Files
ruflo/scripts
randRuFlo 53f95e36e6 feat(funnel): honor opt-outs in the messages fetch, wire opt-in telemetry, fix clone tracker
Operational telemetry (ADR-309, legitimate interest):
- `hooks refresh-funnel` (SessionStart) checked only the RUFLO_FUNNEL env
  kill switch. `ruflo funnel disable`, project config, enterprise policy and
  a declined disclosure all still called funnel.ruv.io every session. It now
  resolves the full funnel precedence and makes no request when disabled.
- The fetch's User-Agent adds the CLI release and OS/CPU family only:
  `ruflo-funnel/messages ruflo/<v> (<platform>; <arch>)`, sanitized to token
  characters. The live endpoint accepts it.
- docs/privacy/funnel-legitimate-interest-assessment.md is the assessment
  ADR-309 requires. ADR-309 links it, and ADR-310's acceptance rule now names
  the one documented default request.

Opt-in telemetry (ADR-302/305):
- `ruflo funnel telemetry on|off|status` is the only way to grant the
  telemetry consent domain. Nothing granted it before, so the event queue
  never left the machine.
- With consent, refresh-funnel flushes queued events once per session.
- `funnel disable` and `telemetry off` revoke consent and delete the ID and
  the local queue.

Clone tracker:
- A failed traffic fetch was recorded as 0 clones (snapshots #15-#18 read 0
  while GitHub reported ~258k in 14 days). The script now exits 1 and writes
  nothing.
- The workflow reads TRAFFIC_TOKEN, falling back to GITHUB_TOKEN, because
  the traffic API needs push access.

Co-Authored-By: RuFlo <ruv@ruv.net>
2026-11-06 11:05:25 -05:00
..
2026-10-20 02:11:26 -04:00
2026-01-04 19:30:59 +00:00