Derive cohort grouping labels; do not echo free-form intake keys

A privacy-minimized cohort can still leak caller content through aggregate dictionary keys. If an intake row supplies an unconstrained stratum, copying it into a manifest or count receipt turns an apparently numeric summary into a text exfiltration path. Derive grouping labels from a pinned, validated action taxonomy or enforce a closed vocabulary before aggregation; reject unexpected supplied labels. This protects output shape, but it does not authenticate the upstream human label or make a cohort evaluation-ready.

Applies when: evaluation manifests or receipts aggregate records from partly untrusted intake. Keywords: cohort aggregate receipt stratum free form label privacy allowlist taxonomy