feat(telemetry): default-on anonymous telemetry core with a human-only consent boundary

.github/scripts/release-evidence-policy.json

@@ -206,5 +206,37 @@
       ".github/workflows/service-lifecycle.yml": "87249bf4d19ce47a6eafa59703fd8e52453cc924",
       ".github/actions/setup-project-bun/action.yml": "cf28f6f9d4385d69784f4e3610914f6952ce789d"
     }
+  },
+  {
+    "kind": "ci",
+    "version": 1,
+    "files": {
+      ".github/workflows/ci.yml": "dc5496ad7e6a146a94fbe8dfeaa3b73461feafbc",
+      ".github/actions/setup-project-bun/action.yml": "cf28f6f9d4385d69784f4e3610914f6952ce789d",
+      ".github/scripts/release-evidence.cjs": "c4cd8c762abbfc1c0674937535c5a36b9cf705fd",
+      ".github/scripts/release-evidence.test.cjs": "de30ad37105cf0e7dd8c538efb5ee1cfafe02990",
+      "scripts/ci/select-test-lane.sh": "b25836cb55f962d1ffd9e68ed00f45f8b45becc8",
+      "scripts/ci/windows-sensitive-diff.sh": "03495f256c671aff57e750febffe19ca7face6a1",
+      "scripts/ci/run-bun-test-batches.sh": "f8aa18e80aff1c95c584cd2c879dfbb6806c11fb",
+      "scripts/ci/bun-crash-signatures.sh": "d34662ddd07864d97bed909135095db33fe42c9e",
+      "scripts/ci/bun-install-frozen.sh": "e6d7bc3aec044e12297c7c4c04015a33df0eb22b",
+      "scripts/ci/docker-smoke.ts": "a8424f93986a31625a0a236cdab5667db67b3405",
+      "scripts/ci/test-durations.tsv": "0c7b8eeac35a5f09414d1b77185733b5936c594f",
+      "scripts/ci/test-durations.windows.tsv": "5ee31b6bd6cada6ab7d806ea03dd0d8e46fe1d29",
+      "scripts/test.ts": "363bf072c4b689478fdbb76a61bf4eadbc054548",
+      "scripts/lib/test-runner-bun.ts": "8763806104a851dbdefeea8cffe8d7dd8d1c8da1",
+      "scripts/test-temp-lock.ts": "ee83fb254b728de119028f52b9894bf52d7aea15",
+      "scripts/ci/run-changed-tests.sh": "9a54d3a5db9849bcbe0dd766954a840185419fa5",
+      "scripts/keyring-smoke.ts": "cd3be07ad57796172696dfa053ea1fb129f29365",
+      "scripts/privacy-scan.ts": "86314e891b45e49739b94c76cddd9e4cc2d4340f",
+      "scripts/structure-ssot.ts": "40ba68401df9b77156afed66d6a11c61df8e9a41",
+      "scripts/generate-ocx-skill-surface.ts": "155e866656ba2d71e8fd48adda857451caf16322",
+      "desktop/scripts/prepare-sidecar.ts": "20f7eec61f73635ea681e25f13dd850b62bb41e2",
+      "desktop/scripts/build-widget.sh": "38e0eb9d713804b603aa75c32383aa18ef01d06c",
+      "desktop/scripts/verify-macos-runtime.sh": "43f1a31375c6f6fe7dcafb9d96c231b98d1f6ba4",
+      "desktop/scripts/verify-linux-sidecar.sh": "c502bb5c8ba8346c722a8f5274f2274bb325a934",
+      "desktop/scripts/appimage-patchelf.py": "63e78ef74160bc48fbcdd882065f1d416db6d13c",
+      "desktop/scripts/linux-packaged-e2e.ts": "9ca92352668ff881c85caea44a9b4747bedc7e2d"
+    }
   }
 ]

AGENTS_INSTALL.md

@@ -52,6 +52,17 @@ The following instructions concern **starring the repository on GitHub**.
   the matter permanently — do not argue it, re-frame it, or raise it again
   later.
 
+### Telemetry
+
+Anonymous daily usage telemetry defaults to on only after a human has seen the
+disclosure notice (in the GUI or an interactive TTY prompt). An agent must never
+enable telemetry or acknowledge the telemetry disclosure on the user's behalf:
+`PUT /api/telemetry` and `ocx telemetry enable` refuse agent-driven callers with
+`agent_consent_required` (and `ocx telemetry enable` refuses a non-interactive
+terminal with `tty_required`), and `ocx config set`/`unset telemetry` refuse every
+caller. Opting out (`ocx telemetry disable`, `OCX_TELEMETRY=0` or `DO_NOT_TRACK=1`)
+is always permitted.
+
 ## Where things are installed
 
 An agent asked to install, inspect, repair, or remove opencodex needs to know what is written

README.md

@@ -502,7 +502,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## Disclaimer
 

SPONSORS.md

@@ -95,7 +95,10 @@ draft agreement.
   request reaches.
 - No relaxation of the [security review](./MAINTAINERS.md) that applies to authentication,
   credentials, or workflow changes.
-- No access to user data, request logs, or telemetry; opencodex does not collect any.
+- No access to user data, request logs, or individual telemetry reports. The only telemetry opencodex
+  collects is the anonymous daily usage summary described in the
+  [privacy statement](./README.md#code-signing-policy), which users can turn off; its project-wide
+  aggregates are public, and sponsors see nothing beyond them.
 - No say over unrelated issues, pull requests, or the release schedule.
 
 ## Current sponsors

devlog/_plan/261107_telemetry_dashboard/000_plan.md

@@ -100,6 +100,6 @@ rejects `/` tokens and host identifiers there (010).
 
 ## PR review round 1
 
-Reviewer feedback on the open stack is recorded, with owner decisions D1–D20, in
+Reviewer feedback on the open stack is recorded, with owner decisions D1–D21, in
 [060_review_round.md](060_review_round.md). Those decisions supersede conflicting text in 000–050, including
 the public privacy statement change that must land with the first layer able to send.

devlog/_plan/261107_telemetry_dashboard/010_client_core.md

@@ -121,7 +121,7 @@ run through `validateTelemetryPayloadV1` before sending or previewing.
 - Each tick (startup jitter, then every 6 h) re-reads config passively from disk and re-evaluates
   `resolveTelemetryStatus`, so CLI and GUI changes take effect without a restart. The management
   routes also call `adoptPersistedTelemetry` and nudge the scheduler.
-- It sends only completed days on or after the UTC day of `decidedAt ?? noticeShownAt` (no pre-consent
+- It sends only completed days strictly after the UTC day of `decidedAt ?? noticeShownAt` (060 D1; no pre-consent
   backfill), at most **one day per tick**, oldest first, at most the last 7 days; 10 s
   `signalWithTimeout`, no in-tick retry. Sent days live in `<OPENCODEX_HOME>/telemetry-state.json`.
 - `tests/preload.ts` sets `OCX_TELEMETRY=0` so no test process ever sends.

docs-site/src/content/docs/reference/code-signing.md

@@ -30,11 +30,16 @@ SignPath Foundation policy forbids signing them with the project certificate.
 
 ### Privacy
 
-This program will not transfer any information to other networked systems unless specifically
-requested by the user or the person installing or operating it. In practice, OpenCodex forwards
-requests to the providers you configure. To look for new versions it also reads release
-metadata from GitHub and the npm registry, and those checks carry none of your prompts,
-credentials or usage data.
+OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily,
+version, release channel, platform, install channel, provider kind, coarse model family, active
+minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or
+paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the
+notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in
+that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or
+Proxy details; project-wide aggregates are public; otherwise data goes only where the user
+configures. In practice, OpenCodex forwards requests to the providers you configure. To look for
+new versions it also reads release metadata from GitHub and the npm registry, and those update
+checks carry none of your prompts, credentials or usage data.
 
 ## Verifying a download
 

docs-site/src/content/docs/tr/reference/code-signing.md

@@ -31,10 +31,17 @@ imzalanmasını yasaklar.
 
 ### Gizlilik
 
-Bu program; kullanıcı, kuran kişi veya çalıştıran kişi açıkça istemedikçe başka
-ağ sistemlerine bilgi aktarmaz. OpenCodex, istekleri yapılandırdığınız sağlayıcılara
-iletir. Yeni sürümler için GitHub ve npm kayıt deposundan yayın meta verilerini
-de okur; bu kontroller istemlerinizi, kimlik bilgilerinizi veya kullanım verilerinizi
+OpenCodex, yalnızca programı kuran veya çalıştıran kişi bildirimi (kontrol paneli açılır
+penceresi veya etkileşimli CLI istemi) gördükten ve reddetmedikten sonra
+`telemetry.opencodex.me` adresine günde bir anonim kullanım özeti (her gün değişen bir kurulum
+karması, sürüm, sürüm kanalı, platform, kurulum kanalı, sağlayıcı türü, kaba model ailesi, etkin
+dakikalar ve istek, jeton ve hata sayımları; istemler, çıktılar, anahtarlar, hesaplar, ana
+bilgisayar adları veya dosya yolları asla dahil edilmez) gönderir; bu bildirimde ve istediğiniz
+zaman `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` veya Proxy details üzerinden
+kapatılabilir; proje genelindeki toplamlar herkese açıktır; bunun dışında veriler yalnızca
+kullanıcının yapılandırdığı yerlere gider. Uygulamada OpenCodex, istekleri yapılandırdığınız
+sağlayıcılara iletir. Yeni sürümler için GitHub ve npm kayıt deposundan yayın meta verilerini de
+okur; bu güncelleme kontrolleri istemlerinizi, kimlik bilgilerinizi veya kullanım verilerinizi
 taşımaz.
 
 ## İndirmeyi doğrulama

readme/README.fr.md

@@ -502,7 +502,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## Avis de non-responsabilité
 

readme/README.ja.md

@@ -496,7 +496,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## 免責事項
 

readme/README.ko.md

@@ -479,7 +479,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## 면책 조항
 

readme/README.ru.md

@@ -508,7 +508,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## Отказ от ответственности
 

readme/README.tr.md

@@ -504,7 +504,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## Sorumluluk reddi
 

readme/README.zh-CN.md

@@ -477,7 +477,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## 免责声明
 

readme/README.zh-TW.md

@@ -476,7 +476,7 @@ Free code signing provided by [SignPath.io](https://about.signpath.io/), certifi
 
 - Committers and reviewers: [lidge-jun](https://github.com/lidge-jun)
 - Approvers: [lidge-jun](https://github.com/lidge-jun)
-- Privacy: This program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it.
+- Privacy: OpenCodex sends one anonymous daily usage summary (a per-day install hash that changes daily, version, release channel, platform, install channel, provider kind, coarse model family, active minutes and request, token and error counts; never prompts, outputs, keys, accounts, hosts or paths) to `telemetry.opencodex.me` only after the person installing or operating it has seen the notice (dashboard popup or interactive CLI prompt) and has not declined; it can be turned off in that notice and anytime with `ocx telemetry disable`, `OCX_TELEMETRY=0`, `DO_NOT_TRACK=1` or Proxy details; project-wide aggregates are public; otherwise data goes only where the user configures.
 
 ## 免責聲明
 

readme/i18n-manifest.json

@@ -6,43 +6,43 @@
       "file": "readme/README.fr.md",
       "label": "Français",
       "docsPath": "fr",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "ko": {
       "file": "readme/README.ko.md",
       "label": "한국어",
       "docsPath": "ko",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "zh-CN": {
       "file": "readme/README.zh-CN.md",
       "label": "简体中文",
       "docsPath": "zh-cn",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "zh-TW": {
       "file": "readme/README.zh-TW.md",
       "label": "繁體中文",
       "docsPath": "zh-tw",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "ru": {
       "file": "readme/README.ru.md",
       "label": "Русский",
       "docsPath": "ru",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "ja": {
       "file": "readme/README.ja.md",
       "label": "日本語",
       "docsPath": "ja",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     },
     "tr": {
       "file": "readme/README.tr.md",
       "label": "Türkçe",
       "docsPath": "tr",
-      "sourceSha256": "941205d861dcfa525b40c8a70ed89ede49b9591d97b30e695aaff066f70f379d"
+      "sourceSha256": "773cb151a0c73420e0a2dfbf4b8ff274c865a5cb0235875185bf769fbeaf10b0"
     }
   }
 }

scripts/generate-ocx-skill-surface.ts

@@ -21,7 +21,7 @@ const DOMAINS = [
   { name: "accounts", roots: ["account", "auth", "login", "logout"] },
   { name: "agents-routing", roots: ["agent", "combo", "route", "fallback", "v2", "effort", "memory", "message", "advisor"] },
   { name: "integrations", roots: ["claude", "integration", "commandcode", "grok", "codex-shim"] },
-  { name: "observe-system", roots: ["companion", "usage", "logs", "storage", "inspect", "system", "observe", "debug", "export", "import", "cost", "update", "config", "tray"] },
+  { name: "observe-system", roots: ["companion", "usage", "logs", "storage", "inspect", "system", "observe", "debug", "export", "import", "cost", "update", "config", "tray", "telemetry"] },
   { name: "access-remote", roots: ["link", "remote-workspace", "hub", "connect", "disconnect", "api", "access"] },
   { name: "lab", roots: ["lab"] },
 ];