AshArcadic.Replicant.Verifiers.ValidatePrimaryKeyNotSensitive (AshArcadic v0.2.0)

Compile-verifier for a replicant CDC mirror target's primary key (build-blocking under --warnings-as-errors).

The mirror's primary key is the identity the sink MATCHes on (upsert_identity for idempotent re-delivery, and the by-PK destroy). The sink builds it from the SOURCE (Postgres) row's plaintext key columns (Resolver.pk_values/2), which — unlike writable_target/attrs_for_upsert — do NOT pass through the F5 sensitive-halt guard, because the identity must be a plaintext value to match.

So a primary-key attribute declared arcade do sensitive ... end is contradictory and unsafe: AshArcadic holds no key material, so the sink would write the source's PLAINTEXT key into a column the classification says must hold encrypted bytes — leaking the classified datum AND breaking idempotent matching (an encrypted-at-rest identity can never equal a plaintext lookup). This verifier rejects it at compile, fail-closed, mirroring ValidateSensitive's R3 rule that the multitenancy discriminator (also a plaintext selector) cannot be sensitive.

The remedy is to model the mirror identity as a non-sensitive key (the source PK is already a plaintext natural/surrogate key upstream).