Identifier sources and license boundaries — 0.2.0 release

This page describes the identifiers-only release's implemented subset. Official documentation provides context, not government endorsement or proof that an identifier was issued. The detector runs locally without issuer lookups; issuer_verified remains false. Recognized failed or unverified candidates still undergo the selected redaction mode.

Eight national identifier types

Output type	Official source	Implemented subset and limits
`AR_CUIT` (CUIT/CUIL)	AFIP published validator	Eleven-digit modulus-11 arithmetic for prefixes 20/23/24/27/30/33/34. A remainder-one body cannot accept a decimal check digit. Other prefixes are not validated; no issuance, prefix reassignment or gender inference.
`AR_DNI`	RENAPER	Seven/eight-digit candidate heuristic. The agency reference is context, not evidence for a universal checksum; none is claimed.
`CL_RUT` (RUT/RUN)	SII published validator	Modulus-11 arithmetic for seven/eight-digit bodies with K/0 handling. No issuer registration check or exhaustive historical-format claim.
`CO_CEDULA`	Registraduría Circular Única, version 9	Six-to-ten-digit candidate heuristic. No universal checksum or exhaustive document-format validation is claimed.
`CO_NIT`	DIAN Administrative Order 4/1989, Annex 3	Arithmetic for a nine-digit body only. This historical source supplies arithmetic context, not a determination of current legal applicability. Other lengths remain unverified.
`DO_CEDULA`	JCE certification requirements	Eleven-digit candidate structure. This service reference does not establish checksum arithmetic, historical exceptions or new-format equivalence; checksum remains unknown.
`MX_CURP`	SEGOB assignment instruction	Implemented 18-character structure/date/state/century checks, not complete assignment verification. The reviewed instructions do not establish the numeric algorithm implemented here: checksum remains unknown.
`MX_RFC`	SAT generic-RFC guidance	Twelve/thirteen-character candidates with partial arithmetic only; remainders 1/10 and documented generic RFCs remain unknown. The official generic guidance does not authenticate the arithmetic transcription described below. No homoclave assignment or issuer lookup.

RFC arithmetic research also consulted a third-party-hosted transcription of a SAT response. It is not an official hosting source; its provenance and ambiguous branches limit the checksum claim. The implementation deliberately reports unknown for those branches rather than inventing a result. Source pages may change; these links do not promise continued availability or complete current statutory coverage.

No government validator source or identity records are bundled. Arithmetic is implemented independently; source links are review references. syntax_valid covers only implemented checks. valid_checksum is true/false where arithmetic is supported and null when unknown, not applicable or unverified. Even a true result does not establish authenticity, ownership or compliance.

Email and protective emissions

EMAIL detects email-address syntax, without delivery or ownership verification. AMBIGUOUS_ID protects recognized cédula candidates when country attribution is unresolved. It is not a ninth national identifier scheme. Documented generic RFCs retain the RFC type and unknown personal-checksum status. GENERIC_ID is not emitted by the current identifiers implementation and is not current supported detection coverage. All actual emitted spans, including EMAIL and AMBIGUOUS_ID, remain in evaluation; no type is excluded to improve metrics.

Application and base-image licenses

The identifier application is distributed under Apache License 2.0, with its application license retained in the container. It uses the Python standard library without added application Python packages. This is an application boundary, not a claim that the entire container is Apache-licensed or contains no third-party packages.

The candidate base is CPython 3.12.16 on Alpine 3.23. CPython's license and incorporated-software notices apply independently. Alpine Linux includes musl, BusyBox and other OS packages under their individual licenses; retained APK metadata identifies installed packages. Operating-system licenses are not reclassified as application licenses.

The official Python base also includes pip and its vendored components. Pip's top-level distribution metadata alone is not a complete inventory of those components. Its retained pip/_vendor/vendor.txt and accompanying notices identify the vendored package boundary; the upstream vendoring policy requires individual license files. Exact-image review must cover installed Python distributions, vendored notices, CPython and APK inventory together. No blanket permissive-only or legal-approval conclusion follows from the application license.

See the model card for evidence and pending release gates, and usage for privacy, modes, supported hints and limits. This page does not authorize deployment or certify regulatory compliance.