Edictum Enterprise Implementation

Read CLAUDE.md first. Understand the tier boundary before writing code.

Scope

Everything under ee/ is enterprise (proprietary license). This includes:

• PII detection (ee/pii/) — RegexPIIDetector, PresidioPIIDetector, CompositePIIDetector
• Audit sinks (ee/sinks/) — Webhook, Splunk HEC, Datadog
• Server (ee/server/) — Central policy server, hot-reload, dashboard
• Auth (ee/auth/) — JWT/OIDC verification, SSO
• Sequences (ee/sequences/) — Sequence-aware contracts
• NL authoring (ee/nl_authoring/) — Natural language -> YAML generation

The ONE RULE

ee/ imports from core freely. Core NEVER imports from ee/.

All ee/ features implement protocols defined in core:

• PII detectors implement PIIDetector from src/edictum/pii.py
• Audit sinks implement AuditSink from src/edictum/audit.py

Workflow

1. Read CLAUDE.md — understand boundaries, what's in core vs ee/
2. Check if the protocol exists in core — if not, create it in core first (that's an edictum-oss task)
3. Read the Linear ticket or user description
4. Scope with user — confirm approach before writing code
5. Implement in ee/ — follow core conventions
6. Test — ee/ tests live alongside the ee/ code or in tests/test_ee/
7. Commit — conventional commits, no Co-Authored-By

What's in core vs ee/

ee/ Directory Structure

ee/
├── LICENSE           (proprietary, separate from root MIT)
├── pii/
│   ├── regex.py      RegexPIIDetector
│   ├── presidio.py   PresidioPIIDetector
│   └── composite.py  CompositePIIDetector
├── sinks/
│   ├── webhook.py    WebhookAuditSink
│   ├── splunk.py     SplunkHECSink
│   └── datadog.py    DatadogSink
├── server/           (Phase 4)
├── auth/             (Phase 4)
├── sequences/
└── nl_authoring/

Do NOT

• Modify core code to import from ee/
• Put ee/ implementations in src/edictum/
• Implement dropped features (Redis/DB StorageBackend, reset_session)