fix(coordinator): warn only about genuine misfilings, once per record

[chalfontchubby]

Opened by Claude on behalf of @chalfontchubby.

Problem

Every debug dump and every publish logged this three times per Octopus meter:

Warn: Coordinator: device_id looks like an identifier in a clear container - pseudonymised

Octopus's device_id is octopus:{mpan}, which trips the 10-digit shape guard. The MPAN is also reported in account_ids and pseudonymised there, so the redaction is doing exactly what it is designed to do. The warning tells the user nothing they can act on.

Change

• Judge hits after the walk. Shape-guard hits are held until the whole catalogue has been walked, then judged against every account identifier in it. A hit wholly explained by one (an identity-derived device_id, a cross-link to it, a numeric echo) is still pseudonymised but no longer warned about.
• Whole-token matching only. A short account id cannot split a longer number's digit run and hide a genuinely misfiled value. A device_id counts as identity-derived only if it embeds one of its own account ids. A number is explained only when its integer part is an identifier. The explained part is replaced by a placeholder rather than removed, so neighbouring digit runs cannot join into something that looks like an identifier.
• Once per record. The remaining genuine misfilings are logged once per process instead of on every redaction. The dedupe key is the message plus a salted pseudonym of the record's device_id, so a second record misfiling the same field is a new leak and still warns. The log line never contains the raw value.

Note on suppressing repeats

Suppressing repeated warnings is deliberate. A warning that repeats every 5-minute publish for a condition that does not change tells the user nothing new after the first time, and it buries the warnings that do. The first occurrence per record is still logged. The behaviour that matters, pseudonymising the value, is unchanged on every path.

Tests

Added to tests/test_coordinator.py; each fails on the code before its commit:

• test_identity_derived_values_do_not_warn
• test_misfiled_identifier_warns_once_per_process
• test_short_or_unrelated_identities_do_not_hide_misfiled_values
• test_warning_is_once_per_record_and_ignores_joined_digit_runs

./run_all --quick passes and pre-commit is clean.

🤖 Generated with Claude Code