Privacy-safe logging for Phoenix channel joins and incoming events.

This opt-in telemetry handler replaces the channel portion of Phoenix's default logger after config :phoenix, :logger, false disables it. Raw topics and event names are never logged. Applications declare safe topic patterns and event names at startup; unmatched values are rendered as filtered labels. Oversized topics are filtered before content validation. Join and incoming-event parameters are omitted by default.

children = [
  {Obscura.Phoenix.ChannelLogger,
   topic_patterns: ["room:*", "system"],
   events: ["new_message", "typing"]}
]

A bounded redacted parameter copy can be enabled independently for joins and incoming events:

{Obscura.Phoenix.ChannelLogger,
 topic_patterns: ["room:*"],
 events: ["new_message"],
 join_params: {:redact, entities: [:email, :phone]},
 handle_in_params: {:redact, entities: [:email, :phone]}}

Applications can opt in to include one validated UUID-valued socket assign as Logger metadata, allowing related channel events to be correlated. Invalid or missing values are omitted:

{Obscura.Phoenix.ChannelLogger,
 topic_patterns: ["room:*"],
 events: ["new_message"],
 correlation: {:socket_assign, :chat_id, :uuid}}

This metadata supports log correlation; it does not create spans, propagate trace context, or provide distributed tracing. Logger-reserved and oversized assign names, plus names containing high-confidence PII recognized by the :fast profile, are rejected at startup.

Phoenix's join telemetry contains the socket from before join/3 runs. Consequently, a correlation assign must already exist before join/3 to appear on the join record. An assign added by join/3 is available to later handled-event records.

Only the dependency-light :fast profile is accepted in this synchronous path. Parameter text above the fixed 4 KiB realtime analysis budget is logged as [FILTERED] without running PII recognition. Structs and tuple-bearing terms, including keyword lists, also fail closed without protocol dispatch. Apart from an explicitly configured correlation assign, the handler never inspects socket assigns, private application data, identifiers, references, or callback results.

Configured topic and event labels containing control or directional formatting codepoints are rejected. Allowed event labels are emitted from owned startup configuration rather than client-frame binaries.