feat(gate2): improve AU/NZ phone number detection coverage

- Add AU/NZ landline patterns (+61 [2378] / +64 [34679], local and international)
- Split AU/NZ phone confidence: international prefix (+61/+64) scores 0.85
  (auto-redacts in any column); local format scores 0.70 (needs key context)
- Fix +610/+640 stray leading zero after country code silently skipped
- Strip ASCII whitespace from values before regex matching so variants like
  "+ 640220831619" and "+6 40220831619" are caught
- Add phone column synonyms: phnumber, ph_number, cell, cell_number

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: GaaraZhu

CHANGELOG.md

@@ -1,3 +1,16 @@
+## [Unreleased]
+
+### 🐛 Bug Fixes
+
+- Fix AU/NZ international phone numbers not matched when `+` is separated from digits by whitespace (e.g. `+ 640220831619`, `+6 40220831619`) — values are now whitespace-stripped before regex matching
+- Fix `+610`/`+640` (stray leading zero after country code) silently skipped by AU/NZ phone patterns
+
+### ✨ Improvements
+
+- Add AU/NZ landline patterns: `+61 [2378]`/`0[2378]` (NSW/ACT, VIC/TAS, QLD, WA/SA/NT) and `+64 [34679]`/`0[34679]` (South Island, Wellington, Taranaki, Waikato, Auckland)
+- Split AU/NZ phone confidence: international-prefix numbers (`+61`/`+64`) score 0.85 and auto-redact in any column; local-format numbers score 0.70 and require a PII-named column
+- Add phone column synonyms: `phnumber`, `ph_number`, `cell`, `cell_number`
+
 ## [0.8.7] - 2026-05-25
 
 ### 🚀 Features

README.md

@@ -216,7 +216,7 @@ Stats are collected by default and written to a local JSONL log on disk — they
 - **Commands not in `tools:`.** The AI can invoke them freely; their output is never inspected.
 - **Non-JSON tool output.** Plain text, CSV, and other formats pass through unchanged. Configure tools to emit JSON.
 - **Encoded or obfuscated PII.** Base64-encoded emails, URL-encoded values, or deliberately spaced strings (`a l i c e @ e x a m p l e . c o m`) are not detected.
-- **Non-US PII by value alone.** The built-in SSN regex requires dashes and the phone pattern is US-centric. AU/NZ identifiers are covered at the value layer: ABN (mod-89 checksum), Medicare (mod-10 checksum), formatted TFN and IRD numbers (mod-11, separators required), NZ NHI (alpha-prefix regex), and NZ bank account numbers. Bare/unformatted TFN and IRD strings without separators are not detected by value alone — column-name matching remains the safety net for those. Other non-AU/NZ formats rely solely on column-name matching — extend `pii.column_names` or `pii.patterns` for your region.
+- **Non-US PII by value alone.** The built-in SSN regex requires dashes. AU/NZ phone numbers are caught by value — mobile (`04XX`/`02X` local, `+61 4XX`/`+64 2X` international) and landline (`0[2378]`/`0[34679]` local, `+61 [2378]`/`+64 [34679]` international) — including the common `+610`/`+640` stray-leading-zero variant and arbitrary whitespace in the number. International-prefix numbers (`+61`/`+64`) auto-redact regardless of column name; local-format numbers require a PII-named column. Other AU/NZ identifiers are also covered at the value layer: ABN (mod-89 checksum), Medicare (mod-10 checksum), formatted TFN and IRD numbers (mod-11, separators required), NZ NHI (alpha-prefix regex), and NZ bank account numbers. Bare/unformatted TFN and IRD strings without separators are not detected by value alone — column-name matching remains the safety net for those. Other non-AU/NZ formats rely solely on column-name matching — extend `pii.column_names` or `pii.patterns` for your region.
 - **PII already in the model's context** from prior turns, system prompts, file reads, or earlier summarisation. Gate filters what goes *into* the model from configured tools; what's already there stays there.
 - **Tool-side network exfiltration.** If a configured tool sends data to an external service directly (rather than returning it via stdout), gate never sees it.
 - **Write operations.** `INSERT`, `UPDATE`, `DELETE` are not inspected or blocked.

crates/common/src/patterns.rs

@@ -95,15 +95,55 @@ pub const BUILTIN_PATTERNS: &[BuiltinPattern] = &[
         confidence: 0.85,
     },
     BuiltinPattern {
-        // AU mobile: 04XX XXX XXX / +61 4XX XXX XXX
+        // AU mobile international: +61 4XX XXX XXX / +610 4XX... (stray leading zero after CC)
+        // +61 is unambiguous — high confidence even without a PII column name.
         name: "phone",
-        regex: r"\b(?:\+61[\s-]?|0)4\d{2}[\s-]?\d{3}[\s-]?\d{3}\b",
+        regex: r"\+61[\s-]?0?4\d{2}[\s-]?\d{3}[\s-]?\d{3}\b",
+        confidence: 0.85,
+    },
+    BuiltinPattern {
+        // AU landline international: +61 [2378] XXXX XXXX / +610 [2378]...
+        // area codes: 2=NSW/ACT, 3=VIC/TAS, 7=QLD, 8=WA/SA/NT.
+        name: "phone",
+        regex: r"\+61[\s-]?0?[2378][\s-]?\d{4}[\s-]?\d{4}\b",
+        confidence: 0.85,
+    },
+    BuiltinPattern {
+        // AU mobile local: 04XX XXX XXX — ambiguous without key context (low confidence).
+        name: "phone",
+        regex: r"\b04\d{2}[\s-]?\d{3}[\s-]?\d{3}\b",
+        confidence: 0.70,
+    },
+    BuiltinPattern {
+        // AU landline local: 0[2378] XXXX XXXX — ambiguous without key context.
+        name: "phone",
+        regex: r"\b0[2378][\s-]?\d{4}[\s-]?\d{4}\b",
+        confidence: 0.70,
+    },
+    BuiltinPattern {
+        // NZ mobile international: +64 2X XXX XXXX(X) / +640 2X... (stray leading zero after CC)
+        // +64 is unambiguous — high confidence even without a PII column name.
+        name: "phone",
+        regex: r"\+64[\s-]?0?2\d[\s-]?\d{3}[\s-]?\d{4,5}\b",
+        confidence: 0.85,
+    },
+    BuiltinPattern {
+        // NZ landline international: +64 [34679] XXX XXXX / +640 [34679]...
+        // area codes: 3=South Island, 4=Wellington, 6=Taranaki/Hawke's Bay, 7=Waikato, 9=Auckland.
+        name: "phone",
+        regex: r"\+64[\s-]?0?[34679][\s-]?\d{3}[\s-]?\d{4}\b",
+        confidence: 0.85,
+    },
+    BuiltinPattern {
+        // NZ mobile local: 02X XXX XXXX(X) — ambiguous without key context (low confidence).
+        name: "phone",
+        regex: r"\b02\d[\s-]?\d{3}[\s-]?\d{4,5}\b",
         confidence: 0.70,
     },
     BuiltinPattern {
-        // NZ mobile: 02X XXX XXXX(X) / +64 2X XXX XXXX(X)
+        // NZ landline local: 0[34679] XXX XXXX — ambiguous without key context.
         name: "phone",
-        regex: r"\b(?:\+64[\s-]?|0)2\d[\s-]?\d{3}[\s-]?\d{4,5}\b",
+        regex: r"\b0[34679][\s-]?\d{3}[\s-]?\d{4}\b",
         confidence: 0.70,
     },
     BuiltinPattern {
@@ -133,6 +173,9 @@ const TOKEN_SYNONYMS: &[(&str, &str)] = &[
     ("mobile", "phone"),
     ("tel", "phone"),
     ("fax", "phone"),
+    ("phnumber", "phone"),   // ph_number / phnumber
+    ("cellnumber", "phone"), // cell_number
+    ("cell", "phone"),
     // ── SSN ───────────────────────────────────────────────────────────────────
     ("ssn", "ssn"),
     ("socialsecuritynumber", "ssn"), // trigram: social_security_number
@@ -784,7 +827,7 @@ mod tests {
         ] {
             assert!(names.contains(expected), "missing builtin: {}", expected);
         }
-        assert_eq!(patterns.len(), 10);
+        assert_eq!(patterns.len(), 16);
     }
 
     #[test]
@@ -900,6 +943,76 @@ mod tests {
         }
     }
 
+    fn any_phone_matches(s: &str) -> bool {
+        CompiledPattern::from_builtins()
+            .into_iter()
+            .filter(|p| p.name == "phone")
+            .any(|p| p.regex.is_match(s))
+    }
+
+    #[test]
+    fn nz_mobile_variants_all_match() {
+        for num in &[
+            "0220831619",      // local format compact
+            "022 083 1619",    // local format spaced
+            "+64220831619",    // E.164 proper
+            "+64 22 083 1619", // E.164 spaced
+            "+640220831619",   // stray leading zero after CC (common mistake)
+        ] {
+            assert!(any_phone_matches(num), "expected NZ phone match: {}", num);
+        }
+    }
+
+    #[test]
+    fn au_mobile_variants_all_match() {
+        for num in &[
+            "0412345678",      // local compact
+            "0412 345 678",    // local spaced
+            "+61412345678",    // E.164 proper
+            "+61 412 345 678", // E.164 spaced
+            "+610412345678",   // stray leading zero
+        ] {
+            assert!(any_phone_matches(num), "expected AU phone match: {}", num);
+        }
+    }
+
+    #[test]
+    fn au_landline_variants_all_match() {
+        for num in &[
+            "+61291711868",    // NSW international compact
+            "+61 2 9171 1868", // NSW international spaced
+            "0291711868",      // NSW local compact
+            "02 9171 1868",    // NSW local spaced
+            "+61391711868",    // VIC international
+            "+61791711868",    // QLD international
+            "+61891711868",    // WA international
+        ] {
+            assert!(
+                any_phone_matches(num),
+                "expected AU landline match: {}",
+                num
+            );
+        }
+    }
+
+    #[test]
+    fn nz_landline_variants_all_match() {
+        for num in &[
+            "+6493092677",    // Auckland international compact
+            "+64 9 309 2677", // Auckland international spaced
+            "093092677",      // Auckland local compact
+            "09 309 2677",    // Auckland local spaced
+            "+6443092677",    // Wellington international
+            "+6433092677",    // South Island international
+        ] {
+            assert!(
+                any_phone_matches(num),
+                "expected NZ landline match: {}",
+                num
+            );
+        }
+    }
+
     // --- Credit card regex ---
 
     #[test]
@@ -1014,6 +1127,9 @@ mod tests {
     fn classify_underscore_separated() {
         assert_eq!(classify_column("email_address"), Some("email"));
         assert_eq!(classify_column("phone_number"), Some("phone"));
+        assert_eq!(classify_column("ph_number"), Some("phone"));
+        assert_eq!(classify_column("phnumber"), Some("phone"));
+        assert_eq!(classify_column("cell_number"), Some("phone"));
         assert_eq!(classify_column("first_name"), Some("name"));
         assert_eq!(classify_column("last_name"), Some("name"));
         assert_eq!(classify_column("full_name"), Some("name"));

crates/common/src/redactor.rs

@@ -571,11 +571,15 @@ fn scan_string(
 
     // 6. Regex pattern scan. column_name_boost is not applied here: any column
     //    whose name matched the denylist was already handled in steps 1–3.
+    // Match against a whitespace-stripped copy so that formatting variants like
+    // "+ 64 022 083 1619" or "+6 40220831619" collapse to a canonical form.
+    // The original `s` is still used for redaction output and all other steps.
+    let s_compact = s.replace(|c: char| c.is_ascii_whitespace(), "");
     // Short-circuit on the first match whose confidence already clears the threshold —
     // no need to continue scanning once we know we'll redact.
     let mut best: Option<(&str, f32)> = None;
     for p in patterns {
-        if p.regex.is_match(&s) {
+        if p.regex.is_match(&s_compact) {
             let score = p.confidence;
             if score >= config.confidence_threshold {
                 if vb {
@@ -942,6 +946,67 @@ mod tests {
         assert_eq!(out["mail"], "[PII:email]");
     }
 
+    #[test]
+    fn phnumber_key_with_nz_phone_is_redacted() {
+        // "phnumber" is a common abbreviated key; the NZ mobile value alone scores 0.70
+        // (below the 0.80 threshold), but the key synonym must force-redact it.
+        let input = json!({"name": "gary", "phnumber": "0220831619"});
+        let out = redact(input, &plan(), &cfg());
+        assert_eq!(out["phnumber"], "[PII:phone]");
+        assert_eq!(out["name"], "gary");
+    }
+
+    #[test]
+    fn nz_international_prefix_redacted_in_generic_column() {
+        // +64 is unambiguous (NZ country code) — value-layer confidence 0.85 clears the
+        // default 0.80 threshold, so redaction must happen even with a non-PII key name.
+        let input = json!({"name": "gary", "mber": "+64220831619"});
+        let out = redact(input, &plan(), &cfg());
+        assert_eq!(out["mber"], "[PII:phone]");
+        assert_eq!(out["name"], "gary");
+    }
+
+    #[test]
+    fn au_international_prefix_redacted_in_generic_column() {
+        let input = json!({"ref": "+61412345678"});
+        let out = redact(input, &plan(), &cfg());
+        assert_eq!(out["ref"], "[PII:phone]");
+    }
+
+    #[test]
+    fn au_landline_international_redacted_in_generic_column() {
+        // +61 2 9171 1868 is an AU landline (Sydney); +61 is unambiguous so value-layer
+        // confidence 0.85 clears the threshold even with a non-PII key like "mber".
+        let input = json!({"name": "gary", "mber": "+61291711868"});
+        let out = redact(input, &plan(), &cfg());
+        assert_eq!(out["mber"], "[PII:phone]");
+        assert_eq!(out["name"], "gary");
+    }
+
+    #[test]
+    fn nz_landline_international_redacted_in_generic_column() {
+        // +64 9 309 2677 is a NZ landline (Auckland); +64 is unambiguous.
+        let input = json!({"name": "gary", "mber": "+6493092677"});
+        let out = redact(input, &plan(), &cfg());
+        assert_eq!(out["mber"], "[PII:phone]");
+        assert_eq!(out["name"], "gary");
+    }
+
+    #[test]
+    fn spaced_international_prefix_caught_via_compaction() {
+        // Whitespace is stripped before regex matching, so "+" followed by spaces
+        // and digits in any position still resolves to the canonical form.
+        for val in &[
+            "+ 640220831619", // space after +
+            "+6 40220831619", // space mid-CC
+            "+64 0220831619", // space after CC
+        ] {
+            let input = json!({"mber": val});
+            let out = redact(input, &plan(), &cfg());
+            assert_eq!(out["mber"], "[PII:phone]", "expected redaction for {}", val);
+        }
+    }
+
     #[test]
     fn non_pii_name_token_not_triggered() {
         // "product_name" must not be redacted — bigram "productname" is not in synonyms.

docs/configuration.md

@@ -17,7 +17,7 @@ Config lives at `~/.config/gate/config.yaml` (override with `GATE_CONFIG`).
 | **Names** | `first_name`, `last_name`, `full_name`, `given_name`, `family_name`, `surname`, `preferred_name`, `middle_name`, `maiden_name`, `salutation`; `<entity>_name` where entity is one of: contact, customer, client, employee, patient, member, owner, recipient, sender, spouse, parent, guardian, manager, sibling, children |
 | **Demographics** | `gender`, `sex`, `nationality`, `citizenship` |
 | **Government IDs** | `passport`, `license` / `licence` / `driver_license_number` / `driver_licence_number`, `ssn` / `social_security_number`, `national_id`, `tax_number` / `tax_id` / `tax_file_number` / `ird_number` / `tfn`, `abn`, `visa_number`, `resident_id`, `immigration_id` |
-| **Contact** | `email` / `email_address` / `mail`, `phone` / `phone_number` / `mobile`, `fax` |
+| **Contact** | `email` / `email_address` / `mail`, `phone` / `phone_number` / `mobile` / `cell` / `cell_number` / `ph_number` / `phnumber`, `fax` |
 | **Date of birth** | `dob`, `birth`, `birthday`, `date_of_birth`, `birth_date`, `dateOfBirth` |
 | **Location of birth** | `birth_country`, `birth_place`, `birth_city`, `country_of_birth`, `place_of_birth`, `city_of_birth`, `state_of_birth` |
 | **Address & location** | `address` / `addr`, `street`, `postcode`, `zip`, `latitude`, `longitude`, `gps`, `coordinates` |