[abrichr]

openadapt-privacy-scan reported "PHI scan clean" and exited 0 when it hadn't read anything: a missing root, a root that's a file, an empty directory, and directories or files it couldn't open all passed the gate. The scan now exits 2 when it can't run and reports a file it can't read as a finding. This change also removes pip>=25.3 from the runtime dependencies, so installing the library no longer upgrades the user's pip.

Fixes

Problem	Change	Regression test	Ref
The PHI scan printed "PHI scan clean (0 files)" and exited 0 when --root was missing, was a file, or was an empty directory. It also skipped directories it couldn't list and files it couldn't open, and still reported clean.	main() exits 2 with "PHI scan error: ... Nothing was scanned." when the root is missing, isn't a directory, or can't be accessed; when a directory under it can't be listed; or when there are no files to scan. A new --allow-empty flag accepts an empty tree. os.walk now raises on an unreadable directory, and a git ls-files permission warning about a path in the tree fails the listing (warnings about an unreadable global ignore file don't). Each listed path is checked with os.stat, so a permission error isn't read as "not a file" on Python 3.14. A file that can't be opened is reported as unreadable (exit 1). iter_scan_files and scan_tree raise OSError for a missing or non-directory root. The README lists exit codes 0, 1, and 2.	tests/test_scan.py: test_cli_missing_root_fails_closed, test_cli_file_root_fails_closed, test_cli_empty_root_fails_closed, test_cli_empty_root_passes_with_allow_empty, test_scan_tree_missing_root_raises, test_cli_unreadable_subdirectory_fails_closed, test_cli_unsearchable_subdirectory_fails_closed, test_cli_root_under_unsearchable_parent_fails_closed, test_cli_unreadable_file_is_a_finding, test_cli_unreadable_global_git_ignore_still_scans	B123
pip>=25.3 was a runtime dependency, so installing openadapt-privacy (or a package that depends on it) upgraded the user's pip. The library never uses pip.	Remove pip>=25.3 from [project].dependencies. The CI job that downloads the spaCy model, which is the only step that needs pip, installs pip>=25.3 itself.	tests/test_packaging.py::test_runtime_and_user_extras_do_not_require_install_tools	B124

Not fixed here

• scan_tree() still returns an empty list for a tree with no files, because callers use it as a plain function, not a gate. The README now says to check iter_scan_files(root) first when an empty tree should fail.
• Other OpenAdapt packages may declare the same pip requirement. They weren't checked in this change.
• Running the scanner on this repository still exits 1, because of two PNG assets and an MRN-shaped test string. That's unchanged.

How it was tested

• Every new scan test except test_cli_unreadable_global_git_ignore_still_scans fails on main, where the scan exits 0, and passes on this branch. That test covers a case main already handles: it makes sure a warning about an unreadable global git ignore file doesn't stop a scan that listed every file.
• test_cli_unsearchable_subdirectory_fails_closed and test_cli_root_under_unsearchable_parent_fails_closed also pass on Python 3.14, where Path.is_file() hides permission errors.
• The packaging test fails on main, where it finds pip>=25.3, and passes on this branch. The built wheel's metadata has no pip requirement.
• Full suite without Presidio: 120 passed and 2 skipped on Python 3.10 and 3.11; 120 passed and 3 skipped on Python 3.12. The scanner and packaging tests pass on Python 3.14.
• ruff check passes on the changed files. The 5 ruff check . errors in scripts/generate_demo_images.py, tests/test_fixtures.py, and tests/test_loaders.py are also on main.
• uv build produces the sdist and wheel, and scripts/check_source_boundary.py --require-dist passes.

Before merging

• Merging this to main runs the release workflow, which publishes openadapt-privacy 1.1.1 to PyPI. Downstream packages stop pulling in pip only after 1.1.1 is published.
• Check every clinic CI job that runs openadapt-privacy-scan. A missing, empty, or inaccessible --root now fails with exit 2 where it used to pass. Add --allow-empty only to a job that's expected to scan an empty tree.

🤖 Generated with Claude Code