Telemetry up-gating hardening (code portion of #32):
- Context field whitelist: telemetry `context` is filtered to a small set of
non-content diagnostic keys (route/retryable/phase/exit_code/duration_ms/
attempt) before persistence. Unknown keys — including potentially identifying
ones (email, full file path, prompt, raw IP) — are dropped, so a client
regression cannot land arbitrary JSON in the store. Empty/unparseable/no-allowed-key
context is dropped to "".
- Per-field size cap: stack_top and context are truncated to 8KiB after
redaction (backstop against unbounded blobs within batch limits).
- Retention: daily master-only task deletes telemetry rows older than
HEICODE_TELEMETRY_RETENTION_DAYS (default 30; <=0 disables).
HEICODE_TELEMETRY_RETENTION_INTERVAL_HOURS (default 24) sets cadence.
model.DeleteTelemetryEventsBefore(cutoff) + controller.StartTelemetryRetentionTask()
wired into main.go under IsMasterNode.
- GET /api/heicode/config telemetry block now surfaces retention_days for
client/admin transparency.
Tests: whitelist drop/keep, size cap, redaction-within-allowed-key. go build/vet
clean; controller telemetry tests pass.
Affects: Manager only (telemetry ingest + retention). No billing/consume-log
change (telemetry still never bills). Privacy-doc disclosure + production
enable-checklist portions of #32 tracked in heicodeDocs sync (#34) / desktop
client API docs (#35).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
chenchenandClaude Opus 4.8
2e37495133