cohorte 1.2.1 → 1.2.3

package/CHANGELOG.md

@@ -3,6 +3,40 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.2.3 — 2026-07-29
+
+- **Telemetry now covers the whole funnel.** Only `/build` was actually pinging; `/smoke`,
+  `/review` and `/fix` wrote their metrics line but never sent one, so consenting installs
+  reported a quarter of their pipeline. Those three are fixed, and `/brainstorm`, `/spec`
+  (on a landed freeze) and `/ship` join them — the seven stages of `idea → PR` now report,
+  so it's finally possible to see *where* features stall. Setup and maintenance commands
+  (`/doctor`, `/init-pipeline`, `/update-pipeline`, `/audit`, `/refactor`, `/align-ds`)
+  deliberately never ping: the collected set stays inside what the consent text describes.
+  Same data categories as before, same purpose — nothing new about you is sent, so your
+  existing consent stands and nothing re-asks. The full table is in SCHEMA.md §Telemetry.
+- `telemetry-send.sh` now allowlists the phase name client-side — a typo in a command file
+  used to sail through and land a phantom phase in the dataset.
+- `/fix` never defined a wall-clock start, so the `seconds` in its metrics line was
+  undefined. It now notes the epoch like `/build` and `/review` do.
+- **`/doctor` catches a half-copied core.** New check: `pipeline/scripts/` must hold every
+  shipped script, and `VERSION` must not be newer than its siblings. Callers chain these
+  scripts with `|| true`, so a missing one was invisible — no kanban move, no telemetry
+  ping, no error. If you saw either go quiet, this is why: re-run the installer.
+- CI now fails if an installer forgets to copy a `scripts/*.sh`, and the dry-run install
+  asserts the scripts land executable — the root cause above, caught before release
+  rather than on someone's machine.
+- The npm tarball no longer ships `scripts/new-feature.sh` + `scripts/remove-feature.sh`
+  — cohorte's *own* rendered isolation scripts, with this repo's ports and paths baked
+  in. They claimed in their header to be excluded but never were (an explicit `files`
+  whitelist wins over `.npmignore`). Only the `*.sh.template` files ship, as intended.
+- Fixed `validate-core.mjs` crashing on Windows (`C:\C:\…` path), so the guard above
+  actually runs locally too.
+
+## 1.2.2 — 2026-07-29
+
+- The reference collector moved to its own (private) deployment repo; the public repo keeps
+  the collector API contract in SCHEMA.md §Telemetry. No behavior change for users.
+
 ## 1.2.1 — 2026-07-29
 
 - Telemetry collector URL shipped as the config-template default

package/README.md

@@ -277,7 +277,7 @@ result counts, and a *hash* of the feature id — never repo names, paths, code,
 recorded so you're never re-asked. Withdraw anytime (`telemetry.enabled: false` in
 `~/.claude/cohorte.config.yaml`); erase your history anytime (`/doctor` prints your `install_id`,
 the collector's `DELETE /v1/install/<id>` drops it). Full spec + GDPR details:
-`profile/SCHEMA.md` §Telemetry; reference collector in `telemetry/`.
+`profile/SCHEMA.md` §Telemetry (including the collector API contract).
 
 ## License
 

package/core/commands/brainstorm.md

@@ -49,3 +49,8 @@ when invoked with no paste). In chat print only a 3-line summary + the path. Tel
 downstream. If a board is configured, **move** the card into the **Brainstorm** column tagged
 `#<feature_id>` (per §Kanban): the picked Ideas card if the human chose one, else a new card. No-op if
 no board.
+
+**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/build` §4's shared form,
+`<phase>` = `brainstorm`, `<seconds>` = `0` (this phase is human thinking time, not pipeline
+wall-clock — the funnel signal is the event, not its duration), `<results>` = `""`. No board ⇒ still
+ping, in its own `|| true` call. Silent no-op without consent; never ask about consent here.

package/core/commands/build.md

@@ -101,10 +101,13 @@ Compute the elapsed time in the same Bash call
 (`echo "{...\"seconds\":$(($(date +%s)-<start epoch from §2>)),...}" >> …`):
 `{"ts":"<ISO date>","feature":"$ARGUMENTS","phase":"build","seconds":<wall-clock>,"surfaces":{"<key>":"ok|error",…}}`
 — this is the evidence SCHEMA.md §Specialization asks for before splitting a surface. In the same
-Bash call, chain the opt-in usage ping:
-`<core>/pipeline/scripts/telemetry-send.sh build "$ARGUMENTS" <seconds> "<ok,ok|error,…>" || true`
-(`<core>` = `~/.claude` global / `.claude` bundled) — a silent no-op unless the human explicitly
-consented (SCHEMA.md §Telemetry); never ask about consent here.
+Bash call, chain the opt-in usage ping — **the shared form every phase command reuses**:
+`<core>/pipeline/scripts/telemetry-send.sh <phase> "$ARGUMENTS" <seconds> "<results>" || true`
+(`<core>` = `~/.claude` global / `.claude` bundled; here `<phase>` = `build`, `<results>` =
+`<ok,ok|error,…>`) — a silent no-op unless the human explicitly consented (SCHEMA.md §Telemetry);
+never ask about consent here. `/review`, `/fix` and `/smoke` chain the same line with their own
+phase + results. The `|| true` swallows a **missing** script too, so a half-copied core goes
+silent rather than loud — `/doctor` check 1 is what catches that.
 Then tell the human: run `/smoke $ARGUMENTS` to exercise the feature end-to-end (or test by hand),
 then `/review $ARGUMENTS`. Do not run the app or migrations yourself here — `/smoke` is the
 sanctioned path for that. **Recommend a `/clear` now** — the spec, contract and diff are all on

package/core/commands/doctor.md

@@ -18,7 +18,12 @@ fix only with the human's go-ahead (or hand them the command).
    suggest `/update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
-   re-run install/update).
+   re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
+   `kanban-move.sh`, `telemetry-send.sh`, `new-feature.sh.template`, `remove-feature.sh.template`
+   — ❌ any missing one. Every caller chains these with `|| true`, so an absent script is a **silent**
+   no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
+   that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
+   a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
 2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
    `surfaces[].agent` has its `.claude/agents/<agent>.md` and every agent file has its `surfaces[]`
    entry — **no orphans either way** (SCHEMA.md rule). Each rendered agent's frontmatter `tools`

package/core/commands/fix.md

@@ -29,6 +29,8 @@ that change the *contract*; `/fix` is for everything else.
   re-author the contract file yourself now (lead-only, per `/build` §2) — agents never edit it. If
   the contract change ripples into surfaces *without* findings, fall back to full `/build` instead
   and say so.
+- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line and usage
+  ping both carry `seconds`, and there is no separate timing call.
 
 ## 2. Scope the re-dispatch — only surfaces with findings
 
@@ -61,7 +63,8 @@ When the agents return:
   needs those checkboxes).
 - Print one status line per surface (`<key> · items fixed <n>/<m> · tests pass/fail`) — do not restate
   handoff content — and append ONE metrics line for the batch to `pipeline-metrics.jsonl`
-  (see `/build` §4, `phase: "fix"`).
+  (see `/build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
+  (results = items fixed over items found across surfaces, e.g. `"5/6"`).
 - Tell the human: re-run `/smoke` if the failures were runtime ones, and `/review $ARGUMENTS` for the
   re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
   reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,

package/core/commands/review.md

@@ -58,6 +58,8 @@ Merge the returned reports into **one** REVIEW REPORT (same template): findings
 re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst returned
 (`BLOCK` > `REVISE` > `SHIP`). Append ONE metrics line for the batch to `pipeline-metrics.jsonl`
 (main-checkout path + rules in `/build` §4): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
+In the same Bash call, chain the opt-in usage ping (`/build` §4, `phase: "review"`, results = the
+merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
 `/fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).

package/core/commands/ship.md

@@ -60,6 +60,13 @@ compare URL was emitted (no PR yet), move the card without a number. Then verify
 or an offset-limited Read around the match): exactly one card, under the `shipped` heading — never
 re-read the whole board into context. No board ⇒ skip silently.
 
+**Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
+(`/build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
+not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
+emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
+event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
+call. Silent no-op without consent; never ask about consent here.
+
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and

package/core/commands/smoke.md

@@ -34,7 +34,8 @@ human; that's expected.
 
 - Print the agent's return as-is (verdict + ❌ lines + report path) — it is already minimal.
 - Append ONE metrics line to `pipeline-metrics.jsonl` (main-checkout path + rules in `/build` §4,
-  `phase: "smoke"`).
+  `phase: "smoke"`), chaining the opt-in usage ping in the same Bash call (results = `PASS` or
+  `FAIL:<n>` failing flows).
 - **PASS** → tell the human to run `/review $ARGUMENTS`. **FAIL** → the failures are findings: feed
   them to `/fix $ARGUMENTS`, re-run `/smoke` after. Either way the report is on disk —
   **recommend a `/clear`** before the next command.

package/core/commands/spec.md

@@ -47,7 +47,12 @@ Detect the mode from the pasted content:
    it. This is just so the human isn't surprised when `/build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/build`.
+   — if it fails the freeze didn't land; fix it before pointing the human at `/build`. Chain the
+   opt-in usage ping onto the postcondition's Bash call (`/build` §4's shared form, `<phase>` =
+   `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
+   Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
+   not ping — it re-enters an already-counted spec, and `/fix` covers that loop. Silent no-op without
+   consent; never ask about consent here.
 6. Author the **design brief** — `specs/design/<id>.md`, rendered via
    `.claude/templates/design-brief.md` (resolves to `~/.claude/templates/…` on a global install).
    _Only if `design.enabled` / the feature has UI; skip entirely for a backend-only feature._

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -43,8 +43,9 @@ Prefer sensible defaults from Phase 1 as the first (Recommended) option in each
 - **Telemetry** (optional, machine-scoped — SKIP entirely if `~/.claude/cohorte.config.yaml` already
   has a `telemetry:` block with a `consent_date`, i.e. the human already answered on this machine).
   Ask ONE opt-in question, stating exactly: _"Share anonymous usage stats with the cohorte project?
-  Sent per pipeline phase: core version, OS, phase name, duration, per-surface result counts, and a
-  hash of the feature id — never repo names, paths, code, or IPs. Off by default; withdraw anytime
+  One ping per pipeline phase, `/brainstorm` through `/ship`: core version, OS, phase name, duration,
+  per-surface result counts, and a hash of the feature id — never repo names, paths, code, or IPs.
+  Setup and maintenance commands never ping. Off by default; withdraw anytime
   (`telemetry.enabled: false`); erase your history anytime (SCHEMA.md §Telemetry). Default: No."_
   On **yes**: in the global config set `telemetry.enabled: true`, mint `install_id` (`uuidgen`,
   lowercase), set `consent_date` (ISO date). On **no**: set `enabled: false` + `consent_date` (so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"
@@ -13,10 +13,11 @@
     "core",
     "profile",
     "scripts",
+    "!scripts/new-feature.sh",
+    "!scripts/remove-feature.sh",
     "dashboard/server",
     "dashboard/dist",
     "dashboard/README.md",
-    "telemetry",
     "install.sh",
     "install.ps1",
     "CHANGELOG.md"

package/profile/SCHEMA.md

@@ -325,9 +325,28 @@ Cohorte can send the maintainers anonymous usage pings so the pipeline improves
 slow. **Nothing is ever sent without explicit consent**: `/init-pipeline` (and `/update-pipeline` on
 pre-telemetry installs) ask ONE question, once per machine, default **No**, and record the answer in
 `~/.claude/cohorte.config.yaml` §`telemetry` (`enabled`, `install_id`, `consent_date`). The sender —
-`pipeline/scripts/telemetry-send.sh`, chained by each phase after its metrics line — is a silent
-no-op unless `enabled: true` AND `install_id` AND `endpoint` are all set, times out at 2s, and never
-fails the pipeline.
+`pipeline/scripts/telemetry-send.sh` — is a silent no-op unless `enabled: true` AND `install_id` AND
+`endpoint` are all set, times out at 2s, and never fails the pipeline. Callers chain it with
+`|| true`, so a **missing** script is equally silent: `/doctor` check 1 verifies `pipeline/scripts/`
+is fully populated.
+
+**Which commands ping** — the seven that make up the feature funnel, and only those. The point is to
+see where features stall, so every stage of `idea → PR` reports and nothing else does:
+
+| phase | fired when | `seconds` | `results` |
+| --- | --- | --- | --- |
+| `brainstorm` | the return is staged | `0` | — |
+| `spec` | a freeze lands (Mode A only) | `0` | `frozen` |
+| `build` | after the batch metrics line | wall-clock | `ok,ok` / `error` |
+| `smoke` | after the verdict | wall-clock | `PASS` / `FAIL:<n>` |
+| `review` | after the merged verdict | wall-clock | `<verdict>:<count>` |
+| `fix` | after the batch metrics line | wall-clock | `<fixed>/<found>` |
+| `ship` | the release agent succeeded | `0` | `pr` / `compare` |
+
+`seconds: 0` marks a phase whose duration is human thinking time, not pipeline wall-clock — the
+funnel signal there is the event, not how long it took. `/doctor`, `/audit`, `/refactor`,
+`/align-ds`, `/init-pipeline` and `/update-pipeline` **never** ping: they sit outside the funnel, and
+keeping them out is what holds the collected set to what the consent text describes.
 
 **What one event contains** (strict allowlist, ~200 bytes):
 
@@ -348,9 +367,9 @@ work without revealing what is being built.
   the next phase, no restart.
 - **Erasure** — `/doctor` prints your `install_id`; send
   `curl -X DELETE <endpoint-origin>/v1/install/<install_id>` and the collector drops every event
-  for that id (the reference collector in `telemetry/` implements this and stores no IPs).
+  for that id (the deployed collector implements this and stores no IPs).
 - **Access/portability** — events are keyed by your `install_id`; ask the operator for an export.
 
-**Collector contract** (implement your own, or deploy `telemetry/collector.mjs`):
+**Collector contract** (any implementation must honor it):
 `POST /v1/events` (one JSON event, allowlisted fields) · `DELETE /v1/install/<id>` (erasure) ·
 `GET /healthz`. Operators must not retain IP-bearing access logs for the ingest vhost.

package/profile/cohorte.config.template.yaml

@@ -15,7 +15,9 @@ enabled: true                 # cfg:enabled — master switch; false disables ev
 # (/init-pipeline or /update-pipeline ask once per machine; they record your answer here).
 # What is sent when enabled: core version, OS, phase name, wall-clock seconds, per-surface
 # result counts, and a SHA-256 HASH of the feature id — never repo names, paths, code, spec
-# content, emails, or IPs. Sent fire-and-forget (2s timeout, silent on failure) by
+# content, emails, or IPs. One ping per pipeline phase, /brainstorm through /ship; setup and
+# maintenance commands (/doctor, /init-pipeline, /update-pipeline, /audit, /refactor,
+# /align-ds) never ping. Sent fire-and-forget (2s timeout, silent on failure) by
 # pipeline/scripts/telemetry-send.sh. Withdraw anytime: set enabled: false. Erase your history:
 # see SCHEMA.md §Telemetry (DELETE by install_id).
 telemetry:

package/scripts/telemetry-send.sh

@@ -2,7 +2,8 @@
 # telemetry-send.sh — fire-and-forget anonymous usage ping (SCHEMA.md §Telemetry).
 #
 #   telemetry-send.sh <phase> <feature_id> <seconds> [results]
-#     phase    build|review|fix|smoke
+#     phase    brainstorm|spec|build|smoke|review|fix|ship — the feature funnel, and only it.
+#              Setup/maintenance commands never ping (SCHEMA.md §Telemetry).
 #     feature  the feature id — NEVER sent raw; SHA-256-hashed to 12 hex chars
 #     seconds  batch wall-clock
 #     results  optional compact summary, e.g. "ok,ok" or "REVISE:3"
@@ -35,6 +36,13 @@ install_id="$(tval install_id)"; [ -n "$install_id" ] || exit 0
 phase="${1:-}"; feature="${2:-}"; seconds="${3:-0}"; results="${4:-}"
 [ -n "$phase" ] || exit 0
 
+# Allowlist the phase here — the collector accepts any string, so a typo in a command
+# file would silently pollute the dataset with a phantom phase nobody notices.
+case "$phase" in
+  brainstorm|spec|build|smoke|review|fix|ship) ;;
+  *) exit 0 ;;
+esac
+
 if command -v shasum >/dev/null 2>&1; then
   fhash=$(printf '%s' "$feature" | shasum -a 256 | cut -c1-12)
 else

package/scripts/validate-core.mjs

@@ -4,8 +4,11 @@
 // locally with `node scripts/validate-core.mjs`.
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
-const root = new URL("..", import.meta.url).pathname;
+// fileURLToPath, not .pathname — on Windows the latter yields "/C:/…", which
+// join() then resolves against the cwd drive ("C:\C:\…") and every read ENOENTs.
+const root = fileURLToPath(new URL("..", import.meta.url));
 const errors = [];
 const fail = (file, msg) => errors.push(`${file}: ${msg}`);
 
@@ -109,6 +112,36 @@ const steps = join(root, "core/templates/steps/init-pipeline");
 if (!existsSync(steps) || readdirSync(steps).length === 0)
   fail("core/templates/steps/init-pipeline", "router step files missing/empty");
 
+// ── telemetry coverage ──────────────────────────────────────────────────────
+// The funnel is only readable if every one of its stages pings — a single missing
+// one silently truncates it (that is how /smoke, /review and /fix went unreported
+// until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
+const FUNNEL = ["brainstorm", "spec", "build", "smoke", "review", "fix", "ship"];
+for (const c of FUNNEL)
+  if (!/usage ping/i.test(read(`core/commands/${c}.md`)))
+    fail(`core/commands/${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
+// …and nothing outside the funnel may ping (consent text scopes it to the funnel).
+for (const f of readdirSync(join(root, "core/commands"))) {
+  const c = f.replace(/\.md$/, "");
+  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /doctor
+  // listing the scripts it checks for) is a mention, not a ping.
+  if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
+    fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
+}
+
+// ── shipped scripts ─────────────────────────────────────────────────────────
+// Every scripts/*.sh must be copied by BOTH installers. Callers chain these with
+// `|| true`, so one the installer forgets is a silent no-op forever — no kanban
+// card moves, no telemetry ping, no error. CI is the only place this is loud.
+// A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
+// (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
+const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };
+const shipped = readdirSync(join(root, "scripts"));
+for (const f of shipped.filter((f) => f.endsWith(".sh") && !shipped.includes(`${f}.template`)))
+  for (const [name, src] of Object.entries(installers))
+    if (!src.includes(`scripts/${f}`) && !src.includes(`scripts\\${f}`))
+      fail(name, `never copies scripts/${f} into pipeline/scripts/ (silent no-op at runtime)`);
+
 // ── report ──────────────────────────────────────────────────────────────────
 if (errors.length) {
   console.error(`validate-core: ${errors.length} error(s)\n`);

package/telemetry/README.md

@@ -1,49 +0,0 @@
-# cohorte telemetry collector (reference)
-
-Zero-dependency ingest endpoint for cohorte's **opt-in** anonymous usage pings
-(see the repo README §Privacy and `profile/SCHEMA.md` §Telemetry for what is —
-and is not — collected).
-
-## Deploy (any VPS, Node ≥ 18)
-
-```sh
-TELEMETRY_DATA=/var/lib/cohorte-telemetry/events.ndjson \
-TELEMETRY_PORT=8787 node collector.mjs
-```
-
-Put it behind HTTPS (Caddy example):
-
-```
-telemetry.yourdomain.tld {
-    reverse_proxy 127.0.0.1:8787
-    log { output discard }   # GDPR: do NOT keep access logs with IPs for this vhost
-}
-```
-
-Then set the public URL as the `endpoint:` default in
-`profile/cohorte.config.template.yaml` (anchor `cfg:telemetry_endpoint`) and release —
-consenting installs start sending to it.
-
-## API
-
-| Method | Path | Purpose |
-|---|---|---|
-| `POST` | `/v1/events` | Ingest one event (strict field allowlist, 4 KB max) |
-| `DELETE` | `/v1/install/<install_id>` | **Right to erasure** — drops every event for that id |
-| `GET` | `/healthz` | Liveness |
-
-Storage is an append-only NDJSON file — point your dashboard (or a cron that loads
-into SQLite/Postgres) at it. One JSON object per line:
-
-```json
-{"v":1,"install_id":"…","ts":"…","core_version":"1.2.0","os":"Darwin","event":"phase","phase":"build","feature_hash":"a1b2c3d4e5f6","seconds":412,"results":"ok,ok","received_at":"…"}
-```
-
-## GDPR checklist (operator side)
-
-- [x] Opt-in only — the client never sends without recorded consent
-- [x] No IPs stored (collector ignores them; disable proxy access logs)
-- [x] Data minimization — hashed feature ids, no repo names/paths/code
-- [x] Erasure — `DELETE /v1/install/<id>`; the user finds their id via `/doctor`
-- [x] Withdrawal — `telemetry.enabled: false` in `~/.claude/cohorte.config.yaml`
-- [ ] Your privacy notice — link the repo README §Privacy from wherever you present cohorte

package/telemetry/collector.mjs

@@ -1,79 +0,0 @@
-#!/usr/bin/env node
-// Reference telemetry collector for cohorte — zero-dependency, GDPR-first.
-// Deploy on any VPS behind HTTPS (Caddy/nginx). Storage: NDJSON append-only file,
-// one event per line — read it from your own dashboard however you like.
-//
-//   TELEMETRY_DATA=/var/lib/cohorte-telemetry/events.ndjson \
-//   TELEMETRY_PORT=8787 node collector.mjs
-//
-// GDPR notes:
-//   - IPs are NEVER stored (this process doesn't read them; make sure your reverse
-//     proxy's access log is disabled or anonymized for this vhost).
-//   - DELETE /v1/install/<install_id> erases every event for that id (right to erasure —
-//     the install_id printed by /doctor is the user's erasure key).
-//   - Events are validated against a strict allowlist of fields; anything else is dropped.
-import { createServer } from "node:http";
-import { appendFileSync, existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { dirname } from "node:path";
-
-const DATA = process.env.TELEMETRY_DATA || "./events.ndjson";
-const PORT = Number(process.env.TELEMETRY_PORT || 8787);
-const MAX_BODY = 4096;
-
-mkdirSync(dirname(DATA), { recursive: true });
-
-const FIELDS = ["v", "install_id", "ts", "core_version", "os", "event",
-  "phase", "feature_hash", "seconds", "results"];
-const ID_RE = /^[A-Za-z0-9-]{8,64}$/;
-
-function sanitize(raw) {
-  const e = {};
-  for (const k of FIELDS) if (k in raw) e[k] = raw[k];
-  if (e.v !== 1) return null;
-  if (typeof e.install_id !== "string" || !ID_RE.test(e.install_id)) return null;
-  if (typeof e.event !== "string" || e.event.length > 32) return null;
-  for (const k of ["ts", "core_version", "os", "phase", "feature_hash", "results"])
-    if (k in e && (typeof e[k] !== "string" || e[k].length > 64)) return null;
-  if ("seconds" in e && typeof e.seconds !== "number") return null;
-  e.received_at = new Date().toISOString();
-  return e;
-}
-
-const server = createServer((req, res) => {
-  const done = (code, body) => { res.writeHead(code, { "content-type": "application/json" }); res.end(JSON.stringify(body)); };
-
-  if (req.method === "GET" && req.url === "/healthz") return done(200, { ok: true });
-
-  if (req.method === "POST" && req.url === "/v1/events") {
-    let body = "";
-    req.on("data", (c) => { body += c; if (body.length > MAX_BODY) req.destroy(); });
-    req.on("end", () => {
-      try {
-        const e = sanitize(JSON.parse(body));
-        if (!e) return done(400, { error: "invalid event" });
-        appendFileSync(DATA, JSON.stringify(e) + "\n");
-        done(204, {});
-      } catch { done(400, { error: "bad json" }); }
-    });
-    return;
-  }
-
-  // Right to erasure: drop every event carrying this install_id.
-  const del = req.url?.match(/^\/v1\/install\/([A-Za-z0-9-]{8,64})$/);
-  if (req.method === "DELETE" && del) {
-    const id = del[1];
-    let kept = [], dropped = 0;
-    if (existsSync(DATA))
-      for (const line of readFileSync(DATA, "utf8").split("\n")) {
-        if (!line.trim()) continue;
-        if (line.includes(`"install_id":"${id}"`)) { dropped++; continue; }
-        kept.push(line);
-      }
-    writeFileSync(DATA, kept.length ? kept.join("\n") + "\n" : "");
-    return done(200, { erased: dropped });
-  }
-
-  done(404, { error: "not found" });
-});
-
-server.listen(PORT, () => console.log(`cohorte telemetry collector on :${PORT} → ${DATA}`));