Repository navigation
Mission layer M9.6: GA4 telemetry (opt-in, informs goals, never a gate) - #71
Merged
Merged
Conversation
mission telemetry init/consent/revoke/auth/setup/debug-hit/report/share/show/check. Consent is a human event on the exact terms; setup goes through the Admin API (property, user-data acknowledgement, web stream, MP secret outside docs/, key events); the debug hit validates journey events; fixed Data API reports read settled data; the minimum-sample rule decides usage's share. Tests run against a local fake of the GA APIs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV
Consent counts only human events and must match the sealed terms; reports and the debug hit are scoped to the recorded stream; redirects are refused so the token never leaves loopback; --help and unknown flags never touch the network; the emit check scans the worker's own worktree; revoke deletes the local secret and names the live tag. Sign-in moves to service-account impersonation (no 7-day refresh). The suite grows to 13 checks against the fake GA. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV
adeelahmad
marked this pull request as ready for review
October 20, 2026 02:49
…-9jviy9 # Conflicts: # docs/ROADMAP.md
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
events emit now refuses telemetry.consent like every approval, so the telemetry test's forged consent is refused and then appended directly; it is still ignored as non-human. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012rsDo9GYzNx8tXucywZHnA
This was referenced Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Before: the mission layer had no way to see real usage; ROADMAP §4.12 listed M9.6 (GA4 telemetry) as open.
After:
aloop mission telemetrydrafts consent terms, records a human's opt-in, sets up Google Analytics 4 through the Admin API, proves the wiring with a validated debug hit, reads fixed Data API reports scoped to its own stream, and says how much of the next goal usage may drive. Usage never gates anything; the check is structural only.How:
init --uri URLwrites a sealed record with the terms (what is measured, why, what agents see, the credential used, Google's verbatim user-data acknowledgement, OAuth scopes).consent --by NAMEis atelemetry.consentevent naming the terms' sha256. Onlyrole=humanevents count (a supervisor-written consent is ignored; full provenance rides M9.17).revokestops agents, deletes the local MP secret, and says plainly that the app's tag keeps sending until it is removed (checknames the files still carrying it). A hand-edited record blocks every command; nothing reseals it silently.--account/--propertypick explicitly; otherwise it finds or creates the property (none or several accounts is the human's call), acknowledges user-data collection, finds or creates the web stream, a Measurement Protocol secret (0600 in.aladdin/state/, never indocs/), and a key event for each active journey's last step. Progress is saved after each step. A lost recorded property asks rather than silently creating a new one.init --forcewith a new uri drops the old stream.ENFORCE_RECOMMENDATIONS. No OAuth token goes to the MP endpoint.streamId: users and journey events over 28 days ending 3 days ago (settled, ≥48h), or realtime as a quick signal. Aggregate dimensions only.latest_share(cwd)(for M9.11) reads only sealed reports for the current record and stream.--helpanywhere and unknown flags never touch the network (64).ALADDIN_GA_BASEaccepts loopback only, no userinfo, no proxy, and redirects are refused so the bearer token never leaves.mission telemetry authprints one-time steps: a service account the owner can impersonate (gcloud auth application-default login --impersonate-service-account), so there is no 7-day refresh-token expiry and no gcloud client scope block. 401, bad scopes, API-off and 403 each ask with the exact fix.Evidence:
scripts/test/mission-telemetry.test.py(13 checks) againstscripts/test/fixtures/fake-ga.py, a threaded loopback fake of the Admin API, Data API and MP validation server (redirect, thresholding, injected MP messages).make test-hosts(includes allmission-*suites),make test,make pycheck,check-tracking.pyandreadme.test.pypass locally.Live run on a real Google account is M9.14 (needs the owner's one sign-in).
🤖 Generated with Claude Code
https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV