firekeep-client 1.8.0__tar.gz → 1.8.2__tar.gz

{firekeep_client-1.8.0/firekeep_client.egg-info → firekeep_client-1.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.8.0
+Version: 1.8.2
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai
@@ -57,9 +57,9 @@ an absent registry is seeded with both (default-on), `firekeep dex remove` is
 the off-switch, and removals stick across updates.
 
 **Firekeep is self-hosted — this package needs a server to talk to.** A person
-or team runs its own server, with per-key authentication. Current server images
-target `linux/amd64`: use an x86-64 Linux host, or Docker Desktop with amd64
-container support on Windows or Mac. There is no hosted endpoint. Server install:
+or team runs its own server, with per-key authentication. Server images target
+`linux/amd64` and, for releases after v1.6.2, `linux/arm64`: use an x86-64 or
+ARM64 Linux host, or Docker Desktop on Windows or Mac. There is no hosted endpoint. Server install:
 [firekeep.ai/docs.html](https://firekeep.ai/docs.html#server).
 
 ## Install

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/README.md

@@ -30,9 +30,9 @@ an absent registry is seeded with both (default-on), `firekeep dex remove` is
 the off-switch, and removals stick across updates.
 
 **Firekeep is self-hosted — this package needs a server to talk to.** A person
-or team runs its own server, with per-key authentication. Current server images
-target `linux/amd64`: use an x86-64 Linux host, or Docker Desktop with amd64
-container support on Windows or Mac. There is no hosted endpoint. Server install:
+or team runs its own server, with per-key authentication. Server images target
+`linux/amd64` and, for releases after v1.6.2, `linux/arm64`: use an x86-64 or
+ARM64 Linux host, or Docker Desktop on Windows or Mac. There is no hosted endpoint. Server install:
 [firekeep.ai/docs.html](https://firekeep.ai/docs.html#server).
 
 ## Install

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/__init__.py

@@ -9,4 +9,4 @@ versions without a verdict (`_check_versions`) and judges staleness against the
 release manifest instead (`_check_client_version`).
 """
 
-__version__ = "1.8.0"
+__version__ = "1.8.2"

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/childenv.py

@@ -118,6 +118,9 @@ NOT_FORWARDED: frozenset[str] = frozenset({
     "FIREKEEP_SIGNING_KEY",
     # An enrolment code is a credential; only `firekeep join` reads it.
     "FIREKEEP_JOIN",
+    # The bootstrap's fresh-install answer belongs to the install hand-off
+    # alone; a child seeing it could count a non-install as a new install.
+    "FIREKEEP_INSTALL_REPORT_CONSENT",
     # Set by the gateway from ~/.firekeep/config for symdex alone; a parent's
     # copy (stale shell export, another member's key) is never authoritative.
     "FIREKEEP_CORTEX_URL", "FIREKEEP_CLIENT_API_KEY", "FIREKEEP_CORTEX_CA",

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/cli.py

@@ -461,7 +461,7 @@ def _apply_flags(cfg, args) -> bool:
         # overwrite an ALREADY-recorded answer — a re-render, an update's
         # re-exec, or a non-interactive run relaying a pre-set env must not
         # rewrite a "no" a human already gave.
-        report.record_consent(cfg, pre == "1")
+        report.record_consent(cfg, pre == "1", installs=report.installs_env_answer())
         touched = True
     return touched
 
@@ -710,8 +710,9 @@ def cmd_install(args) -> int:
         print(f"firekeep: install failed at '{step}': {exc}", file=sys.stderr)
         return 1
 
+    report.milestone("installed")
     print(f"firekeep: installed into {home}")
-    registered = "firekeep (gateway: memory, sessions, relay, monitoring, code, decisions)"
+    registered ="firekeep (gateway: memory, sessions, relay, monitoring, code, decisions)"
     print(f"firekeep: registered MCP servers: {registered}")
     print("firekeep: tip — `/personal` (Claude) or `firekeep personal` toggles a private "
           "session where Firekeep is fully bypassed (nothing logged/recalled); it "
@@ -1018,6 +1019,8 @@ def _check_health(cfg) -> list[tuple[str, str, str]]:
     else:
         for svc, category in failures:
             report.emit("connectivity", svc, error=category, cfg=cfg)
+    if not failures:
+        report.milestone("connected", cfg=cfg)
     return out
 
 

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/hooks/session_start.py

@@ -127,6 +127,8 @@ def run(payload: dict) -> dict:
             )
             if isinstance(data, dict) and data.get("rendered"):
                 rendered = data["rendered"]
+                # Once per machine; the flush below sends it.
+                report.milestone("connected", cfg=cfg, flush_now=False)
             # Stash the server-minted briefing_id so the bridge shim can inject it
             # into a ctx_start_session call the agent makes without it — closing the
             # briefing_id -> session_id A/B join mechanically. (The stale-id clear

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/report.py

@@ -72,6 +72,15 @@ _STAGES_BY_KIND = {
     "runtime": RUNTIME_STAGES,
 }
 
+# Install milestones: the success half of the funnel, so downloads can be read
+# against installs that worked. NOT a failure kind — its own consent key
+# ([report] installs), its own once-per-machine marker, no `error` field, and
+# the collector logs it apart from failures (never mailed, never pulled into
+# Sentinel). installed = `firekeep install` completed; connected = the first
+# time this machine reached its Keep (doctor all-green or a served briefing).
+MILESTONE_KIND = "milestone"
+MILESTONE_STAGES = ("installed", "connected")
+
 _ERRNO_MAP = {
     _errno.EACCES: "permission-denied",
     _errno.EPERM: "permission-denied",
@@ -184,15 +193,43 @@ def build_event(kind, stage, *, error=None, exc=None, exit_code=None,
         return None
 
 
+def build_milestone(stage) -> dict | None:
+    """Validated milestone event, or None. Same closed fields as a failure
+    minus `error` and every tagged-union extra."""
+    try:
+        if stage not in MILESTONE_STAGES:
+            return None
+        os_family = detect_os()
+        if os_family not in OS_FAMILIES:
+            return None
+        from firekeep_client import __version__
+        return {
+            "id": uuid.uuid4().hex,
+            "kind": MILESTONE_KIND,
+            "stage": stage,
+            "os": os_family,
+            "arch": detect_arch(),
+            "client": __version__,
+            "py": py_bucket(),
+        }
+    except Exception:  # noqa: BLE001
+        return None
+
+
 _FALSEY = ("", "0", "false", "no", "off")
 
+# One question, two recorded answers ([report] failures + [report] installs).
+# Machines enrolled under the earlier failures-only wording keep `installs`
+# absent and so never send a milestone: their consent is not widened after
+# the fact. The bootstraps (install.sh / install.ps1) carry the same scope.
 CONSENT_PROMPT = (
-    "Send anonymous failure reports to firekeep.ai? When an install step fails, a\n"
-    "connection to your own Keep fails, or a Firekeep background task errors,\n"
-    "Firekeep sends category codes only — what failed, the error class, OS family,\n"
-    "versions. Never paths, messages, addresses, or any persistent device, account\n"
-    "or session identifier. Ongoing until you turn it off\n"
-    "([report] failures = false). [Y/n] "
+    "Send anonymous reports to firekeep.ai? Once when this install succeeds and\n"
+    "first reaches your Keep, and whenever an install step fails, a connection to\n"
+    "your own Keep fails, or a Firekeep background task errors, Firekeep sends\n"
+    "category codes only — what happened, the error class, OS family, versions.\n"
+    "Never paths, messages, addresses, or any persistent device, account or\n"
+    "session identifier. Ongoing until you turn it off\n"
+    "([report] failures = false, [report] installs = false). [Y/n] "
 )
 
 
@@ -216,6 +253,23 @@ def is_enabled(cfg=None) -> bool:
         return False
 
 
+def milestones_enabled(cfg=None) -> bool:
+    """Consent gate for install milestones. Stricter than is_enabled: only a
+    recorded `[report] installs = true` counts — there is deliberately no env
+    opt-in, so CI runs that set FIREKEEP_FAILURE_REPORT=1 never count as
+    installs. The failure opt-out and personal mode silence it too."""
+    try:
+        if os.environ.get("FIREKEEP_NO_FAILURE_REPORT", "").strip().lower() not in _FALSEY:
+            return False
+        if resolver.is_bypassed():
+            return False
+        if cfg is None:
+            cfg = resolver.load_config()
+        return cfg.get("report", "installs", fallback="").strip().lower() == "true"
+    except Exception:  # noqa: BLE001 — any doubt means OFF (fail closed)
+        return False
+
+
 def has_answer(cfg) -> bool:
     try:
         return cfg.get("report", "failures", fallback="").strip() != ""
@@ -223,15 +277,38 @@ def has_answer(cfg) -> bool:
         return False
 
 
-def record_consent(cfg, value: bool) -> None:
+def record_consent(cfg, value: bool, *, installs: bool | None = None) -> None:
+    """Record the failures answer, and the installs answer only when the
+    human was shown wording that covers milestones (installs is not None)."""
     try:
         if not cfg.has_section("report"):
             cfg.add_section("report")
         cfg.set("report", "failures", "true" if value else "false")
+        if installs is not None:
+            cfg.set("report", "installs", "true" if installs else "false")
     except Exception:  # noqa: BLE001
         pass
 
 
+# Set when THIS process recorded an answer from a human at the prompt. With
+# the bootstrap's relayed answer it defines a fresh install: the prompt only
+# ever appears on a machine with no recorded answer, so an update, a re-render
+# or a later opt-in never counts as a new install.
+_ANSWERED_HERE = False
+
+
+def _fresh_install_consented() -> bool:
+    return installs_env_answer() is True or _ANSWERED_HERE
+
+
+def installs_env_answer() -> bool | None:
+    """The bootstrap relays its prompt's answer in FIREKEEP_INSTALL_REPORT_CONSENT,
+    set ONLY when a human answered the milestone-covering wording — never by
+    FIREKEEP_FAILURE_REPORT or an update re-exec. None = not shown that prompt."""
+    pre = os.environ.get("FIREKEEP_INSTALL_REPORT_CONSENT", "").strip()
+    return (pre == "1") if pre in ("0", "1") else None
+
+
 def ask_consent(cfg) -> bool:
     """Ask once; record only a real answer. EOF and Ctrl-C record NOTHING —
     deliberately not wizard.console_ask, whose EOF-takes-the-default would
@@ -242,7 +319,7 @@ def ask_consent(cfg) -> bool:
             return False
         pre = os.environ.get("FIREKEEP_REPORT_CONSENT", "").strip()
         if pre in ("0", "1"):
-            record_consent(cfg, pre == "1")
+            record_consent(cfg, pre == "1", installs=installs_env_answer())
             return True
         if not sys.stdin.isatty():
             return False
@@ -256,7 +333,10 @@ def ask_consent(cfg) -> bool:
         except (EOFError, KeyboardInterrupt):
             print()
             return False
-        record_consent(cfg, answer in ("", "y", "yes"))
+        yes = answer in ("", "y", "yes")
+        record_consent(cfg, yes, installs=yes)
+        global _ANSWERED_HERE
+        _ANSWERED_HERE = yes
         return True
     except Exception:  # noqa: BLE001
         return False
@@ -373,6 +453,56 @@ def emit(kind, stage, *, error=None, exc=None, exit_code=None,
         pass
 
 
+def _milestones_path() -> Path:
+    return _report_dir() / "report-milestones.json"
+
+
+def _claim_milestone(stage: str) -> bool:
+    """Mark `stage` sent for this machine; True only for the caller that
+    newly marked it. The marker is written BEFORE the event is spooled and a
+    failed write means no event: a milestone may be lost, never repeated —
+    repeats would inflate exactly the count this exists to make honest.
+
+    The funnel is nested: `installed` only on a fresh install whose prompt was
+    answered yes in this run, `connected` only on a machine that already sent
+    `installed` — so an existing machine opting in later counts as neither."""
+    try:
+        path = _milestones_path()
+        seen = {}
+        if path.exists():
+            seen = json.loads(path.read_text(encoding="utf-8"))
+            if not isinstance(seen, dict):
+                return False  # unreadable marker: assume sent
+        if stage in seen:
+            return False
+        if stage == "installed" and not _fresh_install_consented():
+            return False
+        if stage == "connected" and "installed" not in seen:
+            return False
+        seen[stage] = int(time.time())
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(json.dumps(seen), encoding="utf-8")
+        return True
+    except Exception:  # noqa: BLE001
+        return False
+
+
+def milestone(stage, *, cfg=None, flush_now: bool = True) -> None:
+    """Record an install milestone once per machine. Never raises; same spool
+    and wire as emit(), so an offline machine sends it on a later flush."""
+    try:
+        if not milestones_enabled(cfg):
+            return
+        event = build_milestone(stage)
+        if event is None or not _claim_milestone(stage):
+            return
+        _append_spool(event)
+        if flush_now:
+            flush(cfg=cfg)
+    except Exception:  # noqa: BLE001
+        pass
+
+
 def _read_events(path: Path) -> list[dict]:
     out = []
     try:
@@ -443,7 +573,8 @@ def flush(cfg=None, timeout=None) -> None:
     if timeout is None:
         timeout = FLUSH_TIMEOUT
     try:
-        if not is_enabled(cfg):
+        failures_on, milestones_on = is_enabled(cfg), milestones_enabled(cfg)
+        if not (failures_on or milestones_on):
             return
         claims = _adoptable_claims()
         spool = _spool_path()
@@ -457,6 +588,11 @@ def flush(cfg=None, timeout=None) -> None:
                 claim_path.unlink()
             except OSError:
                 pass
+            # Each event travels only under its own consent: a spooled failure
+            # from before `failures = false` is dropped, not sent under the
+            # installs answer (and vice versa).
+            events = [e for e in events
+                      if (milestones_on if e.get("kind") == MILESTONE_KIND else failures_on)]
             if not events:
                 continue
             try:

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client/serverupdate.py

@@ -19,6 +19,7 @@ from firekeep_client.transport import get_json
 
 _TIMEOUT = 3.0
 _CACHE_KEY = "server_update_check"
+_RECHECK_KEY = "server_update_recheck"
 
 
 @dataclass
@@ -93,6 +94,26 @@ def _fetch_latest(cfg) -> str | None:
         return None
 
 
+def _recheck_ahead(cfg, running: str, cached: str | None) -> str | None:
+    """A server ahead of the day-cached latest usually means the cache predates
+    a release deployed since (a published server cannot outrun the published
+    series). Re-fetch once, at most once a day per running version so a
+    checkout parked on an unpublished tag pays the 3s once, not per call."""
+    try:
+        today = datetime.date.today().isoformat()
+        marker = f"{today}|{running}"
+        if state.read_scratch(_RECHECK_KEY) == marker:
+            return cached
+        state.write_scratch(_RECHECK_KEY, marker)
+        fresh = _fetch_latest_uncached(cfg)
+        if fresh:
+            state.write_scratch(_CACHE_KEY, f"{today}|{fresh}")
+            return fresh
+    except Exception:  # noqa: BLE001 — keep the cached verdict
+        pass
+    return cached
+
+
 def _relation(running: str, latest: str | None) -> str:
     # Checked BEFORE the manifest: provenance is a property of the server, not
     # of dist-host reachability, so this verdict must never degrade to
@@ -129,6 +150,8 @@ def check(cfg) -> ServerUpdateStatus | None:
         if running is None:
             return None
         latest = _fetch_latest(cfg)
+        if _relation(running, latest) == "ahead":
+            latest = _recheck_ahead(cfg, running, latest)
         return ServerUpdateStatus(
             running=running, latest=latest,
             relation=_relation(running, latest),

{firekeep_client-1.8.0 → firekeep_client-1.8.2/firekeep_client.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: firekeep-client
-Version: 1.8.0
+Version: 1.8.2
 Summary: Client for Firekeep, the self-hosted operating layer for connected AI agents.
 License-Expression: LicenseRef-Firekeep-BUSL-1.1
 Project-URL: Homepage, https://firekeep.ai
@@ -57,9 +57,9 @@ an absent registry is seeded with both (default-on), `firekeep dex remove` is
 the off-switch, and removals stick across updates.
 
 **Firekeep is self-hosted — this package needs a server to talk to.** A person
-or team runs its own server, with per-key authentication. Current server images
-target `linux/amd64`: use an x86-64 Linux host, or Docker Desktop with amd64
-container support on Windows or Mac. There is no hosted endpoint. Server install:
+or team runs its own server, with per-key authentication. Server images target
+`linux/amd64` and, for releases after v1.6.2, `linux/arm64`: use an x86-64 or
+ARM64 Linux host, or Docker Desktop on Windows or Mac. There is no hosted endpoint. Server install:
 [firekeep.ai/docs.html](https://firekeep.ai/docs.html#server).
 
 ## Install

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/firekeep_client.egg-info/SOURCES.txt

@@ -145,6 +145,7 @@ tests/test_report_consent.py
 tests/test_report_consent_surfaces.py
 tests/test_report_flush_points.py
 tests/test_report_integration.py
+tests/test_report_milestones.py
 tests/test_report_schema.py
 tests/test_report_spool.py
 tests/test_resolver.py

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "firekeep-client"
-version = "1.8.0"
+version = "1.8.2"
 description = "Client for Firekeep, the self-hosted operating layer for connected AI agents."
 readme = "README.md"
 requires-python = ">=3.10"

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/tests/test_bootstrap_consent_pty.py

@@ -40,8 +40,9 @@ def _consent_snippet(tmp_path):
     end = text.index("# --- TLS trust", start)
     snippet = ("#!/bin/sh\nset -u\nPYTHON_VERSION=3.12\n"
                + text[start:end]
-               + '\nprintf "CONSENT=%s EXPORTED=%s\\n" '
-                 '"${REPORT_CONSENT}" "${FIREKEEP_REPORT_CONSENT-unset}"\n')
+               + '\nprintf "CONSENT=%s EXPORTED=%s INSTALLS=%s\\n" '
+                 '"${REPORT_CONSENT}" "${FIREKEEP_REPORT_CONSENT-unset}" '
+                 '"${FIREKEEP_INSTALL_REPORT_CONSENT-unset}"\n')
     script = tmp_path / "consent-only.sh"
     script.write_text(snippet, encoding="utf-8")
     script.chmod(0o755)
@@ -89,18 +90,18 @@ def _run_under_pty(script, keys, env=None):
 
 def test_enter_records_yes(tmp_path):
     out = _run_under_pty(_consent_snippet(tmp_path), b"\n")
-    assert "CONSENT=1 EXPORTED=1" in out
+    assert "CONSENT=1 EXPORTED=1 INSTALLS=1" in out
 
 
 def test_n_records_no(tmp_path):
     out = _run_under_pty(_consent_snippet(tmp_path), b"n\n")
-    assert "CONSENT=0 EXPORTED=0" in out
+    assert "CONSENT=0 EXPORTED=0 INSTALLS=0" in out
 
 
 def test_eof_records_nothing(tmp_path):
     # ^D at the prompt: unanswered — nothing exported, nothing reported
     out = _run_under_pty(_consent_snippet(tmp_path), b"\x04")
-    assert "CONSENT=0 EXPORTED=unset" in out
+    assert "CONSENT=0 EXPORTED=unset INSTALLS=unset" in out
 
 
 def test_env_opt_out_never_asks(tmp_path):
@@ -108,3 +109,17 @@ def test_env_opt_out_never_asks(tmp_path):
                          env={"FIREKEEP_NO_FAILURE_REPORT": "1"})
     assert "[Y/n]" not in out
     assert "CONSENT=0 EXPORTED=unset" in out
+
+
+def test_failure_env_opt_in_never_relays_install_consent(tmp_path):
+    """FIREKEEP_FAILURE_REPORT=1 (CI) enrolls failures without a prompt; it must
+    never stand in for a human's answer to the milestone wording."""
+    out = _run_under_pty(_consent_snippet(tmp_path), b"",
+                         env={"FIREKEEP_FAILURE_REPORT": "1"})
+    assert "[Y/n]" not in out
+    assert "CONSENT=1 EXPORTED=1 INSTALLS=unset" in out
+
+
+def test_prompt_names_the_milestones(tmp_path):
+    out = _run_under_pty(_consent_snippet(tmp_path), b"\n")
+    assert "Once when this install succeeds" in out

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/tests/test_package.py

@@ -7,7 +7,7 @@ from pathlib import Path
 def test_package_imports_and_exposes_frozen_version():
     import firekeep_client
 
-    assert firekeep_client.__version__ == "1.8.0"
+    assert firekeep_client.__version__ == "1.8.2"
 
 
 def test_the_version_pins_agree():

{firekeep_client-1.8.0 → firekeep_client-1.8.2}/tests/test_report_consent_surfaces.py

@@ -90,7 +90,7 @@ def test_cmd_doctor_asks_once_after_output_and_preserves_exit_code(
     assert cli.cmd_doctor(Args()) == 1                       # fail row -> rc 1, EOF didn't change it
     assert "[report]" not in cfg_path.read_text()            # EOF recorded nothing
     out = capsys.readouterr().out
-    assert out.index("[FAIL] cortex") < out.index("Send anonymous failure reports")
+    assert out.index("[FAIL] cortex") < out.index("Send anonymous reports")
 
     monkeypatch.setattr(builtins, "input", lambda prompt="": "y")
     assert cli.cmd_doctor(Args()) == 1

firekeep_client-1.8.2/tests/test_report_milestones.py

@@ -0,0 +1,177 @@
+"""Install milestones: the success half of the funnel, under their own consent
+key ([report] installs). Machines enrolled under the failures-only wording must
+never send one, and an existing machine opting in later must not count as a
+new install."""
+import builtins
+import configparser
+import json
+
+import pytest
+
+from firekeep_client import cli, report
+
+
+def _cfg(text=""):
+    cfg = configparser.ConfigParser()
+    cfg.read_string(text)
+    return cfg
+
+
+ON = "[report]\nfailures = true\ninstalls = true\n"
+
+
+@pytest.fixture(autouse=True)
+def report_dir(tmp_path, monkeypatch):
+    for var in ("FIREKEEP_NO_FAILURE_REPORT", "FIREKEEP_FAILURE_REPORT",
+                "FIREKEEP_REPORT_CONSENT", "FIREKEEP_INSTALL_REPORT_CONSENT",
+                "FIREKEEP_BYPASS"):
+        monkeypatch.delenv(var, raising=False)
+    monkeypatch.setenv("FIREKEEP_REPORT_DIR", str(tmp_path))
+    monkeypatch.setattr(report, "_ANSWERED_HERE", False)
+    return tmp_path
+
+
+@pytest.fixture
+def posted(monkeypatch):
+    sent = []
+
+    def fake_post(url, body, timeout):
+        sent.extend(body["events"])
+        return {"accepted": [e["id"] for e in body["events"]], "rejected": []}
+    monkeypatch.setattr(report, "_post", fake_post)
+    return sent
+
+
+def test_failures_only_enrollee_never_sends_milestones(posted, monkeypatch):
+    monkeypatch.setenv("FIREKEEP_INSTALL_REPORT_CONSENT", "1")
+    cfg = _cfg("[report]\nfailures = true\n")
+    assert report.milestones_enabled(cfg) is False
+    report.milestone("installed", cfg=cfg)
+    assert posted == []
+
+
+def test_failure_env_opt_in_does_not_enable_milestones(monkeypatch):
+    """CI sets FIREKEEP_FAILURE_REPORT=1; that must never count as an install."""
+    monkeypatch.setenv("FIREKEEP_FAILURE_REPORT", "1")
+    assert report.milestones_enabled(_cfg()) is False
+
+
+def test_opt_out_and_personal_mode_silence_milestones(monkeypatch):
+    monkeypatch.setenv("FIREKEEP_NO_FAILURE_REPORT", "1")
+    assert report.milestones_enabled(_cfg(ON)) is False
+    monkeypatch.delenv("FIREKEEP_NO_FAILURE_REPORT")
+    monkeypatch.setenv("FIREKEEP_BYPASS", "1")
+    assert report.milestones_enabled(_cfg(ON)) is False
+
+
+def test_installed_sends_once_on_fresh_consented_install(posted, monkeypatch):
+    monkeypatch.setenv("FIREKEEP_INSTALL_REPORT_CONSENT", "1")
+    cfg = _cfg(ON)
+    report.milestone("installed", cfg=cfg)
+    report.milestone("installed", cfg=cfg)
+    assert [e["stage"] for e in posted] == ["installed"]
+    ev = posted[0]
+    assert set(ev) == {"id", "kind", "stage", "os", "arch", "client", "py"}
+    assert ev["kind"] == "milestone" and "error" not in ev
+
+
+def test_installed_not_sent_without_answer_in_this_run(posted):
+    """An update re-exec or a later opt-in carries no fresh answer."""
+    report.milestone("installed", cfg=_cfg(ON))
+    assert posted == []
+
+
+def test_connected_requires_installed_first(posted, monkeypatch):
+    cfg = _cfg(ON)
+    report.milestone("connected", cfg=cfg)
+    assert posted == []
+    monkeypatch.setenv("FIREKEEP_INSTALL_REPORT_CONSENT", "1")
+    report.milestone("installed", cfg=cfg)
+    report.milestone("connected", cfg=cfg)
+    report.milestone("connected", cfg=cfg)
+    assert [e["stage"] for e in posted] == ["installed", "connected"]
+
+
+def test_unknown_stage_dropped(posted):
+    assert report.build_milestone("uninstalled") is None
+
+
+def test_unwritable_marker_means_no_event(posted, monkeypatch, report_dir):
+    monkeypatch.setenv("FIREKEEP_INSTALL_REPORT_CONSENT", "1")
+    (report_dir / "report-milestones.json").write_text("[]", encoding="utf-8")
+    report.milestone("installed", cfg=_cfg(ON))
+    assert posted == []
+
+
+def test_flush_sends_each_event_only_under_its_own_consent(posted, report_dir):
+    spool = report_dir / "report-spool.jsonl"
+    failure = report.build_event("install", "create-venv", error="disk-full")
+    mile = report.build_milestone("installed")
+    spool.write_text(json.dumps(failure) + "\n" + json.dumps(mile) + "\n",
+                     encoding="utf-8")
+    report.flush(cfg=_cfg("[report]\nfailures = false\ninstalls = true\n"))
+    assert [e["kind"] for e in posted] == ["milestone"]
+
+
+def test_interactive_yes_records_both_keys_and_marks_fresh(monkeypatch):
+    cfg = _cfg()
+    monkeypatch.setattr("sys.stdin", type("T", (), {"isatty": lambda self: True})())
+    monkeypatch.setattr(builtins, "input", lambda prompt="": "")
+    assert report.ask_consent(cfg) is True
+    assert cfg.get("report", "failures") == "true"
+    assert cfg.get("report", "installs") == "true"
+    assert report._fresh_install_consented() is True
+
+
+def test_interactive_no_records_both_keys_false(monkeypatch):
+    cfg = _cfg()
+    monkeypatch.setattr("sys.stdin", type("T", (), {"isatty": lambda self: True})())
+    monkeypatch.setattr(builtins, "input", lambda prompt="": "n")
+    report.ask_consent(cfg)
+    assert cfg.get("report", "installs") == "false"
+    assert report._fresh_install_consented() is False
+
+
+def test_bootstrap_relay_without_install_answer_records_failures_only(monkeypatch):
+    """FIREKEEP_FAILURE_REPORT=1 in the bootstrap exports FIREKEEP_REPORT_CONSENT
+    but not FIREKEEP_INSTALL_REPORT_CONSENT: installs stays unanswered."""
+    cfg = _cfg()
+    monkeypatch.setenv("FIREKEEP_REPORT_CONSENT", "1")
+
+    class Args:
+        pass
+    assert cli._apply_flags(cfg, Args()) is True
+    assert cfg.get("report", "failures") == "true"
+    assert not cfg.has_option("report", "installs")
+
+
+def test_bootstrap_relay_with_install_answer_records_both(monkeypatch):
+    cfg = _cfg()
+    monkeypatch.setenv("FIREKEEP_REPORT_CONSENT", "1")
+    monkeypatch.setenv("FIREKEEP_INSTALL_REPORT_CONSENT", "1")
+
+    class Args:
+        pass
+    cli._apply_flags(cfg, Args())
+    assert cfg.get("report", "installs") == "true"
+
+
+def test_prompt_states_the_milestone_scope():
+    assert "Once when this install succeeds" in report.CONSENT_PROMPT
+    assert "[report] installs = false" in report.CONSENT_PROMPT
+
+
+def test_ps1_relays_install_consent_only_from_the_prompt():
+    """No PTY harness for PowerShell here: pin the shape textually. The
+    FIREKEEP_FAILURE_REPORT branch must not set the install relay; the Read-Host
+    branch must set it on both answers, with the milestone wording."""
+    from pathlib import Path
+    text = (Path(__file__).resolve().parents[1] / "bootstrap" / "install.ps1").read_text(
+        encoding="utf-8")
+    env_branch = text[text.index("} elseif ($env:FIREKEEP_FAILURE_REPORT) {"):
+                      text.index("} elseif ([Environment]::UserInteractive")]
+    assert "FIREKEEP_INSTALL_REPORT_CONSENT" not in env_branch
+    prompt_branch = text[text.index("} elseif ([Environment]::UserInteractive"):
+                         text.index("function Send-FailureReport")]
+    assert "Once when this install" in prompt_branch
+    assert prompt_branch.count("$env:FIREKEEP_INSTALL_REPORT_CONSENT = ") == 2