Redaction that preserves the surrounding document.

IMPLEMENTATION

Design choices.

1. Replace spans in the original string instead of rebuilding the document from a parsed representation. This preserves useful surrounding context across text formats, while leaving detection quality as a separate problem to evaluate.
2. Filter detector groups before selecting overlap winners. An ineligible high-priority candidate must not discard an enabled fallback and then disappear itself, leaving a value untouched.
3. Allocate placeholders within one call instead of keeping a persistent secret-to-label table. Repeated values remain easy to follow inside a result, but their labels do not become stable identities across documents.
4. Keep manual phrases active independently of automatic detector groups and make per-finding overrides explicit. These controls let the review address omissions and false positives without presenting automatic detection as complete.
5. Leave task scheduling, source-text lifetime and output destinations with the caller. The small package boundary supports reuse; it does not certify the safety of a publication or erase the original bytes.

HOW IT FITS TOGETHER

Architecture.

• Redactor is a synchronous Sendable value API. It receives input and policy and returns text, findings and a report, allowing the same processing logic to be used without an app window or clipboard service.
• CompositeDetector collects and deduplicates candidates. Redactor removes disabled groups before resolving overlaps with priority, confidence and span-length scores, then applies the confidence threshold to the selected candidates.
• Each call creates a new PlaceholderAllocator. Repeated values share a placeholder within that result, different values are numbered by kind, and per-finding Keep choices explicitly leave selected text unchanged.
• Accepted findings use UTF-16 spans and are applied from the end of the string toward the start. This preserves earlier positions and leaves untouched document structure in place instead of parsing and serializing it again.
• Public findings carry ranges, kinds, confidence, fixed reasons and masked previews rather than an original-value field. Omitto uses that metadata for review and remains responsible for scheduling and copying.

ACCESS & INPUT

Security controls.

• The package imports Foundation and has no external package dependencies. A repository boundary check rejects UI, pasteboard, persistence, networking and telemetry symbols in the core.
• Public findings omit an original-value field, and custom debug descriptions omit both input and output text. The review metadata can describe a finding without reproducing its detected value.
• The library uses manual phrases for the current call and does not persist them. These phrases remain active even when all automatic detector groups are disabled.
• Placeholder allocation checks whether a proposed replacement equals the original value. If it does, the allocator changes the token so that an accepted redaction does not silently preserve the same text.
• Explicit Keep choices can leave findings in place, and unfamiliar formats can escape heuristic detection. The returned document still needs review before it is shared.
• The caller owns the lifetime of raw input, options, output and any clipboard copy. Nothing in this API promises secure memory erasure.

CHECKS & RESULTS

What was checked.

A source review shows what the code does. It is not a fresh test of the running app.

1. Code and development records reviewedReviewed11 September 2026

   The code, tests and available development records were checked. Reported test results keep their original scope. No fresh app or live deployment check was run for this write-up.

   Scope of this check

   Code review, not a fresh run of the app