The code has always expected classification/m365_skus.json and
classification/google_ou_roles.json (present since the initial commit
in m365_connector.py, google_connector.py, and build_gdpr.py's own
skus_dir variable) - but the actual data files lived in skus/ under a
different name (education.json) or just the wrong directory. Both
loaders degrade to a fallback on failure, so this was never fatal, but
it meant:
- M365 SKU-based role classification silently ran on fragment-matching
only, never touching the real 13 student + 11 staff SKU list.
- Google Workspace OU-based role classification silently used a
hardcoded 4-prefix fallback missing real categories the actual
config has - /Elev, /Pupils (student), /Teachers, /Admin (staff).
_load_ou_roles() had a bare `except Exception: return <fallback>`
with no logging at all, so this had zero visibility anywhere.
Fix: moved both files to classification/ (git mv, so history is
preserved), updated .gitignore's exception rule from !skus/*.json to
!classification/*.json, fixed the stale "skus/google_ou_roles.json"
docstring, and added a module logger + proper warning/error logging to
_load_ou_roles() matching the pattern _load_sku_data() already used -
so if this class of bug recurs, it won't be silent again.
Verified: both loaders now log successful loads with the real counts
(13+11 SKUs, 4+6 OU prefixes including the previously-missing
categories), all 227 tests still pass, and a full app boot confirms
the startup warning is gone and the app still serves normally.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
