fix: HRMS, PII masking, and localization bugs (Bomet deployment)

[ChakshuGautam]

Summary

• Kong MDMS v1 route: DIGIT UI HRMS calls /egov-mdms-service/* — Kong had no route for this path, all v1 MDMS calls returned 404
• TenantBoundary boundary.code: Root boundary code must match tenant code (e.g., ke.bomet), not boundary name — HRMS jurisdiction validation requires this (ERR_HRMS_INVALID_JURISDICTION_HEIRARCHY)
• SecurityPolicy PGR roles: PGR roles (GRO, PGR_LME, EMPLOYEE, etc.) were missing from encryption decryption policy — employee names appeared masked as B*XXXXXXXXX on Assign Complaint
• Boundary type localizations: HRMS/PGR UI showed raw keys like ADMIN_SUBCOUNTY, EGOV_LOCATION_BOUNDARYTYPE_COUNTY — localization messages must be seeded for each boundary hierarchy level
• Boundary code localizations: UI showed raw boundary codes (BOMET_CHEPALUNGU) instead of human names — localization must be seeded for each boundary code
• ServiceDefs localization fix: Code prefix was SERVICEDFS. (typo) instead of SERVICEDEFS_, and module was rainmaker-pgr instead of rainmaker-common

Type of Change

• Core (Reusable) — Fixes that affect any deployment

Files Changed

• local-setup/kong/kong.yml — Add MDMS v1 compat route
• local-setup/jupyter/dataloader/crs_loader.py — Fix TenantBoundary root boundary.code + add boundary localization seeding + simplify bootstrap
• local-setup/db/mdms-security-seed.sql — Add PGR roles to encryption SecurityPolicy
• local-setup/scripts/ci-dataloader-xlsx.py — Add boundary code localization seeding (step 9)
• local-setup/jupyter/dataloader/unified_loader.py — Fix ServiceDefs localization code generation
• local-setup/docker-compose.registry.yml — Update boundary-service image, add Kong Lua sandbox config

Platform Impact

• Kong: Standard route addition, no behavioral change to existing routes
• MDMS: Seed data fix — only affects new deployments (existing deployments need manual fix)
• Localization: Additive — new messages, no existing messages modified

Test plan

• Validate YAML/SQL/Python syntax (done locally, all pass)
• Run ci-dataloader-xlsx.py with Bomet county data on egov-digit
• Verify HRMS Create Employee works (no jurisdiction error)
• Verify PGR Assign shows unmasked employee names
• Verify boundary dropdowns show human-readable labels

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e99a4533-9942-426a-82eb-a699ef3bd401

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bomet-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}