cohorte 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -3,6 +3,11 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.2.2 — 2026-07-29
+
+- The reference collector moved to its own (private) deployment repo; the public repo keeps
+  the collector API contract in SCHEMA.md §Telemetry. No behavior change for users.
+
 ## 1.2.1 — 2026-07-29
 
 - Telemetry collector URL shipped as the config-template default

package/README.md

@@ -277,7 +277,7 @@ result counts, and a *hash* of the feature id — never repo names, paths, code,
 recorded so you're never re-asked. Withdraw anytime (`telemetry.enabled: false` in
 `~/.claude/cohorte.config.yaml`); erase your history anytime (`/doctor` prints your `install_id`,
 the collector's `DELETE /v1/install/<id>` drops it). Full spec + GDPR details:
-`profile/SCHEMA.md` §Telemetry; reference collector in `telemetry/`.
+`profile/SCHEMA.md` §Telemetry (including the collector API contract).
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"
@@ -16,7 +16,6 @@
     "dashboard/server",
     "dashboard/dist",
     "dashboard/README.md",
-    "telemetry",
     "install.sh",
     "install.ps1",
     "CHANGELOG.md"

package/profile/SCHEMA.md

@@ -348,9 +348,9 @@ work without revealing what is being built.
   the next phase, no restart.
 - **Erasure** — `/doctor` prints your `install_id`; send
   `curl -X DELETE <endpoint-origin>/v1/install/<install_id>` and the collector drops every event
-  for that id (the reference collector in `telemetry/` implements this and stores no IPs).
+  for that id (the deployed collector implements this and stores no IPs).
 - **Access/portability** — events are keyed by your `install_id`; ask the operator for an export.
 
-**Collector contract** (implement your own, or deploy `telemetry/collector.mjs`):
+**Collector contract** (any implementation must honor it):
 `POST /v1/events` (one JSON event, allowlisted fields) · `DELETE /v1/install/<id>` (erasure) ·
 `GET /healthz`. Operators must not retain IP-bearing access logs for the ingest vhost.

package/telemetry/README.md

@@ -1,49 +0,0 @@
-# cohorte telemetry collector (reference)
-
-Zero-dependency ingest endpoint for cohorte's **opt-in** anonymous usage pings
-(see the repo README §Privacy and `profile/SCHEMA.md` §Telemetry for what is —
-and is not — collected).
-
-## Deploy (any VPS, Node ≥ 18)
-
-```sh
-TELEMETRY_DATA=/var/lib/cohorte-telemetry/events.ndjson \
-TELEMETRY_PORT=8787 node collector.mjs
-```
-
-Put it behind HTTPS (Caddy example):
-
-```
-telemetry.yourdomain.tld {
-    reverse_proxy 127.0.0.1:8787
-    log { output discard }   # GDPR: do NOT keep access logs with IPs for this vhost
-}
-```
-
-Then set the public URL as the `endpoint:` default in
-`profile/cohorte.config.template.yaml` (anchor `cfg:telemetry_endpoint`) and release —
-consenting installs start sending to it.
-
-## API
-
-| Method | Path | Purpose |
-|---|---|---|
-| `POST` | `/v1/events` | Ingest one event (strict field allowlist, 4 KB max) |
-| `DELETE` | `/v1/install/<install_id>` | **Right to erasure** — drops every event for that id |
-| `GET` | `/healthz` | Liveness |
-
-Storage is an append-only NDJSON file — point your dashboard (or a cron that loads
-into SQLite/Postgres) at it. One JSON object per line:
-
-```json
-{"v":1,"install_id":"…","ts":"…","core_version":"1.2.0","os":"Darwin","event":"phase","phase":"build","feature_hash":"a1b2c3d4e5f6","seconds":412,"results":"ok,ok","received_at":"…"}
-```
-
-## GDPR checklist (operator side)
-
-- [x] Opt-in only — the client never sends without recorded consent
-- [x] No IPs stored (collector ignores them; disable proxy access logs)
-- [x] Data minimization — hashed feature ids, no repo names/paths/code
-- [x] Erasure — `DELETE /v1/install/<id>`; the user finds their id via `/doctor`
-- [x] Withdrawal — `telemetry.enabled: false` in `~/.claude/cohorte.config.yaml`
-- [ ] Your privacy notice — link the repo README §Privacy from wherever you present cohorte

package/telemetry/collector.mjs

@@ -1,79 +0,0 @@
-#!/usr/bin/env node
-// Reference telemetry collector for cohorte — zero-dependency, GDPR-first.
-// Deploy on any VPS behind HTTPS (Caddy/nginx). Storage: NDJSON append-only file,
-// one event per line — read it from your own dashboard however you like.
-//
-//   TELEMETRY_DATA=/var/lib/cohorte-telemetry/events.ndjson \
-//   TELEMETRY_PORT=8787 node collector.mjs
-//
-// GDPR notes:
-//   - IPs are NEVER stored (this process doesn't read them; make sure your reverse
-//     proxy's access log is disabled or anonymized for this vhost).
-//   - DELETE /v1/install/<install_id> erases every event for that id (right to erasure —
-//     the install_id printed by /doctor is the user's erasure key).
-//   - Events are validated against a strict allowlist of fields; anything else is dropped.
-import { createServer } from "node:http";
-import { appendFileSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-
-const DATA = process.env.TELEMETRY_DATA || "./events.ndjson";
-const PORT = Number(process.env.TELEMETRY_PORT || 8787);
-const MAX_BODY = 4096;
-
-mkdirSync(dirname(DATA), { recursive: true });
-
-const FIELDS = ["v", "install_id", "ts", "core_version", "os", "event",
-  "phase", "feature_hash", "seconds", "results"];
-const ID_RE = /^[A-Za-z0-9-]{8,64}$/;
-
-function sanitize(raw) {
-  const e = {};
-  for (const k of FIELDS) if (k in raw) e[k] = raw[k];
-  if (e.v !== 1) return null;
-  if (typeof e.install_id !== "string" || !ID_RE.test(e.install_id)) return null;
-  if (typeof e.event !== "string" || e.event.length > 32) return null;
-  for (const k of ["ts", "core_version", "os", "phase", "feature_hash", "results"])
-    if (k in e && (typeof e[k] !== "string" || e[k].length > 64)) return null;
-  if ("seconds" in e && typeof e.seconds !== "number") return null;
-  e.received_at = new Date().toISOString();
-  return e;
-}
-
-const server = createServer((req, res) => {
-  const done = (code, body) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(body)); };
-
-  if (req.method === "GET" && req.url === "/healthz") return done(200, { ok: true });
-
-  if (req.method === "POST" && req.url === "/v1/events") {
-    let body = "";
-    req.on("data", (c) => { body += c; if (body.length > MAX_BODY) req.destroy(); });
-    req.on("end", () => {
-      try {
-        const e = sanitize(JSON.parse(body));
-        if (!e) return done(400, { error: "invalid event" });
-        appendFileSync(DATA, JSON.stringify(e) + "\n");
-        done(204, {});
-      } catch { done(400, { error: "bad json" }); }
-    });
-    return;
-  }
-
-  // Right to erasure: drop every event carrying this install_id.
-  const del = req.url?.match(/^\/v1\/install\/([A-Za-z0-9-]{8,64})$/);
-  if (req.method === "DELETE" && del) {
-    const id = del[1];
-    let kept = [], dropped = 0;
-    if (existsSync(DATA))
-      for (const line of readFileSync(DATA, "utf8").split("\n")) {
-        if (!line.trim()) continue;
-        if (line.includes(`"install_id":"${id}"`)) { dropped++; continue; }
-        kept.push(line);
-      }
-    writeFileSync(DATA, kept.length ? kept.join("\n") + "\n" : "");
-    return done(200, { erased: dropped });
-  }
-
-  done(404, { error: "not found" });
-});
-
-server.listen(PORT, () => console.log(`cohorte telemetry collector on :${PORT} → ${DATA}`));