sanitization: sync intl-phone detector + messaging-identifier example

sanitize.config.json

@@ -21,7 +21,8 @@
       "a specific dataset accession ID, file path, or repository tied to one private/in-progress study (e.g. an embargoed OpenNeuro dataset)",
       "names of collaborators, PIs, reviewers, or institutions tied to one active engagement (not public co-author lists)",
       "grant numbers, IRB/ethics protocol numbers, or funding details specific to one engagement",
-      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)"
+      "a codename or label that identifies one particular study (e.g. used as a skill name or heading)",
+      "a messaging or account identifier tied to a real person — a Signal/Telegram UUID, a contact phone, an allowlisted user ID (these belong in deployment config/secrets, never in the package)"
     ],
     "do_not_flag_examples": [
       "generic methodology (\"how to verify a citation\", \"how to grade a source\")",

scripts/check_sanitization.py

@@ -59,6 +59,9 @@ def load_config(root="."):
     ("private-key-block", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----")),
     ("email", re.compile(r"\b[A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,}\b")),
     ("us-phone", re.compile(r"(?<!\d)(?:\+?1[\s.\-]?)?\(?\d{3}\)?[\s.\-]\d{3}[\s.\-]\d{4}(?!\d)")),
+    # E.164 international (e.g. a contact wired into config/SOUL): "+" + 7–15 digits,
+    # no separators. The us-phone pattern only covers North-American formatting.
+    ("intl-phone", re.compile(r"(?<!\d)\+\d{7,15}(?!\d)")),
     ("ipv4", re.compile(r"(?<!\d)(?:\d{1,3}\.){3}\d{1,3}(?!\d)")),
 ]
 

tests/test_check_sanitization.py

@@ -31,6 +31,14 @@ def test_detects_ipv4_but_allows_loopback():
     assert not any(l == "ipv4" for l, _ in cs.scan_deterministic("bind 127.0.0.1", ["127.0.0.1"]))
 
 
+def test_detects_international_phone():
+    # E.164 form with no separators — the us-phone pattern misses these entirely.
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("contact +442079460958 anytime", []))
+    assert any(l == "intl-phone" for l, _ in cs.scan_deterministic("MATILDE_CONTACT=+4915123456789", []))
+    # Not a phone: a short +N token (version, diff count) must not trip it.
+    assert not any(l == "intl-phone" for l, _ in cs.scan_deterministic("rebased +1234 ahead", []))
+
+
 def test_generic_methodology_is_clean():
     assert cs.scan_deterministic("Structure a handoff: decisions, threads, next step.", []) == []