# False-positive ledger for tools/phi_scan.py. Entries are matched lowercase.
# Every entry needs a justification. Adding a real identifier here would be
# a policy violation — entries must be provably public vocabulary.

# Column names from Practice Fusion's OFFICIAL PUBLIC EHI export data
# dictionary v9 (practicefusion.com/ehi-export-documentation, verified
# 2026-06-11). They are >=24 chars, so the deny-list generator's
# opaque-token pass hashed them out of the private predecessor's source;
# they are public schema identifiers, not PHI.
diagnosiscodeequivalents
lastmodifiedbyproviderguid
patientinsuranceplanguid
transactiondisplaydatetimeutc
# patient-medications.tsv column — v9 spells the last-modified stamp on this
# ONE table with a Display prefix. Reached the repo when the mapper was
# corrected to the vendor's spelling (#247), and it is 30 chars, so the same
# opaque-token pass hashed it out of the predecessor's source as the four above.
displaylastmodifieddatetimeutc
# patient-guarantor.tsv column (gpdfs:951 consumes it; same v9 dictionary).
billingpatientrelationshipoption

# Synthetic dates of birth of fixture patients "Ada Fixture", "Boris Sample"
# and "Cleo Placeholder" (tests/fixtures/pf_tebra_v9) and "Synthia Probe"
# (tests/unit/test_qa.py). Tests assert rendered chart headers
# ("DOB mm/dd/yyyy"), which legitimately put the DOB marker next to the date;
# the golden rendering snapshot (tests/e2e/goldens/) stores that same
# synthetic chart text verbatim, so the fixture DOBs appear there too.
# 03/15/1988 is the synthetic guarantor "Gus Placeholder" (payment section
# DATE OF BIRTH cell, asserted by the PF-pack payment tests + golden).
03/14/1985
07/04/1952
12/01/2021
01/02/1980
03/15/1988

# Synthetic near-miss dates used by the QA boundary-matching regression
# tests (tests/unit/test_qa.py): they prove a record DOB of 1/2/1980 does
# NOT match a chart showing 11/2/1980.
1/2/1980
11/2/1980

# Synthetic near-miss dates for the boundary-anchored identity regression
# tests (tests/unit/test_identity.py, test_verify_levels.py, test_browserpack.py):
# the same shape as the 1980 pair above, one octave up. They prove a record DOB
# of 1/2/1990 does NOT match a chart showing 11/2/1990 (an unpadded DOB hiding
# inside a longer date) — the wrong-patient collision the shared predicate
# (anastomosis.core.identity) rejects. Fully synthetic; never a real DOB.
1/2/1990
11/2/1990

# Synthetic DOBs for the L0-L6 delivery-verification tests
# (tests/unit/test_verify_{levels,composite}.py). The synthetic patient
# "Synthia Testpatient" has DOB 01/02/1990; the tests render that into a fake
# chart header ("DOB mm/dd/yyyy") and assert L2/L3 match it. The other two are
# the deliberate WRONG-patient DOBs the wrong-chart tests prove are rejected
# (12/31/1965 on a right-name page; 03/04/1975 on a different-patient page).
01/02/1990
12/31/1965
03/04/1975


# Synthea sample C-CDA fixture (tests/fixtures/synthea/) — GUIDs generated
# by the Synthea synthetic-patient simulator (MITRE, Apache-2.0). The data
# is fully synthetic by the project's own statement ('No individual-level
# data was used in creating it'); provenance + license in the fixture
# README. These are Synthea's deterministic per-patient ids, not PHI.
3da68fbe-0b08-2747-00ee-3c459e7d73b8
3da68fbe-0b08-2747-26b9-7d220d57943f
3da68fbe-0b08-2747-339a-0f93da593992
3da68fbe-0b08-2747-4756-7828291dca5a
3da68fbe-0b08-2747-4896-0a30f5636eba
3da68fbe-0b08-2747-51af-09d2403be6d7
3da68fbe-0b08-2747-597c-e0f6e75a4c68
3da68fbe-0b08-2747-6361-641bcddd2868
3da68fbe-0b08-2747-649a-06e4b36b4259
3da68fbe-0b08-2747-7102-fa7f2e8464b0
3da68fbe-0b08-2747-806a-e14daa1e0d66
3da68fbe-0b08-2747-9349-fe12a0625649
3da68fbe-0b08-2747-9f8d-113f65f61ae6
3da68fbe-0b08-2747-a146-16c4459ba196
3da68fbe-0b08-2747-ae2c-55cf62ffea38
3da68fbe-0b08-2747-b50d-b062e56e914b
3da68fbe-0b08-2747-b85d-2f7af9c1957e
3da68fbe-0b08-2747-c114-ca24f5917d6a
3da68fbe-0b08-2747-d23f-6aec7d98e0aa
3da68fbe-0b08-2747-d49f-6c8bf3955adb
3da68fbe-0b08-2747-d4b8-2807b7fa8d91
3da68fbe-0b08-2747-dbbd-0b2f253fdfbc
3da68fbe-0b08-2747-dc0e-437b9970c8cd
3da68fbe-0b08-2747-dcd3-31aa2816d32b
3da68fbe-0b08-2747-e0c9-6a693abacce8
3da68fbe-0b08-2747-e7ab-dd9b19ac6cfc
3da68fbe-0b08-2747-f0e4-d10398ebd4a7
3da68fbe-0b08-2747-f7ef-2241eac48bfe

# core.ccda_codes.organizer_component_source_id's output, pinned LITERALLY in
# tests/unit/test_ccda.py and tests/unit/test_ccda_export.py (#378 round two)
# rather than computed by calling the function under test — a test that
# recomputes the value it is meant to pin cannot catch a change to the recipe
# itself, which is exactly what let three mutations of it survive the suite
# before these literals existed. Both are
# uuid5(NAMESPACE_URL, "anastomosis:ccda:organizer:<root>:<extension>:
# component:<index>") over the synthetic feedface-idls-* organizer id in
# tests/fixtures/ccda_edge_cases/feedface_ccd_idless_result_component.xml and
# feedface_ccd_two_idless_components.xml (index 0 and 1) — this repo's own
# deterministic hash of synthetic input, not an identifier any system issued.
7029466a-7630-5f95-9072-85ca63f186dc
f244f1d6-d7d6-5bc0-ac55-fc41390a3c9b

# sources.ccda.parser's encounter identity recipe (#393), pinned LITERALLY in
# tests/unit/test_ccda.py and tests/unit/test_one_patient_is_one_chart.py for
# the same reason as the pair above — a test that recomputes the value it is
# meant to pin cannot catch a change to the recipe itself. All four are
# uuid5(NAMESPACE_URL, "anastomosis:ccda:encounter:<root>:<extension>") over
# synthetic (root, extension) pairs the tests construct inline (a vendor OID
# "2.16.840.1.113883.19.5.99999.1" with extension "9001"; the synthetic GUID
# "feedface-e000-0000-0000-00000000009b" with extension "visit-42"; and the
# colon-collision pair "1.2.3"/"X:4" vs "1.2.3:X"/"4") — this repo's own
# deterministic hash of synthetic input, not an identifier any system issued.
20c70a5e-f37d-5241-86d1-39c1ae15d794
5582544a-2141-5900-9cdf-b68f2a8ec44f
efa36b0c-c55f-54d6-bcb3-35741a0c8b43
f773cf29-b409-5f2b-9d86-736aab997c80

# The Microsoft Edge WebView2 Runtime's EdgeUpdate "Clients" GUID — a fixed,
# PUBLIC Microsoft product identifier the Windows installer (packaging/
# anastomosis.iss) reads to detect whether WebView2 is present
# (learn.microsoft.com/microsoft-edge/webview2/concepts/distribution). A vendor
# constant, not PHI.
f3017226-fe2a-4295-8bdf-00c3a9a7e4c5
# Windows installer product identity (packaging/anastomosis.iss AppId) — a
# generated application GUID, not a record identifier; stable for the life
# of the product so upgrades find the existing install.
eec2f7c9-06ad-4bc2-91d4-84bbae937b98

# --- Approved opaque content, by FILE hash (default-deny for everything else) -
# The scanner cannot read binary/media content, nor a base64-armored payload
# inside a text file (a `data:...;base64,...` run: the token splitter shreds it
# and every pattern sails through). Both need the file's hash here WITH
# provenance; unlisted, either one fails the scan. The digest covers the whole
# file, so an approval expires the moment the file changes.
# Regenerate a hash after an intentional change: sha256sum <file>.

# assets/icon/icon.ico — generated from the in-repo assets/icon/icon.svg
# master (itself generated by tools/make_vessel.py, seeded and deterministic)
# via tools/make_icons.py (project asset, AGPL-3.0-or-later).
sha256:596f0743597054445805575282f29f5d9bda429d2897fa021aaf47136d0cbfab
# assets/installer/wizard-125.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:9d4c2b43ab0c0f00d856bf4e34ce754aa8d7e687900d5cf27fef449500a920f0
# assets/installer/wizard-150.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:7d223b09ed1082bd9aedadbabd0ae82634afbf8192992458a1951fca97edbbfc
# assets/installer/wizard-175.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:46e016204e22b42991e539ec966533404cbae612675006b428b06f6631c6fb3d
# assets/installer/wizard-200.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:042e20a77d91420dbae2f494271d9781ad9cd2fe000085ec6ee0f8b19668c661
# assets/installer/wizard-small-125.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:ae909d8082645e9d832acae27b368c67da3546aafd7ee32b11ca0ebb51ee2a6a
# assets/installer/wizard-small-150.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:f011f1d76d911ba6cb884a086cad76803c5613e0dd3ad2f7e42783d2b5c55065
# assets/installer/wizard-small-175.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:361e9075c6000788a6e1c46b119bed726ddc66c49b8658fc9b13ffbc96330927
# assets/installer/wizard-small-200.bmp — the DPI rendition Inno Setup draws at that scale,
# generated from assets/icon/icon.svg via tools/make_icons.py
# (project asset, AGPL-3.0-or-later).
sha256:22104a75f59047ec5aaf32982840891ae6b4bdb319451019543518bbb75074a5
# assets/installer/wizard-small.bmp — generated from assets/icon/icon.svg via
# tools/make_icons.py (project asset, AGPL-3.0-or-later).
sha256:d124b6d56bbfd7608bfe3a8abf8574b9b62db8ab78e189afee3b84db7e2bda5d
# assets/installer/wizard.bmp — generated from assets/icon/icon.svg via
# tools/make_icons.py (project asset, AGPL-3.0-or-later).
sha256:4e7d9edd619f9cd9f739177dd69544eb17ec292977737572de3fb7468a13c178
# packaging/msix-assets/*.png — the three logo renditions the Microsoft Store
# package manifest names (Square150x150Logo, Square44x44Logo, StoreLogo),
# generated from the SAME assets/icon/icon.svg master as the .ico above, by
# the same tools/make_icons.py, and committed because the Windows packaging
# job has neither of that script's dev-only renderers (project assets,
# AGPL-3.0-or-later).
sha256:ff30b4ad6324f29f4c492ab6e2b0896f1e70e78ba6c807365eae60244f411e0d
sha256:d0a60ff7ea136e87c76e5a3dda57542cc02ce15275652aa8e86f181c808015e3
sha256:da0317a6423b423382e23f421e2da29ed912ec3d7587949f7912a0b1b685a1c4
# src/anastomosis/gui/web/fonts/FrauncesVF.woff2 — Fraunces variable font
# (The Fraunces Project Authors, SIL OFL-1.1, no Reserved Font Name;
# github.com/undercasetype/Fraunces, fetched via github.com/google/fonts and
# repackaged TTF->WOFF2 with fontTools — format conversion only).
sha256:670cd935300bef81a5e635aabbbd044d99c17a6231086f2713c7abe77666862b
# src/anastomosis/gui/web/fonts/JetBrainsMonoVF.woff2 — JetBrains Mono
# variable font (JetBrains, SIL OFL-1.1; github.com/JetBrains/JetBrainsMono).
sha256:31ec365b93e4bad6f202ce23352a56d01ca4462b2afc782ed2cf6fa42ca9ac0e
# src/anastomosis/gui/web/fonts/MonaSansVF.woff2 — Mona Sans variable font
# (GitHub, SIL OFL-1.1; github.com/github/mona-sans).
sha256:2affc0f41c81325062c297e46762ebd28effa15a64e56e936403981f3dbd7e7d
# src/anastomosis/reconstruct/ccda_standard/vendor/CDA.xsl — HL7's official
# C-CDA stylesheet, vendored UNMODIFIED at tag v4.1.0-beta.2
# (github.com/HL7/cda-core-xsl, Apache-2.0) and pinned by the same digest in
# vendor/PINNED.md, which documents the verifiable re-vendor command. The two
# base64 runs it carries (lines ~2540 and ~6263) are the stylesheet's OWN
# `data:image/png` toolbar icons, not repository content.
sha256:f1c32f11186cf69d64f874cc4c94eb51ca8f696b54b4b6833fb54c6afdd7acc1
# tests/fixtures/pf_tebra_v9/binary-content/feedface-d0c0-0000-0000-000000000001.pdf
# — a 2-page synthetic PDF generated by tools/make_fixture_attachment.py, the
# attachment the fixture's one patient-documents row points at. The script pins
# the PDF's timestamps, so re-running it reproduces this digest exactly and the
# entry stays checkable. Its text is two lines of fixture prose ("Cardiology
# referral letter (synthetic fixture)"), no patient data of any kind, and the
# filename is the row's DocumentStorageGuid from the feedface- synthetic range.
# Exists so CI exercises the blob resolution, which nothing could reach while
# the fixture had tables but no files.
sha256:ce9884f02253419ca57d122a4d1395db61e8dd3845b7d67e721cab5aa589177c
# The Microsoft Store listing's Package/Identity/Publisher CN, issued by
# Partner Center and embedded in every published package manifest — a public
# platform identity, not a person's identifier.
3768f7cb-832a-4a03-bd9a-56171527d9d4

# tools/snapshot.py's committed baseline (tools/snapshot_baseline.json) names
# every captured file by its own relative path, and the ccda-source patient
# (core.ccda_codes.identity_from_ii, #404) and encounter (#393) identity
# recipes are uuid5 over a document-stated (root, extension) pair — a
# deterministic hash of synthetic input, same reasoning as the pair above,
# whose OUTPUT does not carry the feedface-/00000000- prefix even though
# every input does. Patient ids for tests/fixtures/ccda/feedface_ccd.xml and
# tests/fixtures/synthea/synthea_ccda_sample.xml, and two of the former's
# encounter ids, all appearing as directory/file names in the baseline.
9a84356f-bca7-5c4a-800c-f68b1021da82
0bf2c9d0-bfdd-5286-89fb-6bc06eff4f35
555c7156-31ec-5fdc-a9f7-5bbd15c3b054
f86ca1d7-90a7-5481-b280-3b17b44272f7

# tests/unit/test_snapshot_tool.py's example of a NON-fixture id: the test
# proves the UUID-canonicalization rewrite fires on a GUID that does NOT
# carry the fixture prefix (a rewrite that must NOT fire on one that does),
# so the example is deliberately a plain made-up value, never a real one.
3201335a-22c6-4bc7-a916-d47c4ccdb4c4
