Hide hardware serial numbers from public surfaces

[Gajesh2007]

Summary

Removes hardware serial numbers, UDIDs, and raw identity-bearing MDA certificates from public APIs, headers, URLs, UIs, documentation, enrollment, and support reports.

Coordinator/provider internals retain device identity only where required for attestation, MDM checks, and machine lifecycle. Public operations now use opaque IDs and privacy-redacted trust status.

Before

flowchart LR
  subgraph Behavior
    A1[Consumer or browser] --> B1[Public APIs and headers]
    B1 --> C1[Serials, UDIDs, raw MDA chain]
    D1[Enrollment and reports] --> E1[Serial in body, filename, URL, and lookup]
  end
  subgraph Code
    F1[Internal provider records] --> G1[Directly serialized DTOs]
    H1[Doctor] --> I1[Independently loaded key]
    I1 --> J1[Potentially wrong provider match]
  end

Loading

After

flowchart LR
  subgraph Behavior
    A2[Consumer or browser] --> B2[Allowlisted redacted DTOs]
    B2 --> C2[Opaque IDs and trust verdict only]
    D2[Enrollment and reports] --> E2[Identity-free profile and opaque report ID]
  end
  subgraph Code
    F2[Private coordinator identity] --> G2[MDM, attestation, and dedup only]
    H2[Active ProviderLoop signer] --> I2[PID and start-time-bound daemon state]
    I2 --> J2[Doctor matches exact public key without keychain mutation]
  end

Loading

Test plan

• cd coordinator && go test ./...
• Live PostgreSQL migration test verifies historical scrubbing and future-write protection
• cd console-ui && npm test && npx eslint src/ && npm run build
• cd admin-ui && npm test && npm run lint && npm run build
• Swift 6.3 parses all changed provider sources and regression tests
• bash -n scripts/install.sh coordinator/api/install.sh
• scripts/sync-install-embed.sh check
• Two independent final reviews passed

Components touched

• coordinator
• provider-swift
• console-ui
• admin-ui
• documentation

Protocol and interface changes

• Public provider deletion now uses opaque provider IDs.
• Public attestation responses expose only privacy-redacted status.
• Enrollment requests and profiles contain no hardware identity.
• Support uploads return opaque report IDs.
• Legacy ?serial= report uploads return HTTP 426.
• Consumer-provided serial routing constraints are removed.

Notes for reviewers

• The log-report migration installs its write guard before scrubbing historical rows, preventing concurrent writes from reintroducing serial metadata.
• Doctor uses the running daemon’s exact signer identity and validates PID plus process start time.
• Already-published Git history requires a separate owner-authorized history rewrite; this PR removes identifiers from the current tree without force-rewriting shared history.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
d-inference	Ready	Preview	Aug 25, 2026 7:32pm
d-inference-console-ui-dev	Ready	Preview	Aug 25, 2026 7:32pm
d-inference-landing	Ready	Preview	Aug 25, 2026 7:32pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99fcb69626

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".