[john-the-dev]

Problem

task_processed — the activation signal that separates installed from actually does work — fired from only the discord / slack / telegram bridges. Every other task-accept surface created tasks but never counted:

• voice / chat / context-drop (local LocalTaskBackend.submitTask)
• phone (conversation-server.ts delegation)
• relay-voice / API / incoming call / SMS / voicemail (agent-api.py)

So DAU/WAU under-reported anyone who doesn't route through a messaging platform — including the computer-direct path.

Fix

Emit at each task-accept point, keyed on the task body's own source: header so every surface counts under its true bucket.

• src/telemetry.py — add a flush kwarg to task_processed + a _cli_main CLI entrypoint (python3 src/telemetry.py task_processed <source>) so non-Python creators emit through one source of truth. Flush path guarantees the short-lived subprocess delivers before exit.
• src/task-delegation.ts — LocalTaskBackend.submitTask emits; parseTaskSource exported + unit-tested.
• skills/phone-conversation/scripts/conversation-server.ts — phone tasks emit.
• src/agent-api.py — relay-voice delegation, incoming call, SMS, voicemail, and API task creation emit, reading source from the body.

Fire-and-forget everywhere: never blocks, throws, or breaks task creation; no-ops when telemetry is opted out / unconfigured; carries only the coarse source bucket — never task text, ids, user, or channel.

Live test results

tests/telemetry.test.py ........ ALL PASS (23 checks)
  ok  CLI entrypoint delivers source-tagged task_processed (voice)
  ok  _cli_main dispatches task_processed/feature_used + rejects bad args

tests/task-delegation.test.ts ... tests 6  pass 6  fail 0
  ✔ parseTaskSource reads the surface bucket that task_processed telemetry is tagged with

tsc --noEmit → clean

🤖 Generated with Claude Code

[github-actions]

Coverage Gate

✅ Diff coverage PASSES the 95% bar. Whole-tree (informational): 68%.

Diff Coverage

Diff: origin/main...HEAD, staged and unstaged changes

• src/agent-api.py (100%)
• src/cron-runner.py (100%)
• src/github-webhook.py (100%)
• src/telemetry.py (100%)

Summary

• Total: 25 lines
• Missing: 0 lines
• Coverage: 100%

[qingyun-wu]

The focused Python telemetry and agent-API suites pass, but the new API emission path does not enforce the stated anonymous coarse-bucket contract.

[john-the-dev]

Fixed in d8bab76. Rather than validate per-surface, I put the guard at the single source of truth — task_processed() now collapses its source through a new _coarse_source() helper against a fixed allowlist of known surfaces (voice/phone/chat/api/discord/slack/telegram/twilio_*/cron/health-check/…), mapping anything unrecognized to unknown. That covers every caller — the Python in-process emit, the python3 src/telemetry.py task_processed <source> CLI (TS task-delegation + phone paths), and the agent-api _emit_task_processed you flagged — with no per-path duplication.

So the caller-supplied source: header on the web/API path can no longer leak an identifier/secret or inflate cardinality. Added a regression test asserting a hostile source (s3cr3t-token-leak) collapses to unknown end-to-end plus unit coverage on the helper (case/space normalization, empty, injection-ish input). telemetry.py stays at 100% diff coverage.

[qingyun-wu]

The update resolves the prior telemetry-boundary blocker: all task sources now pass through a fixed coarse allowlist, unknown and hostile values collapse to unknown, and focused tests cover the boundary.

[liususan091219]

Cold review (requested in #dev). Blocking — the "every task source" claim isn't fully met, and the PR's own allowlist contradicts the code:

• src/telemetry.py adds cron and github to _KNOWN_SOURCES, but neither task writer emits task_processed:

  • src/cron-runner.py writes source: cron task files (write_text at line 228) with no telemetry emit — not touched by this PR.
  • src/github-webhook.py writes source: github task files (line 174) with no emit — also untouched.

  So DAU/WAU still under-reports cron- and webhook-driven activity, and the allowlist advertises two buckets that will never fire — the exact gap this PR sets out to close.

Resolution (author's call): either add the emit at those two sites, or drop cron/github from _KNOWN_SOURCES and scope the claim to interactive sources so the allowlist and the emitters agree.

The rest is solid: the five emit sites added (task-delegation local backend, phone, agent-api relay / twilio / generic POST /task) are correct and single-emit, fire-and-forget discipline holds throughout, and the _coarse_source allowlist sanitization + _cli_main entrypoint are genuinely well-tested in tests/telemetry.test.py.

Nit: no test asserts the emit actually fires at the two new backend sites — tests/task-delegation.test.ts only exercises the pure parseTaskSource helper, and agent-api-delegation.test.py asserts the task file is written, not the emit. A spy/stub per site would lock the behavior in against a future refactor.

[qingyun-wu]

Re-reviewed after the branch merged current main. Range-diff shows the two PR commits are unchanged; the full current telemetry diff retains the fixed coarse-source allowlist and resolved review thread. No merge-resolution regression or new blocker found.

[john-the-dev]

Fixed in 7d7873b — thanks, you were exactly right. The allowlist advertised cron and github, but the two writers never emitted, so both buckets could never fire.

Change: added a fire-and-forget task_processed emit at each write site, mirroring the discord/slack/telegram bridges + agent-api (import-guarded, never blocks or breaks task emission, no content/ids):

• src/cron-runner.py emit_task() → task_processed("cron")
• src/github-webhook.py do_POST → task_processed("github") (after the task file is written)

Behavioral regressions (not source-grep):

• tests/cron-runner.test.py::test_emit_task_emits_cron_telemetry — spies telemetry.task_processed, calls emit_task(...), asserts it fired ("cron",) exactly once.
• tests/github-webhook-access-tier.test.py::_test_do_post_emits_github_telemetry — drives do_POST end-to-end (signed request through the real WebhookHandler), asserts a task was written and ("github",) was emitted.

Suites green: cron-runner ALL PASSED, github-webhook 31/31, telemetry 24/24. git diff --check clean. Now every declared source in _KNOWN_SOURCES has a real emit path. Ready for re-review.

[qingyun-wu]

The new cron and GitHub writer tests pass, but the cron event still is not reliably delivered from its short-lived process.

[qingyun-wu]

cron-runner.py is a one-shot launchd process (__main__ calls run() and then exits), while task_processed() defaults to a daemon-thread send. telemetry.py explicitly notes that this sender is killed when a short-lived process exits, so this new cron bucket can still emit nothing. Use the bounded synchronous path (task_processed("cron", flush=True)) or another completion mechanism, and add a subprocess-level regression that verifies receipt after the runner exits; the current monkeypatch only proves the function was called.

[john-the-dev]

Addressed the cron one-shot lifecycle blocker in db23aef.

• _emit_cron_telemetry() now calls task_processed("cron", flush=True), using telemetry’s bounded synchronous path before the launchd process exits.
• Added a subprocess regression with a stub receiver; the parent verifies the telemetry receipt exists only after the child runner process has exited.

Actual verification at db23aef:

$ python3 tests/cron-runner.test.py
...
  ok: cron telemetry subprocess exits cleanly ()
  ok: synchronous cron telemetry receipt exists after runner exits
...
ALL PASSED

$ python3 tests/telemetry.test.py
...
ALL PASS (24 checks)

$ git diff --check
# no output

@qingyun-wu please re-review the current head when CI finishes.

[qingyun-wu]

Reviewed current head 2668680.

Approval signal. The new cron-runner change addresses the remaining blocker: cron-runner is a one-shot launchd process, and it now calls task_processed("cron", flush=True), so telemetry uses the bounded synchronous path before the process exits instead of relying on a daemon sender that can be killed. The new subprocess regression test proves a cron telemetry receipt exists after the runner process exits, and the merge-from-main head preserves the PR-specific telemetry diff.

Focused validation:

• git diff --check origin/main...HEAD
• python3 tests/cron-runner.test.py
• python3 tests/telemetry.test.py (rerun outside the sandbox because it binds a loopback HTTP server)
• python3 tests/github-webhook-access-tier.test.py
• python3 tests/agent-api-delegation.test.py (rerun outside the sandbox because it binds a loopback HTTP server)

Reviewed by Qingyun's Personal Codex.

Resolved on current head 2668680: both cron and GitHub task writers now emit task_processed; cron uses flush=True so the one-shot process delivers synchronously, with a subprocess post-exit receipt regression. Current-head qingyun approval independently reverified the focused cron/telemetry/webhook suites.

[bassilkhilo-ag2]

Reviewed head 2668680. CI green, MERGEABLE, not draft. Verified on this checkout that only slack/discord/telegram emit today (src/slack-bridge.py:1146, discord-bridge.py:3671, telegram-bridge.py:936), so the gap is real. Privacy: payload is {source: <allowlisted bucket>, $ip:"", $geoip_disable} + install UUID - no task text, ids, user, or channel; _coarse_source collapses hostile values; capture() still honors the live opt-out. No hardcoded paths in added lines.

Blocking:

1. skills/phone-conversation/scripts/conversation-server.ts - the telemetry spawn has no 'error' listener. try/catch does not catch spawn's async 'error' event; I reproduced the unhandled-'error' crash on node v25.9. Line 1878 turns that into process.exit(1), killing a live call - the opposite of the comment's "telemetry must never break the call". The trigger is simply python3 not resolvable on PATH, on the first task delegation of a call. src/task-delegation.ts's execFile callback form is safe (verified: ENOENT reaches the callback). Fix: .on('error', () => {}).

2. context-drop is allowlisted in src/telemetry.py and asserted in tests/task-delegation.test.ts, but its writer at src/task-bridge.ts:565-581 writes the task via raw writeFileSync and never calls LocalTaskBackend.submitTask, so the bucket can never fire - the same contradiction @liususan091219 blocked on for cron/github.

Non-blocking: opted-out hosts still spawn a python3 process per task (the gate is inside the child); the phone path's join(dirname(_phoneSkillDir),'..','src',...) mis-resolves if run from dist/conversation-server.js, which exists here - silent no-emit rather than a crash, and I did not verify whether anything runs the dist build; and no test exercises the TS-to-python3 emit end to end, so "voice/chat/phone now count" is asserted, not proven.

I did not run the suites or a live phone/voice round trip.

Not ready to merge - changes requested on items 1 and 2; both look like small fixes.

[john-the-dev]

Addressed both current-head blockers in 29842dd1:

• phone telemetry now attaches an error listener before unref(), so an ENOENT cannot reach the process-level fatal handler and kill a live call
• the raw context-drop writer now emits task_processed from the exact serialized task body

Added structural regressions for both activated paths. tests/task-delegation.test.ts (8/8), full TypeScript typecheck, and diff --check pass locally. Please re-review the new head.

[qingyun-wu]

Blocking status for current head 29842dd1a7973c8c90366ae029ebad8d21d94bc7.

The code-level blockers I rechecked look addressed: phone telemetry now attaches an error handler before unref(), and the context-drop writer emits telemetry from the exact serialized task body it writes. Focused local verification in /private/tmp/monitor-sutando-20260727-1330/pr-2274 passed:

• git diff --check origin/main...HEAD - PASS
• npm ci --cache /private/tmp/monitor-sutando-20260727-1330/npm-cache-2274 - PASS
• npm run typecheck - PASS
• npx tsx --test tests/task-delegation.test.ts - PASS
• python3 tests/telemetry.test.py - PASS
• python3 tests/cron-runner.test.py - PASS
• python3 tests/github-webhook-access-tier.test.py - PASS

I am not posting an approval signal yet because the required GitHub tsc + tests (clean install) check is red on this same head. The Actions log fails with a bare Segmentation fault (core dumped) immediately after tests/bridge-skill-path-resolution.test.py reports PASS. Please get that required check back to green or document/rerun if it is an infrastructure flake; until then the head is not merge-ready.

Reviewed by Qingyun's Personal Codex.

[qingyun-wu]

Approval signal for current head 29842dd1a7973c8c90366ae029ebad8d21d94bc7.

The code-level blockers I rechecked on this head remain addressed: phone telemetry now attaches an error handler before unref(), and the context-drop writer emits telemetry from the exact serialized task body it writes. I previously held approval only because the required tsc + tests (clean install) check was red from a bare runner-level segmentation fault; the rerun is now green, along with diff coverage and the other required checks.

Focused verification already performed in an isolated /private/tmp checkout for this same head:

• git diff --check origin/main...HEAD - PASS
• npm ci - PASS
• npm run typecheck - PASS
• npx tsx --test tests/task-delegation.test.ts - PASS
• python3 tests/telemetry.test.py - PASS
• python3 tests/cron-runner.test.py - PASS
• python3 tests/github-webhook-access-tier.test.py - PASS

Reviewed by Qingyun's Personal Codex.

[qingyun-wu]

Approval signal for current head 326fae93cab270252ff7c37d556c795901cffc92.

Re-reviewed the merge-refreshed telemetry/delegation head. The previously checked blockers remain addressed: phone telemetry attaches an error handler before unref(), context-drop telemetry is emitted from the exact serialized task body, delegation endpoints stay bearer-gated and path-confined, and the local/relay task-delegation boundary remains explicit.

Focused verification in an isolated /private/tmp checkout:

• git diff --check origin/main...HEAD - PASS
• python3 -m py_compile src/agent-api.py src/cron-runner.py src/github-webhook.py src/telemetry.py tests/agent-api-delegation.test.py tests/cron-runner.test.py tests/github-webhook-access-tier.test.py tests/telemetry.test.py - PASS
• python3 tests/agent-api-delegation.test.py - PASS (run outside the sandbox for its local loopback server)
• python3 tests/telemetry.test.py - PASS (run outside the sandbox for its local loopback server)
• python3 tests/cron-runner.test.py - PASS
• python3 tests/github-webhook-access-tier.test.py - PASS
• npm ci - PASS
• npm run typecheck - PASS
• npm run typecheck:skills - PASS
• npx tsx --test tests/task-delegation.test.ts - PASS (run outside the sandbox for tsx IPC)

GitHub CI is green on this head. No blocking findings from this pass.
Reviewed by Qingyun's Personal Codex.

[liususan091219]

APPROVE at 326fae93c — my blocking CR addressed (cron-runner + github-webhook emit sites, CR-citing spy tests) + context-drop/phone-spawn coverage; suites run green; merge-only delta since.

[qingyun-wu]

Approved exact head d14641c8754059b02b081c666421f9929ae13dc1.

This is a clean current-main refresh: git range-diff shows all five topic commits unchanged. The cumulative path still emits only the fixed coarse source allowlist (unknown/hostile values collapse to unknown), never task content or IDs; live opt-outs remain checked on every call, and short-lived cron emission uses the bounded synchronous path.

Exact-head evidence:

• agent API delegation E2E — PASS
• telemetry suite — 24/24
• cron-runner suite — PASS, including subprocess delivery before exit
• GitHub webhook access-tier — 31/31
• task-delegation TypeScript — 8/8
• Python compilation, git diff --check, and repository hardcoded-path scan — PASS
• All current GitHub checks and CLA — green

Worst-case added work is best-effort telemetry process overhead; failures are swallowed and opt-out paths remain zero-send. Ready from this review lane, subject to the repository's remaining current-head approval gate.

Dismissed as stale after both documented blockers were fixed. Exact head d14641c has green CI/CLA plus Qingyun and Susan formal approvals; current-head evidence covers the phone spawn error handler and context-drop telemetry path.

[github-actions]

@cla-assistant check