: delete the group separator. Spans still cover the original code points from the first digit to the last, never surrounding labels, punctuation, or whitespace (ADR 0003). The segment text is never rewritten.
• Label boundary: a label must not be preceded or followed by a word character.
• Deduplication: each detector emits at most one finding per (content_path, start, end). When several bindings support the same span, their evidence is merged and the higher state is kept.
• Finding IDs must be unique within a response, for example au-hpi-i-001 and au-vic-vsn-001. The canary detector's finding-%03d scheme would collide once two detectors run.
• Evidence contains kind, result, method, version, and an optional label-set reference. It never contains a value, a substring, or an unkeyed hash.

6. HPI-I (validated_structured)Copy Anchor Link

1. Scan every segment as text, including application/json segments.

2. Accept a value in a supported surface form whose normalized form is 16 digits beginning with 800361.

3. Luhn: starting from the rightmost digit, double every second digit, subtract 9 from any doubled value above 9, and require the sum of all digits to be divisible by 10. This is equivalent to inv-hpii-2.

4. If the value passes, emit validation_state: validated with shape/supports and checksum/supports evidence. Otherwise emit nothing. In particular, do not emit for:

   • a Luhn failure, even when labelled;
   • prefix 800360 (IHI), 800362 (HPI-O), or any other prefix;
   • lengths 15 or 17;
   • embedded digits or alphanumeric adjacency.

   HPI-I never emits candidate or probable in v0. Emitting a candidate for a labelled Luhn failure is deferred.

5. Optional context evidence: this evidence never changes validation state.

   • Proximal label: use the nearest label ending within the 64 code points before the value, with no digit between the label and the value.
     • Supporting labels: HPI-I (hyphen U+002D, U+2010, or U+2011); HPII; and "Healthcare Provider Identifier <dash> Individual" (case-insensitive; the dash may be U+002D, U+2010, U+2011, U+2013, or U+2014).
     • Contradicting labels: IHI, HPI-O, HPIO, HSP-O, and HSPO. These produce context_label/contradicts. The structure still determines the category.
   • Segment URI: if there is no proximal label, the FHIR system URI http://ns.electronichealth.net.au/id/hi/hpii/1.0 anywhere in the segment produces context_label/supports.
   • Field key: if the last decoded pointer token normalizes to hpii or healthcareprovideridentifierindividual, and the trimmed segment is exactly the value, add field_path/supports.

6. validated means the value is validly formed according to a published check digit. It does not mean the identifier was issued, is current, or belongs to the person in the conversation. The HI Service is never queried.

7. VSN (context_bound_structured)Copy Anchor Link

ValueCopy Anchor Link

• A supported surface form (contiguous or 3-3-3) whose normalized form is 9 digits.
• Reject 000000000 and 888888888.
• Leading zeros are significant.
• No checksum test is performed. The published check digit's algorithm is unavailable, and v0 must not emulate it.

Text bindingCopy Anchor Link

The grammar is LABEL SEP VALUE, with label and value boundaries as defined in section 5.

• Tier A label: victorian HWS+ student HWS+ number, optionally followed by (VSN) with optional internal HWS. Matching is ASCII case-insensitive. HWS is U+0009, U+0020, U+00A0, or U+202F.
• Tier B label: either VSN in exactly that case, or "vsn" as a double-quoted JSON key in any ASCII case. The quoted form also requires : or U+FF1A in SEP.
• SEP: S1 [WORD S2].
  • S1 is 0–8 separator characters; S2 is 1–8.
  • WORD is one of is, number, no., or no (ASCII case-insensitive), and is allowed only when S1 is non-empty.
  • Separator characters: HWS, :, =, #, -, U+2013, |, *, ", ', and U+FF1A.
  • Line breaks and zero-width characters are not separators. This deliberately excludes non-adjacent text such as "VSN of the student is …".
• Corroboration (tier B text bindings only): look in the same segment for a whole-word jurisdiction term lying entirely within [label_start − 200, value_end + 200) code points.
  • Case-insensitive terms: Victoria, Victorian.
  • Exact-case terms: VIC, VCAA, VRQA.

Field bindingCopy Anchor Link

1. Split content_path on /.
2. Decode ~1 and then ~0 in each token, and take the last token. An all-digit token is an array index and does not match.
3. Normalize the key: convert it to ASCII lower case, then delete _, -, ., spaces, and /. If any code point outside [a-z0-9] remains, it does not match.
4. Classify the key: victorianstudentnumber is tier A; vsn is tier B.
5. Trim leading and trailing HWS and line breaks from the segment text. The result must be exactly one VSN surface form. The span excludes the trimmed whitespace.

Evidence-state semanticsCopy Anchor Link

Tier B is candidate because, outside education, "VSN" is an ambiguous acronym (for example, serial or version numbers). A tenant-approved application schema, bound through a future snapshot, is the intended route for raising a tier B field to probable. A detector heuristic is not.

Confidence placeholders in the JSON are uncalibrated. Until OD-019 is decided, policies must trigger on category and validation_state, not minimum_confidence. Conformance tests must not assert confidence values.

8. Eligible segments and pathsCopy Anchor Link

• Scan every segment regardless of role or source. System prompts, tool results, and model output can all contain identifiers. Policy match decides where an action applies.
• text/plain and application/json are both scanned as text. Spans index the exact JSON text.
  • The Portkey adapter currently splits JSON into one text/plain segment per string, keyed by its JSON Pointer. Field binding uses those pointers.
  • When redacting inside an application/json segment, the replacement must remain a valid JSON string fragment: no ", \, or control characters.
• Labels and values bind only within one segment. Cross-segment and conversation-level binding is a known gap.
• Multiple values per segment are supported. List binding such as VSNs: a, b is a known gap. This matters because VCAA specifically prohibits VSNs in class lists.
• The path is used only for field binding. It is never echoed in evidence beyond the finding's own location.content_path.

9. Overlap expectationsCopy Anchor Link

• Within the slice, HPI-I and VSN spans cannot overlap because their lengths and boundary rules differ. both.pos.disjoint_spans and both.vsn_label_with_hpi_i_value prove this. In the second case, a 16-digit HPI-I after a VSN label yields only the HPI-I finding.
• Detectors never suppress another detector's findings. With future detectors, the same span may carry several categories. For example, a generic Luhn or payment card detector would also match an HPI-I. Each context-bound detector binds only to its own labels, so identical-span collisions come from validated detectors without context gates. Any future generic Luhn or payment card detector should exclude the 80036[0-2] prefixes or rely on deterministic merge rules.
• Constraints in the executable slice at review time, verified by reading the code (all three are fixed; see section 17):
  1. ApplyModifications rejects overlapping modifications. A redact profile must therefore not include two categories that can produce the same span until a deterministic merge rule exists.
  2. The evaluator runs a detector once per rule and appends every finding. Two rules that use the same detector in one profile duplicate findings, and two redact rules would produce overlapping modifications. Use one rule per detector per profile.
  3. Finding IDs must be detector-scoped, as described in section 5.

10. FixturesCopy Anchor Link

The JSON contains 79 cases built from the canonical segment shape. Every wrapped request validates against evaluation-request.schema.json.

The cases produce 16 HPI-I validated findings, 17 VSN probable findings, and 3 VSN candidate findings. Six cases tagged adr0010_pair reuse a positive VSN value with no label, a jurisdiction term only, or a TFN, ACN, "student number", or wrong field label. Each must produce no finding.

Coverage by sliceCopy Anchor Link

• Unicode and spacing:
  • offsets after a ZWJ emoji sequence;
  • CJK text with fullwidth colons;
  • U+00A0 separators;
  • tabs and multiple spaces in labels;
  • Markdown bold and pipe tables;
  • quoted JSON keys;
  • escaped pointer tokens (~1);
  • trimmed field values;
  • punctuation adjacent to values.
• Hard negatives:
  • Luhn failure;
  • IHI, HPI-O, and other 8003 prefixes;
  • card test number 4111…;
  • lengths 8, 10, 15, and 17;
  • embedded digits, alphanumeric adjacency, and decimals;
  • five-group and four-group continuations;
  • comma grouping;
  • AVSN/myVSN;
  • Erlang {vsn, …};
  • VCAA Student Number;
  • both sentinels;
  • text that is not a value in a VSN field;
  • generic student_number keys.
• Known gaps (adversarial/evasion):
  • fullwidth and Arabic-Indic digits;
  • zero-width characters inside values or after labels;
  • combining marks;
  • Cyrillic homoglyph VЅN;
  • spaced V S N;
  • lowercase prose vsn;
  • plural VSNs;
  • value-before-label;
  • line breaks after labels;
  • non-adjacent labels;
  • unsupported groupings;
  • mixed separators;
  • cross-segment labels;
  • array-element fields.

How the fixtures were checkedCopy Anchor Link

Values were chosen by hand. Spans were computed from explicit markers, never by a detector.

• The three synthetic HPI-Is and the HL7 published example pass Luhn; the invalid fixture fails it.
• A throwaway reference reading of sections 5–7 agreed with all 79 expectations, and a mutated expectation was correctly rejected. That script was not committed: it is not a detector, and the conformance guide still calls for an independently authored reference evaluator.

Privacy of fixture valuesCopy Anchor Link

Fixtures use three HPI-I-valid values and three VSN-shaped values. None is paired with a name, date of birth, school, or practice. Checksum-valid synthetic values are not guaranteed to be unissued. The estimated chance that a given value is real is about 0.1% for HPI-I and below 1% for VSN.

11. Privacy constraintsCopy Anchor Link

• Synthetic data only, until privacy approval covers real-traffic observation. Section 26 of the HI Act and s 5.3A.10 of the ETR Act restrict use and disclosure. Legal review must confirm the deploying organisation's and the operator's roles before Groundskeeper processes real traffic containing these identifiers. Self-disclosure by a student (s 5.3A.13) is not a basis for retaining a value.
• Metadata-only telemetry (ADR 0007): counts by category, state, tier, and rejection reason (for example checksum_rejected or sentinel_rejected). Never values, substrings, unkeyed hashes, or path fragments beyond the finding location. Keyed fingerprints are off by default (OD-009).
• Errors contain no input. Coverage messages are fixed strings.
• Redaction replacements are fixed category tokens that encode nothing about the value. Reversible tokenisation is excluded (OD-010).
• No remote validation: neither the HI Service nor the Victorian Student Register is queried.
• No external judges receive fixtures or traffic (OD-008).
• No inference is made about people, schools, communities, or Indigeneity. The fixtures contain no names or community material (ADR 0008).

12. Benchmark methodologyCopy Anchor Link

1. Partitions follow conformance and benchmarking:
   • public development: this JSON;
   • private fixed holdout: produced by a seeded template generator, authored and held by someone other than the detector implementer;
   • incident-derived cases: later, under the separate privacy process.
2. Generators combine templates, values, and perturbations, and label from the template, never from detector output. They cover:
   • every surface form, label tier, separator, segment type, and role/source;
   • every hard-negative family in section 10;
   • known-gap perturbations as a separate evasion slice.
3. Benign background: synthetic numeric-heavy text without identifiers, such as logs, CSV and spreadsheets, invoices and orders, code, and phone and banking formats. Reuse public-domain prose only after a licence check. Report findings per million code points. The analytic HPI-I expectation for random digits is about 10⁻⁷ per 16-digit window.
4. Metrics:
   • exact type-and-span precision, recall, and F1 by category, state, tier, and slice;
   • post-redaction leakage (any gold digit remaining) and over-redaction (code points outside gold spans);
   • zero rate on bare-value ADR 0010 pairs;
   • known-gap recall, reported but not gated;
   • latency at p50/p99 per KiB and allocations;
   • determinism across repeated runs.
5. Statistics:
   • Wilson 95% intervals for proportions.
   • The rule of three for zero-error claims: zero false positives in n trials bounds the rate below 3/n at 95%.
   • McNemar's test and paired bootstrap for version comparisons.
6. Reproducibility: pin the generator seed, corpus hash, spec version, detector version, and policy digest. Store raw outputs with values redacted.

13. Provisional non-production gatesCopy Anchor Link

Numbers marked † are proposals for OD-004 and OD-019 owners, not decisions.

Observe and redact are permitted only up to G2 and outside production enforcement. Nothing in this slice authorises blocking.

An illustrative policy bundle follows. It validates against policy-bundle.schema.json. At review time it was not committed because the detectors did not exist; the implemented equivalent is policies/examples/au-baseline.yaml (section 17):

bundle_version: "1.0"
name: dev.groundskeeper.examples.au-structured-micro-slice
version: 0.0.1
profiles:
  observe:
    composition: deny_wins
    rules:
      - id: observe_au_hpi_i
        check: { detector: builtin.pii.au.hpi-i, timeout_ms: 50 }
        required: false
        on_error: continue_unjudged
        trigger: { categories: [privacy.pii.health_id.au.hpi_i], minimum_validation: validated }
        action: { type: record }
      - id: observe_au_vic_vsn
        check: { detector: builtin.pii.au-vic.vsn, timeout_ms: 50 }
        required: false
        on_error: continue_unjudged
        trigger: { categories: [privacy.pii.education_id.au.vic.vsn], minimum_validation: candidate }
        action: { type: record }
  redact:
    composition: deny_wins
    rules:
      - id: redact_au_hpi_i
        check: { detector: builtin.pii.au.hpi-i, timeout_ms: 50 }
        required: false
        on_error: continue_unjudged
        trigger: { categories: [privacy.pii.health_id.au.hpi_i], minimum_validation: validated }
        action: { type: redact, replacement: "[AU_HPI_I]" }
      - id: redact_au_vic_vsn
        check: { detector: builtin.pii.au-vic.vsn, timeout_ms: 50 }
        required: false
        on_error: continue_unjudged
        trigger: { categories: [privacy.pii.education_id.au.vic.vsn], minimum_validation: probable }
        action: { type: redact, replacement: "[AU_VIC_VSN]" }

14. How the pair proves ADR 0010Copy Anchor Link

The following invariants must hold for every output, checked mechanically:

• validated ⇒ some checksum or reference_match evidence has result supports.
• context_bound_structured ⇒ some issuer_label, context_label, or field_path evidence has result supports.
• VSN probable ⇒ there is jurisdiction/supports evidence or a tier A binding.

15. Decisions neededCopy Anchor Link

1. Pair: approve HPI-I + VSN (recommended), or start with IHI to gain patient value at the cost of higher fixture-collision risk.
2. Taxonomy: approve privacy.pii.health_id.au.hpi_i and privacy.pii.education_id.au.vic.vsn, including the subdivision level, and extend the initial taxonomy table.
3. VSN tier B: keep VSN and "vsn" without corroboration as candidate (recommended), or treat them as probable outright.
4. Unicode stance: accept ASCII-only v0, with folding and obfuscation measured as known gaps. This must be revisited before G3.
5. Privacy and legal (OD-010 and related):
   • provisional severities and replacement tokens;
   • processing roles under the HI Act and ETR Act before any real traffic;
   • whether to request the VSN check-digit algorithm from VCAA as an approved source. Obtaining it privately would not by itself justify validated.
6. Gates: set the numbers marked † (OD-004 and OD-019).

16. Follow-upsCopy Anchor Link

• The inventory's VSN record says "None published" for the checksum. That remains accurate, but the record should cite djsir-vvssc-2027 for the check digit's existence and the 888888888 code. Adding a source changes the inventory invariants enforced by scripts/validate-contracts.sh, so the change is left for a reviewed inventory update.
• No catalog/ package was created. ADR 0011 is still Proposed, and no catalogue schema exists to validate against. Once both are approved, move the JSON definitions and cases into catalog/packages/groundskeeper.dev/pii-au and convert them to the package test format.

17. Owner decisions and implementation recordCopy Anchor Link

Decisions recorded on 3 October 2026Copy Anchor Link

The owner approved the following answers to section 15. They are provisional where marked and do not settle any open decision named below.

Executable-slice invariants fixed before the detectorsCopy Anchor Link

The three constraints listed at the end of section 9 no longer apply:

1. One execution per detector. The evaluator runs each detector referenced by an enabled rule exactly once per request and reports its findings once. Every referencing rule judges the shared output and gets its own coverage entry. The shared run uses the longest referencing timeout; a rule whose own timeout_ms was exceeded is timed_out and applies its on_error.
2. Deterministic redaction merge. Overlapping or identical redactions with the same replacement merge into their union and carry the sorted union of finding IDs. Touching spans stay separate. Overlapping redactions with different replacements fail closed: the decision becomes block, no modification is returned, and coverage and unjudged gain a failed evaluation.modifications entry with reason conflicting_modifications. The two micro-slice detectors cannot produce overlapping spans, so the example profiles never reach this path.
3. Response-wide finding IDs. The evaluator assigns finding-NNN IDs after ordering findings by content path, span, detector ID, and category. IDs are unique across detectors and deterministic for a given request and policy, independent of rule order. Detector-local IDs (au-hpi-i-NNN, au-vic-vsn-NNN) are not exposed.

Section 2's compatibility note is also settled: canonical requests are now segments-authoritative and payload is rejected, so detectors only ever see canonical segments.

ImplementationCopy Anchor Link

• Detectors: builtin.pii.au.hpi-i and builtin.pii.au-vic.vsn in internal/checks/pii, version 0.1.0, implementing sections 5–7 exactly. They are registered as built-ins but run only when the active policy profile references them. The default development policy does not, so they are disabled by default (G0).
• Policy: policies/examples/au-baseline.yaml now loads in the runtime with an observe profile (record; HPI-I validated, VSN candidate) and a redact-experimental profile (HPI-I validated, VSN probable). Every rule is required: false, on_error: continue_unjudged, and overridable: false, and no rule uses minimum_confidence (OD-019). See policy bundles.
• Privacy: detectors never log. Evidence carries only fixed method and version strings. Coverage messages are fixed. Tests serialize complete output and assert that no value or fragment appears in it or in HTTP responses.

ValidationCopy Anchor Link

Latency was characterised on 64 KiB of adversarial, label- and digit-dense text on a 2-vCPU orb: about 1 ms for HPI-I and 2–3 ms for VSN, linear in input size (about 25 µs and 38 µs per KiB). A regression test fails above 100 ms per 64 KiB. This is a characterisation, not the OD-004 latency SLO.

Known gaps (v0, documented and measured)Copy Anchor Link

• Unicode digits, fullwidth digits, zero-width and other format characters, combining marks, and homoglyph labels evade detection. The 19 known-gap fixtures and 12 generated perturbations all evade v0 (recall 0/19 and 0/12).
• Lowercase prose vsn, plural VSNs, list binding, value-before-label, line breaks after labels, non-adjacent labels, cross-segment labels, and array-element fields are not bound.
• HPI-I does not emit a candidate for a labelled Luhn failure.
• check.config is not passed to built-in detectors in this slice.
• Built-in detectors have no manifest file yet; the class is a code constant and is carried on every finding.
• Holdout, benign-background, and real-traffic measurements required by G1 and later gates have not been run.