audit-trail-fingerprint-normaliz-cross-tenant-audit-trails-become-fragmented-becaus-24dd355e

THEN Implement a mandatory normalization pipeline that substitutes volatile substrings with stable placeholders (e.g., '<ts>', '<uuid>', '<n>') before hashing. The order of substitution matters: replace percentages before bare numbers and timestamps before generic numbers. This ensures the same logical event produces the same fingerprint across tenants, enabling accurate aggregation.

def normalize_message(message: str) -> str:
    if not message:
        return ""
    text = unicodedata.normalize("NFKC", str(message)).lower().strip()
    text = _RE_ISO_TIMESTAMP.sub("<ts>", text)
    text = _RE_UUID.sub("<uuid>", text)
    text = _RE_HEX_LONG.sub("<hex>", text)
    text = _RE_PERCENT.sub("<pct>", text)
    text = _RE_NUMBER.sub("<n>", text)
    text = _RE_PUNCT_RUN.sub(" ", text)
    text = _RE_WHITESPACE.sub(" ", text).strip()
    return text

def fingerprint(agent_name: str, message: str) -> str:
    h = hashlib.sha256()
    h.update(((agent_name or "").strip().lower()).encode("utf-8"))
    h.update(b"::")
    h.update(normalize_message(message).encode("utf-8"))
    return h.hexdigest()