Engineering Gap

Two PII scrubbing implementations exist: a legacy regex-only version at root scrubber.py and the canonical spaCy-based version at app/ai-service/services/pii_scrubber.py. Root file header states it is "preserved for reference" but still has a live function.

Codebase Evidence

• Root scrubber.py lines 1-4: "Legacy PII scrubber — preserved for reference"
• Root scrubber.py line 7-16: scrub_pii function still implemented
• tests/test_pii_scrubber.py: Tests reference root scrubber
• app/ai-service/services/pii_scrubber.py: Canonical implementation with spaCy

Risk Profile

Current Risk

Confusion about canonical implementation. Tests reference legacy version.

Business Impact

Developers may use wrong implementation.

Remediation Strategy

Update root tests to use AI service implementation or remove. Add deprecation notice. Remove function body leaving only docstring reference.

Success Conditions

• Root scrub_pii function deprecated
• Tests updated or removed

Change Surface

Files: scrubber.py, tests/test_pii_scrubber.py

Security Review

No security impact.

Completion Checklist

• Implementation completed
• Tests updated
• Ready for merge