SCRUB-WP add Zorgfilter v1 policy and corpus foundation

Record the approved care-profile policy, synthetic corpus, baseline helpers, test contracts, roadmap sequence, decision and risk boundaries.

CARE_PROFILE_V1_PLAN.md

@@ -0,0 +1,189 @@
+# Zorgfilter v1 — policy, corpus and implementation plan
+
+Status: approved direction; foundation implementation in progress  
+Repository: `solidprivacy-nl/scrub`  
+Approved: 2026-08-03 Europe/Amsterdam
+
+## 1. Product objective
+
+Add an explicit Dutch care profile alongside the existing general Dutch, legal and international profiles.
+
+The care profile removes or flags patient-, client-, relative-, provider- and care-trajectory identifiers while preserving clinical meaning.
+
+Core rule:
+
+```text
+Replace identity and patient-specific administrative references.
+Review contextual provider, location and event identifiers.
+Preserve diagnosis, medication, dosage, laboratory values, observations and care meaning.
+Warn about rare-case re-identification without blindly masking clinical content.
+```
+
+The profile is not a generic medical-term filter and must not make a document clinically unreadable.
+
+## 2. Approved policy
+
+### Replace by default
+
+- patient/client names and names of relatives, representatives or informal carers;
+- BSN and date of birth;
+- address, postcode, e-mail and telephone number;
+- patient number, care client number, EPD/ECD number and medical-record number;
+- personal health-insurance number;
+- patient-specific referral, treatment, laboratory-sample, care-incident and indication references.
+
+### Review and select by default
+
+- care-provider names;
+- BIG numbers and AGB codes;
+- care organizations, departments, teams and locations;
+- room or bed references;
+- exact admission, discharge, appointment, treatment and report dates other than date of birth.
+
+These values are visible in review and selected by default, but the user can preserve them when professional context requires it.
+
+### Preserve by default
+
+- diagnosis and symptoms;
+- medication names, dosage and administration schedules;
+- laboratory results, units and reference values;
+- observations, vital signs, allergies and functional status;
+- treatment, procedure, care goals and clinical recommendations;
+- generic clinical and professional role words;
+- clinical classifications and codes unless evidence proves that a code is patient-specific.
+
+### Audit only
+
+Rare combinations of diagnosis, location, date, age or unusual case detail may still be indirectly identifying. Version 1 records this as residual-risk evidence and an audit warning. It does not blindly remove clinical content.
+
+## 3. First supported document families
+
+1. daily nursing or care report;
+2. care plan and evaluation;
+3. nursing transfer;
+4. medical specialist discharge letter;
+5. GP referral or consultation letter;
+6. medication overview or administration list;
+7. laboratory report;
+8. MIC/MIM/VIM care-incident report.
+
+Later extensions may cover mental-health progress notes, district-nursing intake, rehabilitation, CIZ/Wlz/Wmo documentation, multidisciplinary consultation, wound care, maternity care and youth care.
+
+## 4. Architecture direction
+
+Keep care-specific behavior in separate pure modules before UI integration:
+
+```text
+care_profile_policy.py
+care_test_examples.py
+care_profile_baseline.py
+care_reference_taxonomy.py             # later recognizer package
+dutch_care_recognizers.py              # later recognizer package
+recognition_profiles.py                 # later central profile configuration
+```
+
+Do not continue expanding the legal taxonomy with all care behavior. The existing broad `NL_HEALTHCARE_REFERENCE` category must be assessed and split because it currently combines values with different privacy policies, including patient numbers and DBC-like codes.
+
+## 5. Current Streamlit interface target
+
+After the policy, corpus, baseline and recognizer packages pass, the current profile selector becomes:
+
+```text
+Zorgcontrole — streng
+Juridische controle — streng
+Algemene Nederlandse controle
+Algemene internationale controle
+```
+
+Care-profile behavior:
+
+```text
+threshold: evidence-based, initial candidate 0.30
+entities: general Dutch + care-specific
+legal-only entities: not enabled by default
+care candidate scan: enabled
+synthetic care examples: available
+profile explanation: visible
+```
+
+No export, Scrub Key or reinsert semantics change merely because a care profile is added.
+
+## 6. Final desktop interface target
+
+The future document workspace shows a compact, explicit profile choice:
+
+```text
+[ Algemeen NL ] [ Zorg ] [ Juridisch ] [ Internationaal ]
+```
+
+After a document opens, the toolbar shows `Profiel: Zorg` with a small change action. The full explanation and advanced entity selection remain under Options. Profile switching must never happen silently.
+
+## 7. Test strategy
+
+### Corpus contracts
+
+Each fully synthetic document must define:
+
+- exact values expected to be replaced;
+- exact values expected to be shown for review;
+- exact clinical values and phrases expected to be preserved;
+- ambiguity traps and negative examples;
+- sector and document type metadata.
+
+### Current-engine baseline
+
+Run the existing recognizer layer against the care corpus before adding care recognizers. Record:
+
+- detected and missed expected values;
+- wrong entity classification;
+- partial-span matches;
+- clinical over-masking;
+- role-word over-masking.
+
+The baseline is evidence, not a production gate.
+
+### Recognizer validation
+
+Measure at least:
+
+- recall by care entity;
+- precision by care entity;
+- exact-span accuracy;
+- false positives and false negatives;
+- preserved clinical phrases;
+- profile isolation across all four profiles.
+
+### End-to-end validation
+
+For TXT and DOCX:
+
+```text
+import -> detect -> review -> replace -> Scrub Key -> reinsert -> audit
+```
+
+Verify document binding, context preservation, header/footer behavior and fail-closed wrong-key handling.
+
+## 8. Sequential workpackages
+
+1. `SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION`
+2. `SCRUB-WP_CARE_PROFILE_CURRENT_ENGINE_BASELINE`
+3. `SCRUB-WP_CARE_PROFILE_GAP_TRIAGE`
+4. `SCRUB-WP_CARE_PROFILE_RECOGNIZER_CONTRACT_TESTS`
+5. `SCRUB-WP_CARE_PROFILE_RECOGNIZER_IMPLEMENTATION`
+6. `SCRUB-WP_RECOGNITION_PROFILE_CONFIGURATION_REFACTOR`
+7. `SCRUB-WP_CARE_PROFILE_CURRENT_UI_INTEGRATION`
+8. `SCRUB-WP_CARE_PROFILE_CROSS_PROFILE_REGRESSION_MATRIX`
+9. `SCRUB-WP_CARE_PROFILE_APP_VERIFY`
+10. `SCRUB-WP_CARE_PROFILE_DESKTOP_UX_CONTRACT`
+
+UI integration remains sequential and must not run in parallel with other edits to `presidio_streamlit.py` or the same review/export flow.
+
+## 9. Safety and claim boundaries
+
+- synthetic data only;
+- human review remains required;
+- no claim that all medical or care identifiers are always found;
+- no automatic cloud document processing;
+- no blind masking of clinical meaning;
+- no production-readiness claim from corpus or benchmark results;
+- no weakening of Scrub Key, export, audit or review controls.

CHANGELOG.md

@@ -1,3 +1,39 @@
+## 2026-08-03 15:31 Europe/Amsterdam — SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION
+
+Status: completed; policy/corpus foundation implemented and validated.
+
+Purpose:
+- Create the evidence base for an explicit Dutch Zorg profile without prematurely changing recognizers or the UI.
+
+Files added:
+- `CARE_PROFILE_V1_PLAN.md`
+- `care_profile_policy.py`
+- `care_test_examples.py`
+- `care_profile_baseline.py`
+- `scripts/generate_care_profile_baseline.py`
+- `tests/test_care_profile_policy_contract.py`
+- `tests/test_care_profile_corpus_contracts.py`
+- `tests/test_care_profile_current_engine_baseline.py`
+- `workpackage_claims/scrub_wp_care_profile_v1_policy_and_corpus_foundation.md`
+
+Main changes:
+- froze replace/review/preserve/audit-only care policy actions;
+- added eight fully synthetic document families;
+- separated patient identifiers from provider/location review and clinical content preservation;
+- added a deterministic baseline helper for current Dutch custom recognizers;
+- made no recognizer or product-UI behavior change.
+
+Validation:
+- full GitHub Actions run #1818 passed: 918 tests;
+- Hugging Face sync not functionally relevant because no runtime/UI file changed;
+- app verification not applicable.
+
+Intentionally not changed:
+- current three profile choices;
+- recognizer registration or thresholds;
+- review table, export, Scrub Key and reinsert semantics;
+- runtime, dependencies or cloud processing.
+
 ## 2026-08-03 14:47 Europe/Amsterdam — SCRUB-WP_AI_FIRST_DESKTOP_PACKAGING_ROADMAP_ALIGNMENT
 
 Status: completed; roadmap/decision documentation only.

DECISION_LOG.md

@@ -1,3 +1,34 @@
+## 2026-08-03 — D039 — Add Zorgfilter v1 with clinical-context preservation
+
+Status: accepted product and implementation-sequence decision
+
+Decision:
+
+```text
+Add an explicit Dutch Zorg profile. Replace date of birth and patient/client identity by default. Show other exact care dates, provider identity, BIG/AGB, organizations and locations for review and select them by default. Preserve diagnosis, medication, dosage, laboratory results and observations. Surface rare-case indirect re-identification as residual-risk evidence rather than blindly masking clinical meaning.
+```
+
+Implementation sequence:
+- policy and fully synthetic corpus first;
+- current-engine baseline and gap triage second;
+- recognizer contracts and pure recognizer implementation before UI;
+- central profile configuration before adding the fourth Streamlit profile;
+- cross-profile regression and live app verification before closeout.
+
+Reason:
+- Care documents contain both direct identifiers and essential clinical meaning.
+- A broad medical-word filter would destroy usability and potentially clinical/legal context.
+- The current `NL_HEALTHCARE_REFERENCE` category combines values with different privacy policies and must be split through evidence-driven work.
+- A fourth UI label without dedicated detection evidence would be cosmetic and unsafe.
+
+Boundaries:
+- synthetic data only;
+- human review remains required;
+- no production-readiness claim from corpus or benchmark results;
+- no silent profile switching;
+- no cloud document processing;
+- no export, Scrub Key or reinsert semantic change in the foundation package.
+
 ## 2026-08-03 — D038 — Use AI-first execution with human-controlled signing, security and release gates for Phase 9 desktop packaging
 
 Status: accepted roadmap and execution-model decision; implementation remains gated

RISK_REGISTER.md

@@ -181,6 +181,41 @@ Current mitigations include diagnostic benchmark work, preservation guidance, PE
 
 ---
 
+## R10 — Care-profile under-detection and clinical over-masking
+
+Status: mitigating  
+Impact: critical
+
+Risk:
+
+```text
+A care document retains patient or trajectory identifiers, or Scrub removes diagnosis, medication, laboratory values, observations or care context and makes the document misleading or unusable.
+```
+
+Mitigation direction:
+
+- explicit Zorgfilter v1 policy contract;
+- fully synthetic corpus across eight care-document families;
+- exact replace, review and preserve expectations;
+- current-engine baseline before recognizer changes;
+- separate care taxonomy and recognizers;
+- negative tests for medical numbers, dosages, times, vital signs and laboratory values;
+- cross-profile regression before UI promotion;
+- human review and residual-risk evidence remain mandatory.
+
+Approved policy boundary:
+
+```text
+Patient identity and date of birth: replace.
+Other exact care dates and provider identity: review, selected by default.
+Clinical meaning: preserve.
+Rare-case indirect identification: audit warning, not blind masking.
+```
+
+The current broad `NL_HEALTHCARE_REFERENCE` category is insufficient because it combines patient numbers, referral references, insurance identifiers and DBC/clinical codes under one behavior.
+
+---
+
 ## Product-claim boundary
 
 Disallowed claims:

ROADMAP.md

@@ -11,7 +11,7 @@ Use it together with:
 - `DECISION_LOG.md` for accepted strategic and architecture decisions;
 - `PROJECT_PROMPT.md` for worker rules and project governance.
 
-Last roadmap strategy update: 2026-08-03 — Phase 9 local desktop packaging remains gated, with an AI-first implementation model and explicit human signing, release, security-claim and UX-acceptance gates.
+Last roadmap strategy update: 2026-08-03 — Zorgfilter v1 is approved as an evidence-driven profile line; policy and synthetic corpus work may proceed while recognizer and UI integration remain sequential and test-gated.
 
 ---
 
@@ -411,3 +411,99 @@ When the phase is explicitly opened, use small sequential workpackages:
 ```
 
 Do not collapse signing, release and security acceptance into the same autonomous worker. Do not make a production/local-only claim from successful packaging alone.
+
+## 11. Zorgfilter v1 — evidence-driven care profile
+
+Approved: 2026-08-03 15:31 Europe/Amsterdam
+
+The first product wedge already identifies Legal and Zorg as the most relevant Dutch professional domains. Zorg now receives an explicit profile line rather than remaining an incidental subset of general and legal recognition.
+
+### Approved policy
+
+```text
+Geboortedatum: vervangen
+Overige exacte zorgdata: controleren en standaard geselecteerd
+Patiënt- en cliëntidentificatie: vervangen
+Zorgverleneridentificatie: controleren en standaard geselecteerd
+Diagnose, medicatie, dosering, labwaarden en observaties: behouden
+Zeldzame-casus-herleidbaarheid: auditwaarschuwing, niet blind maskeren
+```
+
+The core product rule is:
+
+```text
+Remove identity and patient-specific administrative references while preserving clinical meaning.
+```
+
+Zorgfilter v1 is not a generic medical-word filter. It must not make care records clinically unreadable.
+
+### Initial document scope
+
+- daily nursing/care reports;
+- care plans and evaluations;
+- nursing transfers;
+- medical specialist discharge letters;
+- GP referrals and consultation letters;
+- medication overviews or administration lists;
+- laboratory reports;
+- MIC/MIM/VIM care-incident reports.
+
+### Architecture and sequencing
+
+The first packages are pure helper, policy, corpus and evidence work. They may proceed without reopening the shared Streamlit review/export flow. The future current-UI integration is permitted by explicit coordinator approval, but only after the corpus baseline, gap triage, recognizer contracts and recognizer implementation are green and no parallel worker is editing the same UI surface.
+
+Preferred helper direction:
+
+```text
+care_profile_policy.py
+care_test_examples.py
+care_profile_baseline.py
+care_reference_taxonomy.py
+dutch_care_recognizers.py
+recognition_profiles.py
+```
+
+The existing broad `NL_HEALTHCARE_REFERENCE` category must be assessed and split. Patient numbers, referral references, insurance identifiers and DBC/clinical codes do not share one safe default action.
+
+### Current and final interface direction
+
+Current prototype after test-gated integration:
+
+```text
+Zorgcontrole — streng
+Juridische controle — streng
+Algemene Nederlandse controle
+Algemene internationale controle
+```
+
+Final desktop workspace:
+
+```text
+[ Algemeen NL ] [ Zorg ] [ Juridisch ] [ Internationaal ]
+```
+
+The active profile remains visible in the document toolbar and never changes silently.
+
+### Sequential workpackages
+
+```text
+1. SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION
+2. SCRUB-WP_CARE_PROFILE_CURRENT_ENGINE_BASELINE
+3. SCRUB-WP_CARE_PROFILE_GAP_TRIAGE
+4. SCRUB-WP_CARE_PROFILE_RECOGNIZER_CONTRACT_TESTS
+5. SCRUB-WP_CARE_PROFILE_RECOGNIZER_IMPLEMENTATION
+6. SCRUB-WP_RECOGNITION_PROFILE_CONFIGURATION_REFACTOR
+7. SCRUB-WP_CARE_PROFILE_CURRENT_UI_INTEGRATION
+8. SCRUB-WP_CARE_PROFILE_CROSS_PROFILE_REGRESSION_MATRIX
+9. SCRUB-WP_CARE_PROFILE_APP_VERIFY
+10. SCRUB-WP_CARE_PROFILE_DESKTOP_UX_CONTRACT
+```
+
+Safety boundaries:
+
+- synthetic data only;
+- no blind masking of clinical meaning;
+- no change to Scrub Key, export or reinsert semantics without a separate package;
+- human review remains required;
+- corpus or benchmark success does not prove production readiness;
+- no cloud document processing is introduced.

WORKPACKAGES.md

@@ -1,3 +1,41 @@
+## 2026-08-03 15:31 Europe/Amsterdam — SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION
+
+Status: completed; policy/corpus foundation implemented and validated.
+
+Goal:
+- Establish the approved Zorgfilter v1 policy and a fully synthetic, machine-readable care-document corpus before adding recognizers or UI.
+
+Current package scope:
+- roadmap, decision and risk alignment;
+- pure care-profile action contract;
+- eight synthetic care-document families;
+- corpus contract tests;
+- current custom-recognizer baseline helper and report generator.
+
+Approved policy:
+- date of birth and patient/client identity: replace;
+- other exact care dates and provider identity: review, selected by default;
+- diagnosis, medication, dosage, lab results and observations: preserve;
+- rare-case re-identification: audit warning only.
+
+Active next package:
+1. `SCRUB-WP_CARE_PROFILE_CURRENT_ENGINE_BASELINE`
+2. `SCRUB-WP_CARE_PROFILE_GAP_TRIAGE`
+3. `SCRUB-WP_CARE_PROFILE_RECOGNIZER_CONTRACT_TESTS`
+4. `SCRUB-WP_CARE_PROFILE_RECOGNIZER_IMPLEMENTATION`
+5. `SCRUB-WP_RECOGNITION_PROFILE_CONFIGURATION_REFACTOR`
+6. `SCRUB-WP_CARE_PROFILE_CURRENT_UI_INTEGRATION`
+7. `SCRUB-WP_CARE_PROFILE_CROSS_PROFILE_REGRESSION_MATRIX`
+8. `SCRUB-WP_CARE_PROFILE_APP_VERIFY`
+9. `SCRUB-WP_CARE_PROFILE_DESKTOP_UX_CONTRACT`
+
+Boundaries:
+- no Streamlit change in this package;
+- no recognizer behavior change yet;
+- no export, Scrub Key, reinsert, cloud or dependency change;
+- synthetic data only;
+- current Phase 6 binding verification remains an independent active gate.
+
 ## 2026-08-03 14:47 Europe/Amsterdam — SCRUB-WP_AI_FIRST_DESKTOP_PACKAGING_ROADMAP_ALIGNMENT
 
 Status: completed; documentation/strategy alignment only.

care_profile_baseline.py

@@ -0,0 +1,162 @@
+"""Current deterministic recognizer baseline for the synthetic care corpus.
+
+This baseline intentionally uses the recognizers that exist before the dedicated
+Zorgfilter recognizer package. It records evidence and never claims production
+readiness. Generic NER-model results are outside this pure baseline.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import Any, Dict, Iterable, List, Sequence
+
+from care_test_examples import TEST_CASES
+
+
+def _normalize(value: str) -> str:
+    return re.sub(r"[^a-z0-9]+", "", str(value or "").lower())
+
+
+def _result_row(text: str, result: Any, recognizer_name: str) -> Dict[str, Any]:
+    start = getattr(result, "start", None)
+    end = getattr(result, "end", None)
+    detected_text = ""
+    if isinstance(start, int) and isinstance(end, int) and 0 <= start < end <= len(text):
+        detected_text = text[start:end]
+    return {
+        "text": detected_text,
+        "entity_type": str(getattr(result, "entity_type", "") or ""),
+        "start": start,
+        "end": end,
+        "score": float(getattr(result, "score", 0.0) or 0.0),
+        "recognizer": recognizer_name,
+    }
+
+
+def detect_with_current_custom_recognizers(text: str) -> List[Dict[str, Any]]:
+    """Run the current Dutch custom recognizers without a generic NER model."""
+
+    from dutch_recognizers import get_dutch_entity_names, get_dutch_recognizers
+
+    entities = get_dutch_entity_names(include_legal=True)
+    rows: List[Dict[str, Any]] = []
+    for recognizer in get_dutch_recognizers(supported_language="en"):
+        results = recognizer.analyze(text, entities=entities, nlp_artifacts=None)
+        rows.extend(_result_row(text, result, recognizer.name) for result in results)
+    rows.sort(key=lambda row: (row.get("start", -1), row.get("end", -1), row.get("entity_type", "")))
+    return rows
+
+
+def _matching_rows(value: str, rows: Sequence[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    needle = _normalize(value)
+    if not needle:
+        return []
+    return [row for row in rows if needle in _normalize(row.get("text", ""))]
+
+
+def _phrase_spans(text: str, phrase: str) -> List[tuple[int, int]]:
+    spans: List[tuple[int, int]] = []
+    start = 0
+    while True:
+        index = text.find(phrase, start)
+        if index < 0:
+            return spans
+        spans.append((index, index + len(phrase)))
+        start = index + max(1, len(phrase))
+
+
+def _spans_overlap(first: tuple[int, int], second: tuple[int, int]) -> bool:
+    return first[0] < second[1] and second[0] < first[1]
+
+
+def _preserve_overlaps(
+    text: str,
+    preserve_phrases: Iterable[str],
+    rows: Sequence[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    overlaps: List[Dict[str, Any]] = []
+    detected_spans = [
+        (int(row["start"]), int(row["end"]), row)
+        for row in rows
+        if isinstance(row.get("start"), int) and isinstance(row.get("end"), int)
+    ]
+    for phrase in preserve_phrases:
+        for phrase_span in _phrase_spans(text, phrase):
+            for start, end, row in detected_spans:
+                if _spans_overlap(phrase_span, (start, end)):
+                    overlaps.append(
+                        {
+                            "preserve_phrase": phrase,
+                            "detected_text": row.get("text", ""),
+                            "entity_type": row.get("entity_type", ""),
+                            "recognizer": row.get("recognizer", ""),
+                        }
+                    )
+    return overlaps
+
+
+def build_current_care_baseline(
+    cases: Sequence[Dict[str, Any]] = TEST_CASES,
+) -> Dict[str, Any]:
+    """Build a deterministic evidence report for the pre-Zorgfilter recognizers."""
+
+    case_reports: List[Dict[str, Any]] = []
+    total_expected = 0
+    total_found = 0
+    total_preserve_overlaps = 0
+
+    for case in cases:
+        text = str(case["text"])
+        rows = detect_with_current_custom_recognizers(text)
+        expectations: List[Dict[str, Any]] = []
+        for policy_bucket in ("replace", "review_selected"):
+            for item in case.get(policy_bucket, []):
+                value = str(item["value"])
+                matches = _matching_rows(value, rows)
+                total_expected += 1
+                if matches:
+                    total_found += 1
+                expectations.append(
+                    {
+                        "value": value,
+                        "expected_entity_type": str(item["entity_type"]),
+                        "policy_bucket": policy_bucket,
+                        "found": bool(matches),
+                        "detected_entity_types": sorted(
+                            {str(row.get("entity_type", "")) for row in matches}
+                        ),
+                        "detected_spans": [str(row.get("text", "")) for row in matches],
+                    }
+                )
+
+        preserve_overlaps = _preserve_overlaps(text, case.get("preserve", []), rows)
+        total_preserve_overlaps += len(preserve_overlaps)
+        case_reports.append(
+            {
+                "id": case["id"],
+                "name": case["name"],
+                "sector": case["sector"],
+                "document_type": case["document_type"],
+                "expected_value_count": len(expectations),
+                "found_value_count": sum(1 for item in expectations if item["found"]),
+                "expectations": expectations,
+                "preserve_overlaps": preserve_overlaps,
+                "detected_rows": rows,
+            }
+        )
+
+    recall = (total_found / total_expected) if total_expected else 0.0
+    return {
+        "schema_version": "1.0",
+        "profile": "current_custom_recognizers_before_care_profile",
+        "scope": "deterministic Dutch custom recognizers only; generic NER excluded",
+        "synthetic_data_only": True,
+        "production_ready": False,
+        "human_review_required": True,
+        "case_count": len(case_reports),
+        "expected_value_count": total_expected,
+        "found_value_count": total_found,
+        "indicative_recall": round(recall, 6),
+        "preserve_overlap_count": total_preserve_overlaps,
+        "cases": case_reports,
+    }

care_profile_policy.py

@@ -0,0 +1,348 @@
+"""Pure policy contract for the first Dutch care recognition profile.
+
+This module contains no Streamlit, Presidio, network, file-system or cloud logic.
+It records what the future care profile should replace, review, preserve or only
+surface as residual-risk evidence.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Dict, Iterable, Mapping, Sequence
+
+
+ACTION_REPLACE = "replace"
+ACTION_REVIEW_SELECTED = "review_selected"
+ACTION_PRESERVE = "preserve"
+ACTION_AUDIT_ONLY = "audit_only"
+
+VALID_ACTIONS = {
+    ACTION_REPLACE,
+    ACTION_REVIEW_SELECTED,
+    ACTION_PRESERVE,
+    ACTION_AUDIT_ONLY,
+}
+
+
+@dataclass(frozen=True)
+class CarePolicyRule:
+    entity_type: str
+    action: str
+    label_nl: str
+    reason_nl: str
+    examples: tuple[str, ...]
+
+
+CARE_POLICY_RULES: tuple[CarePolicyRule, ...] = (
+    CarePolicyRule(
+        "PERSON",
+        ACTION_REPLACE,
+        "Naam van patiënt, cliënt of naaste",
+        "Directe persoonsidentificatie wordt standaard vervangen.",
+        ("Ahmed El Mansouri", "mantelzorger Fatima El Mansouri"),
+    ),
+    CarePolicyRule(
+        "NL_BSN",
+        ACTION_REPLACE,
+        "BSN",
+        "Het BSN is een direct identificerend persoonsnummer.",
+        ("123456782",),
+    ),
+    CarePolicyRule(
+        "NL_DATE_OF_BIRTH",
+        ACTION_REPLACE,
+        "Geboortedatum",
+        "De geboortedatum is in zorgdocumenten sterk herleidbaar.",
+        ("14-02-1948",),
+    ),
+    CarePolicyRule(
+        "NL_ADDRESS",
+        ACTION_REPLACE,
+        "Adres",
+        "Een volledig woon- of verblijfadres identificeert de betrokkene.",
+        ("Zorglaan 18, 3511 AB Utrecht",),
+    ),
+    CarePolicyRule(
+        "NL_POSTCODE",
+        ACTION_REPLACE,
+        "Postcode",
+        "Een postcode kan samen met andere gegevens herleidbaar zijn.",
+        ("3511 AB",),
+    ),
+    CarePolicyRule(
+        "EMAIL_ADDRESS",
+        ACTION_REPLACE,
+        "E-mailadres",
+        "Een persoonlijk e-mailadres identificeert de betrokkene direct.",
+        ("ahmed@example.invalid",),
+    ),
+    CarePolicyRule(
+        "PHONE_NUMBER",
+        ACTION_REPLACE,
+        "Telefoonnummer",
+        "Een persoonlijk telefoonnummer identificeert de betrokkene direct.",
+        ("06 12345678",),
+    ),
+    CarePolicyRule(
+        "NL_PHONE_NUMBER",
+        ACTION_REPLACE,
+        "Nederlands telefoonnummer",
+        "Een persoonlijk telefoonnummer identificeert de betrokkene direct.",
+        ("030 2345678",),
+    ),
+    CarePolicyRule(
+        "NL_PATIENT_NUMBER",
+        ACTION_REPLACE,
+        "Patiëntnummer",
+        "Een patiëntnummer koppelt tekst aan een specifieke patiëntregistratie.",
+        ("PAT-2026-1148",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_CLIENT_NUMBER",
+        ACTION_REPLACE,
+        "Zorgcliëntnummer",
+        "Een cliëntnummer koppelt tekst aan een specifieke zorgcliënt.",
+        ("CL-ZORG-7712",),
+    ),
+    CarePolicyRule(
+        "NL_MEDICAL_RECORD_NUMBER",
+        ACTION_REPLACE,
+        "Medisch dossiernummer",
+        "Een medisch dossiernummer verwijst naar een individueel dossier.",
+        ("MD-2026-4412",),
+    ),
+    CarePolicyRule(
+        "NL_EPD_ECD_NUMBER",
+        ACTION_REPLACE,
+        "EPD- of ECD-nummer",
+        "Een EPD/ECD-nummer koppelt het document aan een individuele registratie.",
+        ("ECD-889144", "EPD-2026-5501"),
+    ),
+    CarePolicyRule(
+        "NL_HEALTH_INSURANCE_NUMBER",
+        ACTION_REPLACE,
+        "Verzekerdennummer",
+        "Een persoonsgebonden verzekerdennummer is administratieve identificatie.",
+        ("VERZ-88441122",),
+    ),
+    CarePolicyRule(
+        "NL_REFERRAL_NUMBER",
+        ACTION_REPLACE,
+        "Verwijsnummer",
+        "Een patiëntspecifieke verwijzing kan het zorgtraject identificeren.",
+        ("VERW-2026-7711",),
+    ),
+    CarePolicyRule(
+        "NL_TREATMENT_REFERENCE",
+        ACTION_REPLACE,
+        "Behandel- of zorgtrajectnummer",
+        "Een patiëntspecifieke behandelreferentie koppelt tekst aan een traject.",
+        ("BEH-2026-1188",),
+    ),
+    CarePolicyRule(
+        "NL_LAB_SAMPLE_NUMBER",
+        ACTION_REPLACE,
+        "Laboratorium- of monsternummer",
+        "Een laboratoriumreferentie kan rechtstreeks naar de patiëntorder leiden.",
+        ("LAB-2026-4412",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_INCIDENT_NUMBER",
+        ACTION_REPLACE,
+        "Zorgincidentnummer",
+        "Een MIC/MIM/VIM- of incidentnummer koppelt tekst aan een specifieke melding.",
+        ("MIC-2026-0912",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_INDICATION_REFERENCE",
+        ACTION_REPLACE,
+        "Indicatie- of beschikkingreferentie",
+        "Een CIZ, Wlz, Wmo of zorgtoewijzingsreferentie kan de cliënt identificeren.",
+        ("CIZ-2026-5512",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_PROVIDER_NAME",
+        ACTION_REVIEW_SELECTED,
+        "Naam zorgverlener",
+        "De naam is herleidbaar, maar kan voor professionele context nodig zijn.",
+        ("dr. Karin de Groot", "verpleegkundige Omar El Idrissi"),
+    ),
+    CarePolicyRule(
+        "NL_BIG_NUMBER",
+        ACTION_REVIEW_SELECTED,
+        "BIG-nummer",
+        "Het nummer identificeert een zorgverlener en wordt daarom gecontroleerd.",
+        ("12345678901",),
+    ),
+    CarePolicyRule(
+        "NL_AGB_CODE",
+        ACTION_REVIEW_SELECTED,
+        "AGB-code",
+        "De code identificeert een zorgverlener, vestiging of onderneming.",
+        ("01020304",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_ORGANIZATION",
+        ACTION_REVIEW_SELECTED,
+        "Zorgorganisatie",
+        "Een instelling kan in combinatie met andere details indirect herleidbaar zijn.",
+        ("Stichting Morgenlicht",),
+    ),
+    CarePolicyRule(
+        "NL_CARE_LOCATION_REFERENCE",
+        ACTION_REVIEW_SELECTED,
+        "Zorglocatie, afdeling of team",
+        "Een specifieke locatie kan een kleine patiëntgroep of casus identificeren.",
+        ("locatie Parkzicht", "afdeling Neurologie B"),
+    ),
+    CarePolicyRule(
+        "NL_ROOM_OR_BED_REFERENCE",
+        ACTION_REVIEW_SELECTED,
+        "Kamer- of bednummer",
+        "Een kamer of bed kan samen met datum en locatie indirect identificeren.",
+        ("kamer 214", "bed B-12"),
+    ),
+    CarePolicyRule(
+        "NL_CARE_EVENT_DATE",
+        ACTION_REVIEW_SELECTED,
+        "Exacte zorgdatum",
+        "Exacte opname-, ontslag-, afspraak- of behandeldatums worden gecontroleerd.",
+        ("opgenomen op 12-06-2026",),
+    ),
+    CarePolicyRule(
+        "CARE_DIAGNOSIS",
+        ACTION_PRESERVE,
+        "Diagnose",
+        "Diagnose is klinische betekenis en wordt niet blind gemaskeerd.",
+        ("diabetes mellitus type 2",),
+    ),
+    CarePolicyRule(
+        "CARE_MEDICATION",
+        ACTION_PRESERVE,
+        "Medicatie",
+        "Geneesmiddelnaam is noodzakelijke klinische inhoud.",
+        ("metformine", "paracetamol"),
+    ),
+    CarePolicyRule(
+        "CARE_DOSAGE",
+        ACTION_PRESERVE,
+        "Dosering en toedieningsschema",
+        "Dosering en schema zijn noodzakelijke klinische inhoud.",
+        ("500 mg tweemaal daags",),
+    ),
+    CarePolicyRule(
+        "CARE_LAB_RESULT",
+        ACTION_PRESERVE,
+        "Laboratoriumuitslag",
+        "Uitslag, eenheid en referentiewaarde moeten inhoudelijk intact blijven.",
+        ("Hb 7,8 mmol/L",),
+    ),
+    CarePolicyRule(
+        "CARE_OBSERVATION",
+        ACTION_PRESERVE,
+        "Observatie of voortgang",
+        "Verpleegkundige en medische observaties dragen de inhoud van het document.",
+        ("mobiliseert met rollator",),
+    ),
+    CarePolicyRule(
+        "CARE_VITAL_SIGN",
+        ACTION_PRESERVE,
+        "Vitale parameter",
+        "Bloeddruk, pols, temperatuur en saturatie zijn klinische inhoud.",
+        ("bloeddruk 123/78 mmHg",),
+    ),
+    CarePolicyRule(
+        "CARE_ALLERGY",
+        ACTION_PRESERVE,
+        "Allergie",
+        "Een allergie is essentiële klinische informatie.",
+        ("allergisch voor penicilline",),
+    ),
+    CarePolicyRule(
+        "CARE_TREATMENT",
+        ACTION_PRESERVE,
+        "Behandeling of verrichting",
+        "Behandelinhoud moet leesbaar blijven.",
+        ("wondzorg volgens protocol",),
+    ),
+    CarePolicyRule(
+        "CARE_GOAL",
+        ACTION_PRESERVE,
+        "Zorgdoel",
+        "Zorgdoelen en evaluatiecriteria zijn noodzakelijke professionele context.",
+        ("zelfstandig transfereren binnen zes weken",),
+    ),
+    CarePolicyRule(
+        "CARE_ROLE",
+        ACTION_PRESERVE,
+        "Zorgrol",
+        "Woorden zoals patiënt, arts en verpleegkundige blijven als rol leesbaar.",
+        ("patiënt", "arts", "verpleegkundige"),
+    ),
+    CarePolicyRule(
+        "CARE_CLINICAL_CODE",
+        ACTION_PRESERVE,
+        "Klinische classificatiecode",
+        "Klinische codes worden behouden tenzij bewijs toont dat ze patiëntspecifiek zijn.",
+        ("ICD-10 E11.9",),
+    ),
+    CarePolicyRule(
+        "CARE_RARE_CASE_COMBINATION",
+        ACTION_AUDIT_ONLY,
+        "Zeldzame combinatie van casusdetails",
+        "Indirecte herleidbaarheid wordt als restrisico gemeld zonder klinische inhoud blind te verwijderen.",
+        ("zeldzame diagnose plus kleine locatie en exacte datum",),
+    ),
+)
+
+
+CARE_POLICY_BY_ENTITY: Dict[str, CarePolicyRule] = {
+    rule.entity_type: rule for rule in CARE_POLICY_RULES
+}
+
+
+def policy_for_entity(entity_type: str) -> CarePolicyRule | None:
+    """Return the frozen care-profile rule for an entity type, if defined."""
+
+    return CARE_POLICY_BY_ENTITY.get(str(entity_type or "").strip())
+
+
+def entities_for_action(action: str) -> tuple[str, ...]:
+    """Return entity types assigned to one policy action."""
+
+    if action not in VALID_ACTIONS:
+        raise ValueError(f"Unknown care-profile action: {action}")
+    return tuple(rule.entity_type for rule in CARE_POLICY_RULES if rule.action == action)
+
+
+def validate_care_policy_rules(
+    rules: Sequence[CarePolicyRule] = CARE_POLICY_RULES,
+) -> tuple[str, ...]:
+    """Return deterministic contract errors; an empty tuple means valid."""
+
+    errors: list[str] = []
+    seen: set[str] = set()
+    for index, rule in enumerate(rules):
+        prefix = f"rule[{index}]"
+        if not rule.entity_type.strip():
+            errors.append(f"{prefix}: missing entity_type")
+        elif rule.entity_type in seen:
+            errors.append(f"{prefix}: duplicate entity_type {rule.entity_type}")
+        seen.add(rule.entity_type)
+        if rule.action not in VALID_ACTIONS:
+            errors.append(f"{prefix}: invalid action {rule.action}")
+        if not rule.label_nl.strip():
+            errors.append(f"{prefix}: missing Dutch label")
+        if not rule.reason_nl.strip():
+            errors.append(f"{prefix}: missing reason")
+        if not rule.examples:
+            errors.append(f"{prefix}: missing examples")
+        elif any(not str(value).strip() for value in rule.examples):
+            errors.append(f"{prefix}: contains empty example")
+    return tuple(errors)
+
+
+def policy_snapshot() -> Mapping[str, str]:
+    """Return a stable entity-to-action mapping for reports and tests."""
+
+    return {rule.entity_type: rule.action for rule in CARE_POLICY_RULES}

care_test_examples.py

@@ -0,0 +1,374 @@
+"""Fully synthetic Dutch care-document corpus for Zorgfilter v1.
+
+The corpus contains no real people, organizations, identifiers or care records.
+Every case separates values that should be replaced, values that should be
+reviewed and selected by default, and clinical phrases that must be preserved.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+
+TEST_CASES: List[Dict[str, Any]] = [
+    {
+        "id": "care_daily_nursing_report_v1",
+        "name": "VVT - dagelijkse verpleegkundige rapportage",
+        "sector": "verpleging_verzorging_thuiszorg",
+        "document_type": "dagrapportage",
+        "text": """DAGELIJKSE RAPPORTAGE\n
+Cliënt: Ahmed El Mansouri\n
+Cliëntnummer: CL-ZORG-7712\n
+ECD-nummer: ECD-889144\n
+Geboortedatum: 14-02-1948\n
+Adres: Zorglaan 18, 3511 AB Utrecht\n
+Telefoon contactpersoon: 06 12345678\n
+Contactpersoon: Fatima El Mansouri\n
+Locatie: Stichting Morgenlicht, locatie Parkzicht, kamer 214\n
+Rapportagedatum: 12-06-2026\n
+Rapporteur: verpleegkundige Omar El Idrissi, BIG-nummer 12345678901\n
+
+Cliënt was vanochtend helder en goed aanspreekbaar. Bloeddruk 123/78 mmHg, pols 72 per minuut en temperatuur 36,8 °C. Cliënt mobiliseert met rollator en had pijnscore 6 bij het opstaan. Na rust daalde de pijnscore naar 3. Metformine 500 mg werd volgens schema toegediend. Geen misselijkheid gemeld. Zorgdoel blijft: zelfstandig transfereren binnen zes weken.\n""",
+        "replace": [
+            {"value": "Ahmed El Mansouri", "entity_type": "PERSON"},
+            {"value": "CL-ZORG-7712", "entity_type": "NL_CARE_CLIENT_NUMBER"},
+            {"value": "ECD-889144", "entity_type": "NL_EPD_ECD_NUMBER"},
+            {"value": "14-02-1948", "entity_type": "NL_DATE_OF_BIRTH"},
+            {"value": "Zorglaan 18, 3511 AB Utrecht", "entity_type": "NL_ADDRESS"},
+            {"value": "06 12345678", "entity_type": "NL_PHONE_NUMBER"},
+            {"value": "Fatima El Mansouri", "entity_type": "PERSON"},
+        ],
+        "review_selected": [
+            {"value": "Stichting Morgenlicht", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "locatie Parkzicht", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+            {"value": "kamer 214", "entity_type": "NL_ROOM_OR_BED_REFERENCE"},
+            {"value": "12-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Omar El Idrissi", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "12345678901", "entity_type": "NL_BIG_NUMBER"},
+        ],
+        "preserve": [
+            "verpleegkundige",
+            "Bloeddruk 123/78 mmHg",
+            "pols 72 per minuut",
+            "temperatuur 36,8 °C",
+            "mobiliseert met rollator",
+            "pijnscore 6",
+            "Metformine 500 mg",
+            "zelfstandig transfereren binnen zes weken",
+        ],
+        "audit_only": [],
+        "ambiguity_traps": ["123/78", "72", "36,8", "500 mg", "pijnscore 6"],
+    },
+    {
+        "id": "care_plan_evaluation_v1",
+        "name": "Gehandicaptenzorg - zorgplan en evaluatie",
+        "sector": "gehandicaptenzorg",
+        "document_type": "zorgplan_evaluatie",
+        "text": """ZORGPLAN EN EVALUATIE\n
+Cliënt: Noor van den Berg\n
+Patiëntnummer: PAT-2026-1148\n
+Medisch dossiernummer: MD-2026-4412\n
+Vertegenwoordiger: mevrouw Elise van den Berg\n
+E-mailadres vertegenwoordiger: elise.vandenberg@example.invalid\n
+Zorgorganisatie: Zorggroep Kompas, woonlocatie De Linde, appartement 3B\n
+Evaluatiedatum: 01-07-2026\n
+Persoonlijk begeleider: Sanne de Wit\n
+
+Probleem: cliënt raakt overprikkeld bij onverwachte wijzigingen in het dagprogramma. Diagnose autismespectrumstoornis blijft relevante klinische context. Zorgdoel: cliënt geeft met een pictogram aan wanneer rust nodig is. Actie: begeleider kondigt wijzigingen minimaal vijftien minuten vooraf aan. Evaluatie: het aantal escalaties daalde van vier naar één per week. Allergie: geen bekende medicatieallergieën.\n""",
+        "replace": [
+            {"value": "Noor van den Berg", "entity_type": "PERSON"},
+            {"value": "PAT-2026-1148", "entity_type": "NL_PATIENT_NUMBER"},
+            {"value": "MD-2026-4412", "entity_type": "NL_MEDICAL_RECORD_NUMBER"},
+            {"value": "Elise van den Berg", "entity_type": "PERSON"},
+            {"value": "elise.vandenberg@example.invalid", "entity_type": "EMAIL_ADDRESS"},
+        ],
+        "review_selected": [
+            {"value": "Zorggroep Kompas", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "woonlocatie De Linde", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+            {"value": "appartement 3B", "entity_type": "NL_ROOM_OR_BED_REFERENCE"},
+            {"value": "01-07-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Sanne de Wit", "entity_type": "NL_CARE_PROVIDER_NAME"},
+        ],
+        "preserve": [
+            "autismespectrumstoornis",
+            "raakt overprikkeld",
+            "Zorgdoel",
+            "pictogram",
+            "vijftien minuten vooraf",
+            "vier naar één per week",
+            "geen bekende medicatieallergieën",
+        ],
+        "audit_only": ["diagnose plus kleine woonlocatie en exact evaluatiemoment"],
+        "ambiguity_traps": ["vier", "één per week", "3B"],
+    },
+    {
+        "id": "care_nursing_transfer_v1",
+        "name": "Ziekenhuis naar wijkverpleging - verpleegkundige overdracht",
+        "sector": "ziekenhuis_en_wijkverpleging",
+        "document_type": "verpleegkundige_overdracht",
+        "text": """VERPLEEGKUNDIGE OVERDRACHT\n
+Patiënt: mevrouw Laila Ait Haddou\n
+EPD-nummer: EPD-2026-5501\n
+BSN: 123456782\n
+Geboortedatum: 03-09-1957\n
+Woonadres: Herstelstraat 42, 3062 KL Rotterdam\n
+Telefoon: 010 2345678\n
+Verzendende organisatie: Stedelijk Ziekenhuis Noord, afdeling Neurologie B, bed B-12\n
+Ontvangende organisatie: Wijkzorg Rijnmond, team Kralingen\n
+Ontslagdatum: 18-06-2026\n
+Overdragend verpleegkundige: Karin de Groot\n
+
+Medische context: ischemisch CVA links. Patiënt is alert, heeft lichte rechtszijdige krachtsvermindering en spreekt korte zinnen. Mobiliteit: transfer met één persoon en rollator. Voeding: normaal dieet, dunne vloeistoffen toegestaan. Medicatie: clopidogrel 75 mg eenmaal daags en atorvastatine 40 mg eenmaal daags. Allergisch voor penicilline. Wondzorg is niet van toepassing. Vervolg: fysiotherapie en controle bij neuroloog over zes weken.\n""",
+        "replace": [
+            {"value": "Laila Ait Haddou", "entity_type": "PERSON"},
+            {"value": "EPD-2026-5501", "entity_type": "NL_EPD_ECD_NUMBER"},
+            {"value": "123456782", "entity_type": "NL_BSN"},
+            {"value": "03-09-1957", "entity_type": "NL_DATE_OF_BIRTH"},
+            {"value": "Herstelstraat 42, 3062 KL Rotterdam", "entity_type": "NL_ADDRESS"},
+            {"value": "010 2345678", "entity_type": "NL_PHONE_NUMBER"},
+        ],
+        "review_selected": [
+            {"value": "Stedelijk Ziekenhuis Noord", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "afdeling Neurologie B", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+            {"value": "bed B-12", "entity_type": "NL_ROOM_OR_BED_REFERENCE"},
+            {"value": "Wijkzorg Rijnmond", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "team Kralingen", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+            {"value": "18-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Karin de Groot", "entity_type": "NL_CARE_PROVIDER_NAME"},
+        ],
+        "preserve": [
+            "ischemisch CVA links",
+            "lichte rechtszijdige krachtsvermindering",
+            "transfer met één persoon en rollator",
+            "clopidogrel 75 mg eenmaal daags",
+            "atorvastatine 40 mg eenmaal daags",
+            "Allergisch voor penicilline",
+            "fysiotherapie",
+        ],
+        "audit_only": [],
+        "ambiguity_traps": ["75 mg", "40 mg", "zes weken", "B-12"],
+    },
+    {
+        "id": "care_discharge_letter_v1",
+        "name": "Medisch-specialistische ontslagbrief",
+        "sector": "medisch_specialistische_zorg",
+        "document_type": "ontslagbrief",
+        "text": """ONTSLAGBRIEF INTERNE GENEESKUNDE\n
+Patiënt: Peter van Leeuwen\n
+Patiëntnummer: PAT-2026-7781\n
+Verzekerdennummer: VERZ-88441122\n
+Opnamedatum: 10-06-2026\n
+Ontslagdatum: 14-06-2026\n
+Huisarts: dr. Miriam Vos, AGB-code 01020304\n
+Behandelend internist: dr. Jeroen de Bruin, BIG-nummer 10987654321\n
+Ziekenhuis: Medisch Centrum Rivierenland, afdeling Interne Geneeskunde\n
+
+Reden opname: dehydratie bij gastro-enteritis. Hoofddiagnose: acute nierinsufficiëntie, volledig hersteld na intraveneuze vochttoediening. Bij ontslag creatinine 88 µmol/L en natrium 139 mmol/L. Medicatie bij ontslag: amlodipine 5 mg eenmaal daags. Advies: voldoende drinken en nierfunctiecontrole bij de huisarts binnen één week.\n""",
+        "replace": [
+            {"value": "Peter van Leeuwen", "entity_type": "PERSON"},
+            {"value": "PAT-2026-7781", "entity_type": "NL_PATIENT_NUMBER"},
+            {"value": "VERZ-88441122", "entity_type": "NL_HEALTH_INSURANCE_NUMBER"},
+        ],
+        "review_selected": [
+            {"value": "10-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "14-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Miriam Vos", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "01020304", "entity_type": "NL_AGB_CODE"},
+            {"value": "Jeroen de Bruin", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "10987654321", "entity_type": "NL_BIG_NUMBER"},
+            {"value": "Medisch Centrum Rivierenland", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "afdeling Interne Geneeskunde", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+        ],
+        "preserve": [
+            "dehydratie bij gastro-enteritis",
+            "Hoofddiagnose: acute nierinsufficiëntie",
+            "intraveneuze vochttoediening",
+            "creatinine 88 µmol/L",
+            "natrium 139 mmol/L",
+            "amlodipine 5 mg eenmaal daags",
+            "nierfunctiecontrole",
+        ],
+        "audit_only": ["zeldzame diagnose in combinatie met kleine afdeling en exacte opnameperiode"],
+        "ambiguity_traps": ["88 µmol/L", "139 mmol/L", "5 mg", "één week"],
+    },
+    {
+        "id": "care_gp_referral_v1",
+        "name": "Huisartsverwijzing cardiologie",
+        "sector": "huisartsenzorg",
+        "document_type": "verwijsbrief",
+        "text": """VERWIJSBRIEF CARDIOLOGIE\n
+Patiënt: Samira Benali\n
+Geboortedatum: 22-11-1966\n
+BSN: 123456782\n
+Verwijsnummer: VERW-2026-7711\n
+Behandelnummer: BEH-2026-1188\n
+Huisarts: dr. Thomas Mulder, praktijk De Stadspoort, AGB-code 87654321\n
+E-mail patiënt: samira.benali@example.invalid\n
+
+Vraagstelling: beoordeling van inspanningsgebonden thoracale druk. Voorgeschiedenis: hypertensie en diabetes mellitus type 2. Medicatie: metformine 500 mg tweemaal daags en lisinopril 10 mg eenmaal daags. Bloeddruk op het spreekuur 148/86 mmHg. Geen bekende geneesmiddelenallergieën. Graag beoordeling en behandeladvies.\n""",
+        "replace": [
+            {"value": "Samira Benali", "entity_type": "PERSON"},
+            {"value": "22-11-1966", "entity_type": "NL_DATE_OF_BIRTH"},
+            {"value": "123456782", "entity_type": "NL_BSN"},
+            {"value": "VERW-2026-7711", "entity_type": "NL_REFERRAL_NUMBER"},
+            {"value": "BEH-2026-1188", "entity_type": "NL_TREATMENT_REFERENCE"},
+            {"value": "samira.benali@example.invalid", "entity_type": "EMAIL_ADDRESS"},
+        ],
+        "review_selected": [
+            {"value": "Thomas Mulder", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "praktijk De Stadspoort", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "87654321", "entity_type": "NL_AGB_CODE"},
+        ],
+        "preserve": [
+            "inspanningsgebonden thoracale druk",
+            "hypertensie",
+            "diabetes mellitus type 2",
+            "metformine 500 mg tweemaal daags",
+            "lisinopril 10 mg eenmaal daags",
+            "148/86 mmHg",
+            "Geen bekende geneesmiddelenallergieën",
+        ],
+        "audit_only": [],
+        "ambiguity_traps": ["148/86", "500 mg", "10 mg", "type 2"],
+    },
+    {
+        "id": "care_medication_overview_v1",
+        "name": "Apotheek - medicatieoverzicht",
+        "sector": "farmaceutische_zorg",
+        "document_type": "medicatieoverzicht",
+        "text": """ACTUEEL MEDICATIEOVERZICHT\n
+Patiënt: Willem de Jong\n
+Patiëntnummer: PAT-2026-3321\n
+Geboortedatum: 09-04-1952\n
+Apotheek: Apotheek Waterlinie, AGB-code 11223344\n
+Voorschrijver: huisarts dr. Eva Smit, BIG-nummer 11223344556\n
+Receptnummer: BEH-2026-2244\n
+
+1. Metoprolol 50 mg, eenmaal daags om 08:00 uur.\n
+2. Apixaban 5 mg, tweemaal daags om 08:00 en 20:00 uur.\n
+3. Omeprazol 20 mg, eenmaal daags voor het ontbijt.\n
+Allergie: naproxen veroorzaakt urticaria.\n""",
+        "replace": [
+            {"value": "Willem de Jong", "entity_type": "PERSON"},
+            {"value": "PAT-2026-3321", "entity_type": "NL_PATIENT_NUMBER"},
+            {"value": "09-04-1952", "entity_type": "NL_DATE_OF_BIRTH"},
+            {"value": "BEH-2026-2244", "entity_type": "NL_TREATMENT_REFERENCE"},
+        ],
+        "review_selected": [
+            {"value": "Apotheek Waterlinie", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "11223344", "entity_type": "NL_AGB_CODE"},
+            {"value": "Eva Smit", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "11223344556", "entity_type": "NL_BIG_NUMBER"},
+        ],
+        "preserve": [
+            "Metoprolol 50 mg",
+            "eenmaal daags om 08:00 uur",
+            "Apixaban 5 mg",
+            "tweemaal daags om 08:00 en 20:00 uur",
+            "Omeprazol 20 mg",
+            "naproxen veroorzaakt urticaria",
+        ],
+        "audit_only": [],
+        "ambiguity_traps": ["50 mg", "5 mg", "20 mg", "08:00", "20:00"],
+    },
+    {
+        "id": "care_laboratory_report_v1",
+        "name": "Laboratorium - klinisch chemisch rapport",
+        "sector": "laboratoriumzorg",
+        "document_type": "laboratoriumrapport",
+        "text": """KLINISCH CHEMISCH RAPPORT\n
+Patiënt: Daan Vermeer\n
+Medisch dossiernummer: MD-2026-7744\n
+Monsternummer: LAB-2026-4412\n
+Afnamedatum: 20-06-2026\n
+Aanvrager: dr. Nadia Bos\n
+Laboratorium: Diagnostiek Centrum Delta\n
+
+Hemoglobine: 7,8 mmol/L (referentie 8,5-11,0).\n
+Leukocyten: 6,2 x10^9/L (referentie 4,0-10,0).\n
+CRP: 4 mg/L (referentie kleiner dan 5).\n
+Glucose: 4,4 mmol/L.\n
+Conclusie: licht verlaagd hemoglobine, overige waarden zonder bijzonderheden.\n""",
+        "replace": [
+            {"value": "Daan Vermeer", "entity_type": "PERSON"},
+            {"value": "MD-2026-7744", "entity_type": "NL_MEDICAL_RECORD_NUMBER"},
+            {"value": "LAB-2026-4412", "entity_type": "NL_LAB_SAMPLE_NUMBER"},
+        ],
+        "review_selected": [
+            {"value": "20-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Nadia Bos", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "Diagnostiek Centrum Delta", "entity_type": "NL_CARE_ORGANIZATION"},
+        ],
+        "preserve": [
+            "Hemoglobine: 7,8 mmol/L",
+            "referentie 8,5-11,0",
+            "Leukocyten: 6,2 x10^9/L",
+            "CRP: 4 mg/L",
+            "Glucose: 4,4 mmol/L",
+            "licht verlaagd hemoglobine",
+        ],
+        "audit_only": [],
+        "ambiguity_traps": ["7,8", "8,5-11,0", "6,2", "4 mg/L", "4,4"],
+    },
+    {
+        "id": "care_incident_report_v1",
+        "name": "VVT - MIC medicatie-incident",
+        "sector": "verpleging_verzorging_thuiszorg",
+        "document_type": "mic_mim_vim_rapport",
+        "text": """MIC-MELDING MEDICATIE-INCIDENT\n
+Cliënt: mevrouw Johanna Peters\n
+Cliëntnummer: CL-ZORG-9901\n
+Incidentnummer: MIC-2026-0912\n
+Locatie: woonzorgcentrum De Brug, afdeling Waterkant, kamer 18\n
+Incidentdatum: 21-06-2026 om 20:15 uur\n
+Melder: verzorgende IG Youssef Amrani\n
+Betrokken arts: dr. Lotte Kramer\n
+Contactpersoon familie: Mark Peters, telefoon 06 87654321\n
+
+Omschrijving: de avonddosering apixaban 5 mg is om 20:00 uur niet toegediend. De omissie werd om 20:15 uur ontdekt. De arts beoordeelde dat geen inhaaldosis nodig was. Cliënt had geen klachten en de vitale parameters waren stabiel. Maatregel: dubbele controle van de medicatielijst bij de avonddienst.\n""",
+        "replace": [
+            {"value": "Johanna Peters", "entity_type": "PERSON"},
+            {"value": "CL-ZORG-9901", "entity_type": "NL_CARE_CLIENT_NUMBER"},
+            {"value": "MIC-2026-0912", "entity_type": "NL_CARE_INCIDENT_NUMBER"},
+            {"value": "Mark Peters", "entity_type": "PERSON"},
+            {"value": "06 87654321", "entity_type": "NL_PHONE_NUMBER"},
+        ],
+        "review_selected": [
+            {"value": "woonzorgcentrum De Brug", "entity_type": "NL_CARE_ORGANIZATION"},
+            {"value": "afdeling Waterkant", "entity_type": "NL_CARE_LOCATION_REFERENCE"},
+            {"value": "kamer 18", "entity_type": "NL_ROOM_OR_BED_REFERENCE"},
+            {"value": "21-06-2026", "entity_type": "NL_CARE_EVENT_DATE"},
+            {"value": "Youssef Amrani", "entity_type": "NL_CARE_PROVIDER_NAME"},
+            {"value": "Lotte Kramer", "entity_type": "NL_CARE_PROVIDER_NAME"},
+        ],
+        "preserve": [
+            "verzorgende IG",
+            "apixaban 5 mg",
+            "20:00 uur niet toegediend",
+            "geen inhaaldosis nodig",
+            "geen klachten",
+            "vitale parameters waren stabiel",
+            "dubbele controle van de medicatielijst",
+        ],
+        "audit_only": ["kleine woonlocatie plus exact incidentmoment en zeldzame gebeurtenis"],
+        "ambiguity_traps": ["5 mg", "20:00", "20:15", "kamer 18"],
+    },
+]
+
+
+def get_case(case_id: str) -> Dict[str, Any]:
+    """Return one synthetic case by stable ID."""
+
+    for case in TEST_CASES:
+        if case["id"] == case_id:
+            return case
+    raise KeyError(case_id)
+
+
+def all_expected_values(case: Dict[str, Any]) -> List[str]:
+    """Return all exact replace/review values from one case."""
+
+    values: List[str] = []
+    for bucket in ("replace", "review_selected"):
+        values.extend(str(item["value"]) for item in case.get(bucket, []))
+    return values

handover/workpackages/20260803_1531_care_profile_v1_policy_and_corpus_foundation.md

@@ -0,0 +1,56 @@
+# Handover — SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION
+
+Repository: solidprivacy-nl/scrub  
+Workpackage title: Zorgfilter v1 policy and corpus foundation  
+Status: completed; final clean PR validation initiated
+
+## Summary
+
+Recorded the approved Zorgfilter v1 policy and workpackage sequence. Added a pure policy contract, eight fully synthetic care-document families, corpus contract tests and a deterministic baseline helper for the current Dutch custom recognizers. No recognizer or UI behavior has changed.
+
+## Files added
+
+- `CARE_PROFILE_V1_PLAN.md`
+- `care_profile_policy.py`
+- `care_test_examples.py`
+- `care_profile_baseline.py`
+- `scripts/generate_care_profile_baseline.py`
+- `tests/test_care_profile_policy_contract.py`
+- `tests/test_care_profile_corpus_contracts.py`
+- `tests/test_care_profile_current_engine_baseline.py`
+- `workpackage_claims/scrub_wp_care_profile_v1_policy_and_corpus_foundation.md`
+- `handover/workpackages/20260803_1531_care_profile_v1_policy_and_corpus_foundation.md`
+
+## Files changed
+
+- `ROADMAP.md`
+- `WORKPACKAGES.md`
+- `CHANGELOG.md`
+- `DECISION_LOG.md`
+- `RISK_REGISTER.md`
+
+## Tests
+
+- Pure policy-contract tests.
+- Synthetic corpus structural and policy-alignment tests.
+- Current deterministic recognizer baseline-schema tests.
+
+## Validation
+
+- Initial GitHub Actions run: 917 passed, 1 new corpus-contract test failed because a valid discharge-letter preserve phrase lacked one of the test's clinical marker words.
+- Corrective action: replaced the brittle marker-word assertion with a contract for multiple protected clinical passages that remain disjoint from replace/review values.
+- GitHub Actions run #1818: 918 tests passed on the corrected implementation.
+- Final clean PR validation: initiated after all temporary workflow/operator files were removed.
+- Hugging Face sync status: not functionally relevant; no runtime/UI change.
+- App verification status: not applicable.
+
+## Remaining risks
+
+- The current broad `NL_HEALTHCARE_REFERENCE` behavior remains unchanged and must be split through later evidence-driven recognizer packages.
+- The baseline excludes generic NER-model results and is not a production benchmark.
+- Exact care-date, provider, organization and location policy requires later recognizer precision testing.
+- Human review remains mandatory.
+
+## Next recommended step
+
+Generate and inspect the current-engine baseline report, perform gap triage, then freeze care-recognizer contracts before implementing care-specific recognizers.

scripts/generate_care_profile_baseline.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Generate a machine-readable pre-Zorgfilter recognizer baseline."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from care_profile_baseline import build_current_care_baseline
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--output",
+        default="output/validation/care_profile_v1_current_engine_baseline.json",
+    )
+    args = parser.parse_args()
+
+    output_path = Path(args.output)
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    output_path.write_text(
+        json.dumps(build_current_care_baseline(), ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8",
+    )
+    print(output_path)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_care_profile_corpus_contracts.py

@@ -0,0 +1,71 @@
+from care_profile_policy import ACTION_REPLACE, ACTION_REVIEW_SELECTED, policy_for_entity
+from care_test_examples import TEST_CASES, all_expected_values, get_case
+
+
+REQUIRED_DOCUMENT_TYPES = {
+    "dagrapportage",
+    "zorgplan_evaluatie",
+    "verpleegkundige_overdracht",
+    "ontslagbrief",
+    "verwijsbrief",
+    "medicatieoverzicht",
+    "laboratoriumrapport",
+    "mic_mim_vim_rapport",
+}
+
+
+def test_care_corpus_contains_eight_stable_document_families():
+    assert len(TEST_CASES) == 8
+    assert {case["document_type"] for case in TEST_CASES} == REQUIRED_DOCUMENT_TYPES
+    assert len({case["id"] for case in TEST_CASES}) == len(TEST_CASES)
+
+
+def test_every_expected_identifier_occurs_exactly_in_its_synthetic_text():
+    for case in TEST_CASES:
+        text = case["text"]
+        for value in all_expected_values(case):
+            assert value in text, f"{case['id']}: expected value not present: {value}"
+
+
+def test_every_preserve_phrase_and_ambiguity_trap_occurs_in_text():
+    for case in TEST_CASES:
+        text = case["text"]
+        assert case["preserve"], f"{case['id']}: preserve list must not be empty"
+        for phrase in case["preserve"]:
+            assert phrase in text, f"{case['id']}: preserve phrase not present: {phrase}"
+        for trap in case["ambiguity_traps"]:
+            assert trap in text, f"{case['id']}: ambiguity trap not present: {trap}"
+
+
+def test_corpus_buckets_match_the_frozen_policy():
+    for case in TEST_CASES:
+        for item in case["replace"]:
+            rule = policy_for_entity(item["entity_type"])
+            assert rule is not None, f"{case['id']}: missing policy for {item['entity_type']}"
+            assert rule.action == ACTION_REPLACE
+        for item in case["review_selected"]:
+            rule = policy_for_entity(item["entity_type"])
+            assert rule is not None, f"{case['id']}: missing policy for {item['entity_type']}"
+            assert rule.action == ACTION_REVIEW_SELECTED
+
+
+def test_corpus_uses_only_synthetic_email_domains():
+    for case in TEST_CASES:
+        for item in case["replace"]:
+            if item["entity_type"] == "EMAIL_ADDRESS":
+                assert item["value"].endswith(".invalid")
+
+
+def test_clinical_meaning_is_represented_in_every_case():
+    for case in TEST_CASES:
+        protected_values = set(all_expected_values(case))
+        preserve_phrases = list(case["preserve"])
+
+        assert len(preserve_phrases) >= 3, case["id"]
+        assert sum(len(phrase.strip()) for phrase in preserve_phrases) >= 40, case["id"]
+        assert protected_values.isdisjoint(preserve_phrases), case["id"]
+
+
+def test_get_case_uses_stable_ids():
+    case = get_case("care_laboratory_report_v1")
+    assert case["document_type"] == "laboratoriumrapport"

tests/test_care_profile_current_engine_baseline.py

@@ -0,0 +1,38 @@
+from care_profile_baseline import build_current_care_baseline
+
+
+def test_current_care_baseline_is_complete_evidence_not_a_readiness_claim():
+    report = build_current_care_baseline()
+
+    assert report["schema_version"] == "1.0"
+    assert report["synthetic_data_only"] is True
+    assert report["production_ready"] is False
+    assert report["human_review_required"] is True
+    assert report["case_count"] == 8
+    assert len(report["cases"]) == 8
+    assert report["expected_value_count"] >= report["found_value_count"] >= 0
+    assert 0.0 <= report["indicative_recall"] <= 1.0
+    assert report["preserve_overlap_count"] >= 0
+
+
+def test_each_baseline_case_keeps_exact_expectation_evidence():
+    report = build_current_care_baseline()
+
+    for case in report["cases"]:
+        assert case["expected_value_count"] == len(case["expectations"])
+        assert case["found_value_count"] == sum(
+            1 for expectation in case["expectations"] if expectation["found"]
+        )
+        for expectation in case["expectations"]:
+            assert expectation["policy_bucket"] in {"replace", "review_selected"}
+            assert expectation["value"]
+            assert expectation["expected_entity_type"]
+            assert isinstance(expectation["detected_entity_types"], list)
+            assert isinstance(expectation["detected_spans"], list)
+
+
+def test_baseline_scope_excludes_generic_ner_and_cloud_processing():
+    report = build_current_care_baseline()
+
+    assert "generic NER excluded" in report["scope"]
+    assert report["profile"] == "current_custom_recognizers_before_care_profile"

tests/test_care_profile_policy_contract.py

@@ -0,0 +1,47 @@
+from care_profile_policy import (
+    ACTION_AUDIT_ONLY,
+    ACTION_PRESERVE,
+    ACTION_REPLACE,
+    ACTION_REVIEW_SELECTED,
+    entities_for_action,
+    policy_for_entity,
+    policy_snapshot,
+    validate_care_policy_rules,
+)
+
+
+def test_care_policy_contract_is_structurally_valid():
+    assert validate_care_policy_rules() == ()
+
+
+def test_all_four_policy_actions_are_used():
+    assert entities_for_action(ACTION_REPLACE)
+    assert entities_for_action(ACTION_REVIEW_SELECTED)
+    assert entities_for_action(ACTION_PRESERVE)
+    assert entities_for_action(ACTION_AUDIT_ONLY)
+
+
+def test_approved_care_policy_preferences_are_frozen():
+    assert policy_for_entity("NL_DATE_OF_BIRTH").action == ACTION_REPLACE
+    assert policy_for_entity("NL_PATIENT_NUMBER").action == ACTION_REPLACE
+    assert policy_for_entity("NL_CARE_PROVIDER_NAME").action == ACTION_REVIEW_SELECTED
+    assert policy_for_entity("NL_BIG_NUMBER").action == ACTION_REVIEW_SELECTED
+    assert policy_for_entity("NL_AGB_CODE").action == ACTION_REVIEW_SELECTED
+    assert policy_for_entity("CARE_DIAGNOSIS").action == ACTION_PRESERVE
+    assert policy_for_entity("CARE_MEDICATION").action == ACTION_PRESERVE
+    assert policy_for_entity("CARE_LAB_RESULT").action == ACTION_PRESERVE
+    assert policy_for_entity("CARE_OBSERVATION").action == ACTION_PRESERVE
+    assert policy_for_entity("CARE_RARE_CASE_COMBINATION").action == ACTION_AUDIT_ONLY
+
+
+def test_clinical_codes_are_not_blindly_replaced():
+    assert policy_for_entity("CARE_CLINICAL_CODE").action == ACTION_PRESERVE
+    assert "CARE_CLINICAL_CODE" not in entities_for_action(ACTION_REPLACE)
+
+
+def test_policy_snapshot_is_stable_and_complete():
+    snapshot = policy_snapshot()
+    assert snapshot["NL_EPD_ECD_NUMBER"] == ACTION_REPLACE
+    assert snapshot["NL_CARE_EVENT_DATE"] == ACTION_REVIEW_SELECTED
+    assert snapshot["CARE_DOSAGE"] == ACTION_PRESERVE
+    assert len(snapshot) == len(set(snapshot))

workpackage_claims/scrub_wp_care_profile_v1_policy_and_corpus_foundation.md

@@ -0,0 +1,22 @@
+# Workpackage claim — SCRUB-WP_CARE_PROFILE_V1_POLICY_AND_CORPUS_FOUNDATION
+
+Repository: `solidprivacy-nl/scrub`  
+Claimed at: 2026-08-03 15:31 Europe/Amsterdam  
+Status: completed
+
+## Scope
+
+- Record the approved Zorgfilter v1 policy in roadmap, decision, risk and workpackage documentation.
+- Define the sequential Zorgfilter workpackage line.
+- Add a pure, machine-readable care-profile policy contract.
+- Add a first fully synthetic care-document corpus with explicit detect, review and preserve expectations.
+- Add contract tests and a current-engine baseline artifact without changing recognizer, UI, export, Scrub Key or reinsert behavior.
+
+## Boundaries
+
+- Synthetic data only.
+- No real care records or personal data.
+- No UI integration in this first package.
+- No automatic masking of diagnosis, medication, lab results or observations.
+- No change to current legal/general/international profile behavior.
+- No cloud document processing.