Skip to main content

Prepare the PII removal example

The walkthrough and machine fixture use these repository files:

  • Fixture: examples/data-security/remove-pii/sample-data.json
  • Configuration: examples/data-security/remove-pii-complete.yaml
  • Fixture environment: examples/data-security/remove-pii/fixture-environment.json
  • Expected output: examples/data-security/remove-pii/expected-output.jsonl

From the repository root, inspect both before changing field names:

jq . examples/data-security/remove-pii/sample-data.json
sed -n '1,220p' examples/data-security/remove-pii-complete.yaml

Salt inputs​

The hash mappings read three environment variables. Generate values for an adapted run without printing them:

export IP_SALT="$(openssl rand -hex 32)"
export EMAIL_SALT="$(openssl rand -hex 32)"
export USER_SALT="$(openssl rand -hex 32)"

printf 'IP=%s EMAIL=%s USER=%s\n' \
  "${#IP_SALT}" "${#EMAIL_SALT}" "${#USER_SALT}"

The configuration has no built-in salt fallback. Treat a missing or empty value as a failed precondition, and load secrets through the controls used by the adapted environment.

Run the exact fixture gate​

Run the machine gate from the repository root:

npm run test-pipelines

The gate uses isolated local mode, replaces only the pipeline edges with local fixture files, and compares the output byte for byte. See the repository tooling guide for Expanso tool prerequisites. Its checked-in salts are fixture-specific values, not secrets or deployment defaults.

Scope​

This proves one deterministic core-path result. It does not test malformed inputs, load, recovery, salt rotation, or production controls. Continue with payment-field deletion or inspect the curated Explorer.