Description
PR #735 demoted one DNS change log and removed an IP from with_timeout, but PR #733 P2.14 remains partially reachable: DNSResolver.resolve_hostname still gives AsyncRetry an operation string containing the IP, and client collection DEBUG logs include client IDs and MACs not fully enumerated by docs/privacy.md. Audit INFO/WARNING/ERROR paths for client IP, ID, MAC, hostname, and descriptions; make non-debug operations non-identifying; and state the intentional DEBUG surface precisely.
Acceptance Criteria
- #1 INFO, WARNING, and ERROR logs never contain client IP, ID, MAC, hostname, or description values
- #2 Timeout and retry messages use stable non-identifying operation names
- #3 Any identifier values intentionally retained at DEBUG are listed in docs/privacy.md
- #4 Tests capture representative logger events rather than checking source strings only
Definition of Done
- #1 make check (uv run ruff check . && uv run ruff format –check . && uv run mypy . && uv run pytest -v)
- #2 make docgen, when metrics, config, endpoints or collectors changed — CI fails the build on generated-docs drift
- #3 Grafana queries in grafana/dashboards/*.json and grafana/alerts/ updated, if a metric or label name changed
Implementation Plan
Wave 1 L5: audit and correct client identifier logging together with MDE-0020 under one DNS/client file owner; root integrates and finalizes.
Final Summary
Implemented and verified in 7327153. High-severity client logs avoid identifiers and the DEBUG boundary is documented; full gates passed.