git_admin/obsidian-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[2026-09-18] eagle: work/projects/cpm-m3-telemetry-privacy-triage.md

Browse Source
This commit is contained in:
Alexey Martemyanov
2026-09-18 16:03:42 +06:00
parent 5f4b305e83
commit f9e3a41d70
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
work/projects/cpm-m3-telemetry-privacy-triage.md
+4 -4
View File
@@ -20,9 +20,9 @@ This proposal covers diagnostic collection only; it does not change recovery beh
## Recommended Approach
Keep the existing CPM failure/stuck detection. A shared in-memory recorder collects lifecycle events, critical-memory-pressure notifications and current WebKit/tab state. When a failure or stuck pixel fires, attach a best-effort snapshot. No additional JavaScript probes or periodic telemetry uploads are introduced.
Keep the existing CPM failure/stuck detection. A shared in-memory recorder collects lifecycle events, critical-memory-pressure notifications and current WebKit/tab state. When a failure or stuck pixel fires, capture native state synchronously on the main actor and attach a best-effort snapshot. Callbacks from an earlier context load cannot enter the current timeline. No additional JavaScript probes or periodic telemetry uploads are introduced.
A forwarding delegate proxy observes background-process termination and responsiveness callbacks. The original delegate owns the proxy; the proxy references it weakly. A remote flag enables/disables proxy installation, not the entire diagnostics recorder.
A forwarding delegate proxy observes background-process termination and responsiveness callbacks. The original delegate owns the proxy; the proxy references it weakly. A remote flag enables proxy installation on the current view; disabling restores the original delegates on all surviving observed views, including views retained after unload. It does not disable the entire diagnostics recorder.
| Pixel | Trigger | Frequency |
|---|---|---|
@@ -92,7 +92,7 @@ Original domains/codes are preserved without category mapping. Localized descrip
New pixel and additional parameters require Privacy Triage. No intentional collection of browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs in these payloads. Exact-second timelines and unrestricted error-domain/code combinations can be high-cardinality; bucketing/allowlisting needs a decision. `data_clearing` discloses the operation preceding a failed reload.
Current local diagnostics logs separately include raw errors with `privacy: .public`; remove/redact these before production. Pixel approval does not approve those logs.
Local context-error diagnostics log only original and immediate underlying error domains/codes, without localized descriptions or other userInfo contents.
**Security**
@@ -108,7 +108,7 @@ None. Recovery changes and experiments are outside this proposal.
**Operational**
Update the existing CPM Grafana board for the new fields and reload failures. Agree a diagnostic removal/review date; none is enforced currently. Failure-only snapshots do not provide a denominator of all process deaths or prove an all-tabs outage. Rolling timelines can lose the trigger; deferred snapshots can observe newer state.
Update the existing CPM Grafana board for the new fields and reload failures. Agree a diagnostic removal/review date; none is enforced currently. Failure-only snapshots do not provide a denominator of all process deaths or prove an all-tabs outage. Rolling timelines can lose the trigger; snapshots are captured synchronously at failure time.
**Localization / Internationalization**