| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(telemetry): accept disclosed default-on usage policy without fabricated consent Add closed schema3/notice_version5 ingest and generated CWC contract. Preserve original v1 first-party-only and v2/consent4 semantics, reject mixed policy fields before storage or forwarding, and retain IP/host/operator/content guards. Existing Analytics Engine column positions remain fixed; schema_version distinguishes old consent from new notice metadata. Document the founder's amended default-on/opt-out policy and preserve prior declines. Rust/app preference changes are integrated separately. Validation: ingest 171 passed, 0 failed across 6 files; TypeScript, facts, 23 documentation topics and git diff checks passed. Original validator rejects the new v3 fixture; current validator accepts v2 and v3. Proposed Rust v3 fixture accepted by ingest; sender proof pending Rust integration. Root npm test && npm run check:web exits1 because no test script exists (0 tests, check:web not reached). No hosted deployment, processor activation or runtime-installed policy change claimed. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 12 天前 | |
Add consent-gated PostHog processing to the canonical telemetry ingest Keep legacy v1 batches first-party only. Add v2 consent-v4 aggregate product and operations contracts with a generated CWC JSON Schema. Reuse native telemetry collectors and Settings persistence, require explicit revised processor acceptance, remove implicit notice acceptance, and expose the same versioned choice to headless users through config telemetry --accept-notice 4. The optional regional capture sink has a 1.5-second timeout, no redirects/SDK/retries, and remains disabled without host, token, and an operator egress prerequisite. Cloudflare may add client IP headers outside JS: staging proof is required before activation and is not established by local mocks. No keys, external configuration, deployment, or live delivery were used. Validation: ingest 164 passed, typecheck passed; telemetry 49 passed; config 636 passed and 1 ignored; TUI telemetry unit 52 passed; TUI subprocess/loopback contract 15 passed; CLI telemetry 5 passed and config-filter 65 passed; all 15 locale packs passed parity (2044 keys); git diff --check passed. A temporary negative regression removing current-consent validation failed 5 selected checks as expected. The prescribed root npm test && npm run check:web gate was attempted but unavailable: root package.json has no test script. Native linking emitted the existing compact-unwind size warning. No hosted CI or live egress proof claimed. | 12 天前 | |
feat(telemetry): accept disclosed default-on usage policy without fabricated consent Add closed schema3/notice_version5 ingest and generated CWC contract. Preserve original v1 first-party-only and v2/consent4 semantics, reject mixed policy fields before storage or forwarding, and retain IP/host/operator/content guards. Existing Analytics Engine column positions remain fixed; schema_version distinguishes old consent from new notice metadata. Document the founder's amended default-on/opt-out policy and preserve prior declines. Rust/app preference changes are integrated separately. Validation: ingest 171 passed, 0 failed across 6 files; TypeScript, facts, 23 documentation topics and git diff checks passed. Original validator rejects the new v3 fixture; current validator accepts v2 and v3. Proposed Rust v3 fixture accepted by ingest; sender proof pending Rust integration. Root npm test && npm run check:web exits1 because no test script exists (0 tests, check:web not reached). No hosted deployment, processor activation or runtime-installed policy change claimed. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 12 天前 | |
telemetry: add the first-party ingest Worker (not deployed) Adds `telemetry-ingest/`, a Cloudflare Worker that accepts the batches `crates/telemetry` produces and writes them to Workers Analytics Engine. Nothing is deployed and no Cloudflare resource was created; the shipped `telemetry_endpoint` default stays unset, `config.example.toml` and `docs/TELEMETRY.md` are untouched. Publishing is a separate, deliberate step. It lives at the top level rather than inside `web/` because the site is a separate deploy with its own Next.js/OpenNext build, and a telemetry change should not rebuild the marketing site. The endpoint is write-only: one POST route, every other method 405, no route that returns data, and a zero-byte body on every status. The client reads only the status class and drops the batch on anything non-2xx, so a rejection here is invisible to the user by construction — which is what lets the endpoint fail closed and refuse anything it cannot account for. Three properties are enforced by tests rather than by intent: `docs/TELEMETRY.md` says "Batches are IP-stripped at ingest. No IP is stored, logged, or joined to install_id." This Worker is the whole of what makes that true. It reads exactly two headers, never touches the request's `cf` property, logs nothing, and turns invocation logs off in the config; the row builder's input type is the validated batch body, so it cannot see the connection at all. `test/no-ip.test.ts` greps the shipped source for the header and geo names and fails the build if one appears, if the set of headers read grows, if a console call is added, or if a Response is ever built with a body. The validator is a closed field set, not a permissive parse: an unexpected key anywhere — envelope, event, counters, errors, turn_wall — rejects the whole batch with 400. A future client bug that starts attaching a path or a prompt is refused rather than quietly stored. `test/schema-doc.test.ts` parses the field names and enum spellings back out of `docs/TELEMETRY.md` and asserts set equality against the validator, and the suite posts `crates/telemetry/tests/golden/v1.json` — the client's own pinned wire form — asserting it is accepted and that deleting any key from it is rejected. Doc, client, and server cannot drift apart silently. The body cap is computed, not guessed: `parse_events` bounds a batch at 200 events and 65536 bytes, plus 199 commas and ~375 bytes of envelope, so 66110 bytes is the conforming worst case and the cap is 72 KiB. The 512-record ring is the disk cap, not the wire cap. Rate limiting is keyed on `install_id` from the validated body, never on an address. Analytics Engine layout is one data point per event, indexed on `install_id`, with the ten counters, six error classes and four turn-wall buckets filling all twenty doubles. The README documents the exact SQL for the two questions this exists to answer — installs and sessions, and which error classes and panic sites dominate — one query each. Verified locally only: 87 vitest tests, `tsc --noEmit`, `wrangler deploy --dry-run`, and `wrangler dev --local` driven with curl (204 on the golden batch, 400 on an unknown key and on an out-of-allowlist panic site, 413 oversized, 405 GET, 415 wrong content type, 404 other path, 429 after 20 POSTs from one install id). `wrangler dev` caught a real defect the dry run did not: the runtime maps every named export of the entrypoint to an entrypoint, so the route constant moved to its own module. | 1 个月前 | |
feat(telemetry): accept disclosed default-on usage policy without fabricated consent Add closed schema3/notice_version5 ingest and generated CWC contract. Preserve original v1 first-party-only and v2/consent4 semantics, reject mixed policy fields before storage or forwarding, and retain IP/host/operator/content guards. Existing Analytics Engine column positions remain fixed; schema_version distinguishes old consent from new notice metadata. Document the founder's amended default-on/opt-out policy and preserve prior declines. Rust/app preference changes are integrated separately. Validation: ingest 171 passed, 0 failed across 6 files; TypeScript, facts, 23 documentation topics and git diff checks passed. Original validator rejects the new v3 fixture; current validator accepts v2 and v3. Proposed Rust v3 fixture accepted by ingest; sender proof pending Rust integration. Root npm test && npm run check:web exits1 because no test script exists (0 tests, check:web not reached). No hosted deployment, processor activation or runtime-installed policy change claimed. Signed-off-by: CodeWhale Bot <bot@codewhale.net> | 12 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 12 天前 | ||
| 12 天前 | ||
| 12 天前 | ||
| 1 个月前 | ||
| 12 天前 |