feat(pii): add v3 replace_pii config and tabular replacer

.github/workflows/config/.secrets.baseline

@@ -26,6 +26,9 @@
     {
       "name": "GitHubTokenDetector"
     },
+    {
+      "name": "GitLabTokenDetector"
+    },
     {
       "name": "HexHighEntropyString",
       "limit": 3.0
@@ -37,21 +40,26 @@
       "name": "IbmCosHmacDetector"
     },
     {
-      "name": "JwtTokenDetector"
+      "name": "IPPublicDetector"
     },
     {
-      "name": "KeywordDetector",
-      "keyword_exclude": ""
+      "name": "JwtTokenDetector"
     },
     {
       "name": "MailchimpDetector"
     },
     {
       "name": "NpmDetector"
     },
+    {
+      "name": "OpenAIDetector"
+    },
     {
       "name": "PrivateKeyDetector"
     },
+    {
+      "name": "PypiTokenDetector"
+    },
     {
       "name": "SendGridDetector"
     },
@@ -67,6 +75,9 @@
     {
       "name": "StripeDetector"
     },
+    {
+      "name": "TelegramBotTokenDetector"
+    },
     {
       "name": "TwilioKeyDetector"
     }
@@ -77,7 +88,7 @@
     },
     {
       "path": "detect_secrets.filters.common.is_baseline_file",
-      "filename": ".secrets.baseline"
+      "filename": ".github/workflows/config/.secrets.baseline"
     },
     {
       "path": "detect_secrets.filters.common.is_ignored_due_to_verification_policies",
@@ -109,7 +120,14 @@
     },
     {
       "path": "detect_secrets.filters.heuristic.is_templated_secret"
+    },
+    {
+      "path": "detect_secrets.filters.regex.should_exclude_file",
+      "pattern": [
+        "\\.github/workflows/config/\\.secrets\\.baseline"
+      ]
     }
   ],
-  "results": {}
+  "results": {},
+  "generated_at": "2026-08-04T15:08:14Z"
 }

.markdownlint.json

@@ -1,4 +1,5 @@
 {
     "MD013": false,
-    "MD034": false
+    "MD034": false,
+    "MD046": { "style": "fenced" }
 }

AGENTS.md

@@ -55,7 +55,7 @@ Source code lives in `src/nemo_safe_synthesizer/`:
 | `generation/` | GeneratorBackend, VllmBackend, regex manager, batch gen |
 | `holdout/` | Train/test splitting |
 | `llm/` | Model loading, metadata, memory management |
-| `pii_replacer/` | NER-based PII detection and replacement |
+| `pii_replacer/` | Heuristic tabular PII discovery and persona replacement |
 | `privacy/` | DP transformers (Opacus integration) |
 | `sdk/` | SafeSynthesizer builder, library_builder |
 | `training/` | TrainingBackend, HuggingFace backend, timeseries_preprocessing (`timeseries_preprocessing.py`) |

STYLE_GUIDE.md

@@ -154,8 +154,6 @@ def is_json_object(value: object) -> TypeIs[dict[str, JsonValue]]:
     )
 ```
 
-Legacy modules (`pii_replacer/`) still use `Optional`/`List`/`Dict`. Only `pii_replacer/` is excluded from `ty` type-checking (see `[tool.ty.src] exclude` in `pyproject.toml`). The remaining legacy usages will be migrated when those modules come under the type checker.
-
 ### Control flow
 
 - Prefer `match`/`case` for dispatch on types or tagged values. Not a blanket rule -- `if`/`elif` is fine for simple boolean predicates.

design.md

@@ -23,7 +23,7 @@ graph TB
             TrainConfig[TrainingHyperparams]
             GenConfig[GenerateParameters]
             EvalConfig[EvaluationParameters]
-            PIIConfig[PiiReplacerConfig]
+            PIIConfig[ReplacePiiConfig]
             DPConfig[DifferentialPrivacyHyperparams]
         end
     end
@@ -207,7 +207,7 @@ Path: `src/nemo_safe_synthesizer/config/`
 - `TrainingHyperparams`: Training settings (learning rate, epochs, batch size, etc.)
 - `GenerateParameters`: Generation settings (temperature, top_p, num_records, etc.)
 - `EvaluationParameters`: Evaluation component toggles and settings
-- `PiiReplacerConfig`: PII detection and replacement settings
+- `ReplacePiiConfig`: PII detection and replacement settings
 - `DifferentialPrivacyHyperparams`: DP training parameters (epsilon, delta, clipping norm)
 
 ### 2. Data Processing Pipeline
@@ -415,7 +415,7 @@ results = synthesizer.results
 
 ### PII Protection
 
-- Named Entity Recognition (NER) to detect PII
+- Heuristic discovery to find PII columns (names, values, dtypes)
 - Deterministic replacement with synthetic values
 - Preserves column statistics and distributions
 
@@ -469,7 +469,7 @@ safe-synthesizer-artifacts/
 2. Custom Generation Backend: Implement `GeneratorBackend` abstract class
 3. Custom Evaluation Component: Extend `Component` base class
 4. Custom Data Actions: Add to `data_processing/actions/`
-5. Custom PII Detectors: Extend NER pipeline
+5. Custom PII discovery: extend heuristic detectors in `pii_replacer/`
 
 ---
 

docs/developer-guide/architecture.md

@@ -29,7 +29,7 @@ graph TB
             TrainConfig["TrainingHyperparams"]
             GenConfig["GenerateParameters"]
             EvalConfig["EvaluationParameters"]
-            PIIConfig["PiiReplacerConfig"]
+            PIIConfig["ReplacePiiConfig"]
             DPConfig["DifferentialPrivacyHyperparams"]
         end
     end
@@ -188,7 +188,7 @@ flowchart TB
         training_p["TrainingHyperparams"]
         gen_p["GenerateParameters"]
         eval_p["EvaluationParameters"]
-        pii_p["PiiReplacerConfig | None"]
+        pii_p["ReplacePiiConfig | None"]
         dp_p["DifferentialPrivacyHyperparams | None"]
         ts_p["TimeSeriesParameters"]
     end
@@ -233,7 +233,7 @@ Exactly what avenues of configuration are available, and thus how precedence is
 - CLI: CLI flags > dataset registry overrides > YAML config file > defaults
 - SDK: Python SDK builder calls > YAML config file > defaults
 
-Nullable sub-configs (`PiiReplacerConfig | None`, `DifferentialPrivacyHyperparams | None`)
+Nullable sub-configs (`ReplacePiiConfig | None`, `DifferentialPrivacyHyperparams | None`)
 use `None` as the sole disabled signal. The `@pydantic_options` decorator auto-generates
 `--no_<field>` is-flags for these fields; `parse_overrides` translates them into
 `{field: None}` in the overrides dict.
@@ -297,7 +297,7 @@ Path: `src/nemo_safe_synthesizer/config/`
 - TrainingHyperparams: training settings (learning rate, epochs, batch size, etc.)
 - GenerateParameters: generation settings (temperature, top_p, num_records, etc.)
 - EvaluationParameters: evaluation component toggles and settings
-- PiiReplacerConfig: PII detection and replacement settings
+- ReplacePiiConfig: PII detection and replacement settings
 - DifferentialPrivacyHyperparams: DP training parameters (epsilon, delta, clipping norm)
 
 ### 2. Data Processing Pipeline
@@ -395,4 +395,4 @@ The execution follows a clear pipeline: Data --> PII Replacement --> Training --
 2. Custom Generation Backend: implement `GeneratorBackend` abstract class
 3. Custom Evaluation Component: extend `Component` base class
 4. Custom Data Actions: add to `data_processing/actions/`
-5. Custom PII Detectors: extend NER pipeline
+5. Custom PII discovery: extend heuristic detectors in `pii_replacer/`

docs/developer-guide/configuration_management.md

@@ -39,7 +39,7 @@ The generated Click options use `Field(description=...)` as CLI help text.
 Optional sub-configs use `None` as the disabled signal. Do not add a second
 boolean flag for the same feature.
 
-For a field such as `replace_pii: PiiReplacerConfig | None`,
+For a field such as `replace_pii: ReplacePiiConfig | None`,
 `pydantic_options()` emits:
 
 ```bash