[WRONG BRANCH] fix(lab): redact digit-suffixed upstream hosts

[luvs01]

Motivation

• Narrow a sanitizer regression where the weak upstream namespace exemption allowed digit-suffixed final labels (e.g. internal.service1, db.prod1, api.v2) to be treated as namespaces and persisted unredacted, leaking provider-controlled host identifiers.
• Preserve the intended diagnostic exception for the conventional <name>.metric.p<digits> metric form while preventing other digit-suffixed dotted identifiers from escaping redaction.

Description

• Tighten the dotted-namespace predicate by replacing DOTTED_NAMESPACE_RE with a narrower regex that only accepts pure dotted alphabetic namespaces or the explicit *.metric.p<digits> diagnostic form (src/lab/artifacts/sanitize.ts).
• Update the explanatory comment above DOTTED_NAMESPACE_RE to document the narrower exemption and rationale (src/lab/artifacts/sanitize.ts).
• Add regression coverage asserting that upstream internal.service1 unavailable, upstream db.prod1 unavailable, and upstream api.v2 unavailable are redacted to upstream [host] unavailable (tests/lab-evidence-sanitization.test.ts).

Testing

• Ran bun run typecheck, which completed successfully.
• Ran bun run privacy:scan, which completed successfully.
• Ran bun run test -- tests/lab-evidence-sanitization.test.ts, where the sanitizer-boundary tests including the new regressions passed; two unrelated activation tests in that file failed due to pre-existing synthetic live-result receipts not presenting a trusted execution receipt (these failures are not caused by the sanitizer change).
• Started a full bun run test; the run was not driven to a green full-suite result because of unrelated timeouts and fixture-state failures elsewhere in the suite that predate this change.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Improved sanitization of dotted hostnames and namespaces.
  • Numeric hostname labels are now correctly redacted when network context is present.
  • Prevented unrelated digit-suffixed labels from being incorrectly classified as namespaces.

• Tests

  • Added coverage for hostname sanitization involving numeric labels.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change narrows dotted namespace detection in sanitize.ts. It adds tests that verify numeric hostname labels are redacted in network-context messages.

Changes

Hostname Sanitization

Layer / File(s)	Summary
Namespace matching and validation src/lab/artifacts/sanitize.ts, tests/lab-evidence-sanitization.test.ts	DOTTED_NAMESPACE_RE now accepts alphabetic dotted namespaces and the explicit .metric.p<digits> pattern. Tests verify that internal.service1, db.prod1, and api.v2 become [host] in network-context messages.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: lidge-jun, wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: redacting digit-suffixed upstream hosts.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-upstream-host-redaction-issue

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 56ddeb8ac3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle a trailing dot before validating upstream hosts

When a digit-suffixed host ends the diagnostic or uses FQDN root notation, such as upstream api.v2., WEAK_HOST_CONTEXT_RE includes the terminal dot in name; CONTEXTUAL_HOST_TOKEN_RE then rejects the candidate, so this new predicate is never consulted and the raw hostname is persisted. Strip and preserve a terminal punctuation/root dot before applying the predicates, or adjust the capture so the host candidate excludes it, and add this form to the regression test.

AGENTS.md reference: AGENTS.md:L233-L234

Useful? React with 👍 / 👎.