From edc975f76e997c93fb6af1afe376a2705baf37a1 Mon Sep 17 00:00:00 2001
From: Juniper Bevensee <juniperbevensee@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:32:01 +1200
Subject: [PATCH] sanitization: sync intl-phone detector + messaging-identifier
 example from template
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Carries the template's gate improvements into the live package: an E.164
intl-phone deterministic detector (us-phone only caught NA formatting) and a
semantic flag example for messaging/user identifiers (Signal/Telegram UUID,
contact phone). Directly relevant — Matilde is about to receive a scientist's
real international contact + Signal UUID, which must never land in the package.

TDD: test_detects_international_phone added; 75 passed / 6 skipped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 sanitize.config.json             | 3 ++-
 scripts/check_sanitization.py    | 3 +++
 tests/test_check_sanitization.py | 8 ++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/sanitize.config.json b/sanitize.config.json
index 580af1b..63c9c4a 100644
--- a/sanitize.config.json
+++ b/sanitize.config.json
@@ -21,7 +21,8 @@
       "a specific dataset accession ID, file path, or repository tied to one private/in-progress study (e.g. an embargoed OpenNeuro dataset)",
       "names of collaborators, PIs, reviewers, or institutions tied to one active engagement (not public co-author lists)",
       "grant numbers, IRB/ethics protocol numbers, or funding details specific to one engagement",
-      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)"
+      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)",
+      "a messaging or account identifier tied to a real person — a Signal/Telegram UUID, a contact phone, an allowlisted user ID (these belong in deployment config/secrets, never in the package)"
     ],
     "do_not_flag_examples": [
       "generic methodology (\"how to verify a citation\", \"how to grade a source\")",
diff --git a/scripts/check_sanitization.py b/scripts/check_sanitization.py
index 55213fc..ab33baa 100644
--- a/scripts/check_sanitization.py
+++ b/scripts/check_sanitization.py
@@ -59,6 +59,9 @@ def load_config(root="."):
     ("private-key-block", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----")),
     ("email", re.compile(r"\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b")),
     ("us-phone", re.compile(r"(?<!\d)(?:\+?1[\s.\-]?)?\(?\d{3}\)?[\s.\-]\d{3}[\s.\-]\d{4}(?!\d)")),
+    # E.164 international (e.g. a contact wired into config/SOUL): "+" + 7–15 digits,
+    # no separators. The us-phone pattern only covers North-American formatting.
+    ("intl-phone", re.compile(r"(?<!\d)\+\d{7,15}(?!\d)")),
     ("ipv4", re.compile(r"(?<!\d)(?:\d{1,3}\.){3}\d{1,3}(?!\d)")),
 ]
 
diff --git a/tests/test_check_sanitization.py b/tests/test_check_sanitization.py
index 60ad929..7562edb 100644
--- a/tests/test_check_sanitization.py
+++ b/tests/test_check_sanitization.py
@@ -31,6 +31,14 @@ def test_detects_ipv4_but_allows_loopback():
     assert not any(l == "ipv4" for l, _ in cs.scan_deterministic("bind 127.0.0.1", ["127.0.0.1"]))
 
 
+def test_detects_international_phone():
+    # E.164 form with no separators — the us-phone pattern misses these entirely.
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("contact +442079460958 anytime", []))
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("MATILDE_CONTACT=+4915123456789", []))
+    # Not a phone: a short +N token (version, diff count) must not trip it.
+    assert not any(l == "intl-phone" for l, _ in cs.scan_deterministic("rebased +1234 ahead", []))
+
+
 def test_generic_methodology_is_clean():
     assert cs.scan_deterministic("Structure a handoff: decisions, threads, next step.", []) == []