Repository navigation
M9.6 telemetry: consent from the ledger, journeys by record, live verify - #83
Merged
Merged
Conversation
Consent and revoke are human rows in the committed ledger, so a fresh checkout keeps them and a broken ledger blocks. Active journeys come from journeys.lifecycle, never the status field, and the reserved event names are never fewer than journeys refuses. `telemetry verify` sends one probe through the real Measurement Protocol endpoint and waits for it in the stream's realtime report, the only proof of a live setup. ALADDIN_GA_QUOTA_PROJECT sends x-goog-user-project. 14 checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV
The newest consent or revoke by time decides, since a union merge can append a branch's older row last; a ledger that fails its own check decides nothing, so a lost revoke never brings usage back. Telemetry binds the journeys the records pin (frozen or a recorded replacement, not retired) and blocks one changed since. Event names match whole and reserved prefixes in any case; the probe event is ours alone. The users report never counts the probe's client. verify sends a session id, stops when consent or setup changes mid-wait, caps its wait, and a new MP secret clears the last verification. 15 checks; 13 mutants killed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV
…-9jviy9 # Conflicts: # plugin/bin/_mission.py
#78 reads replacements from the journey.retired record's data, so the test's hand-made retirement records journey_id, replaced_by and its sha256. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Ro7iYo3scQt6vAuAWdYpV
adeelahmad
marked this pull request as ready for review
October 20, 2026 04:06
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
… the human's line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018RxETAY6S1gcmdctBK8a8Z
adeelahmad
pushed a commit
that referenced
this pull request
Oct 20, 2026
Docs only: ROADMAP takes master's M9.8 and M9.20–M9.25 rows beside this track's M9.9, M9.26 and M9.27; TRACKING marks both M9.8 and M9.9 implemented. make ci (conformance 78/78) passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0197nSutKR1QAAqgJhFZ8fPj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Before: telemetry (#71) read consent and revoke from the git-ignored run log, so a fresh checkout lost them. It took "active" journeys from their hand-editable
statusfield, and nothing could prove a live GA setup, because the Measurement Protocol answers 2xx to dropped hits and its validator checks no secret.After: consent and revoke are human rows in the committed ledger (#77), and the journeys telemetry binds are the ones the records pin.
aloop mission telemetry verifysends one probe through the real Measurement Protocol and waits for it in the stream's realtime report, which is the proof M9.14 needs.How:
consentisM.approve.revokeisM.record_human, which needs the one change outside the M9.6 files:telemetry.revokedjoinsHUMAN_EVENTSin_mission.py. The newest human row for the record, by time, decides; file order doesn't, because amerge=unionmerge can append a branch's older row last. While the ledger fails its own check, nothing is decided, so a lost revoke never brings usage back. Network commands andcheckblock with the recovery command.journeys.pinsandlifecycle. A bound journey that changed after it was pinned blockscheck. Malformed journey files never crash it.journeys.GA4_RESERVED_NAMES(the union of both lists, plussession_start_with_rollout). Prefixes match in any case, and names must match whole (fullmatch).aloop_probeis reserved for the probe.aloop_probewithsession_idandengagement_time_msec(Realtime needs both), and pollsrunRealtimeReportscoped to the stream until the count rises, withinALADDIN_GA_VERIFY_WAIT(0–900 s, default 180). It stops if the consent or setup changes while it waits, and writes nothing back then. A new stream or MP secret clears the last verification.verifynever gatescheck.notExpression eventName == aloop_probe), so verifying never moves the 50-user minimum-sample line.ALADDIN_GA_QUOTA_PROJECTis sent asx-goog-user-projecton Admin and Data calls only, never to the MP host.Evidence:
mission-telemetry.test.pyruns 15 checks against the fake GA, which now has a real/mp/collectthat only a live secret reaches realtime through, plusmp_drop. The checks cover a fresh checkout, an edited ledger row, a union-merge order, a lost revoke, replacement/retired/drifted/malformed journeys, a revoke mid-verify, wait bounds, and the secret and stream resets.make cipasses locally, conformance included (78/78).Not changed: setup never deletes GA key events that no journey needs any more. They may be the owner's own.
Generated by Claude Code