aeat.core.telemetry package

Default-off, consent-gated remote telemetry.

Every existing telemetry primitive in this codebase ( LLMRunTelemetryRecorder, the MCP ToolCallTelemetryRecord) is local-only by construction: encrypted secure storage or a local JSONL file, never a network call. This package is the one deliberate, narrow exception – a REMOTE telemetry tier an operator may opt into to help improve the project.

The consent gate mirrors cloud_evidence_read_permitted()’s shape exactly (gestor-mode absolute bar -> deployment opt-in -> tier -> per- invocation acknowledgement, all ANDed, never sticky). The payload contract is a closed, code-authored allowlist (TelemetryEventPayload): there is no extra field, no free-text field wide enough to carry operator content, and no metric key can be emitted remotely unless it is explicitly registered in TELEMETRY_METRIC_REGISTRY with remote_allowed=True.

emit_telemetry_event()’s default sink, LocalNoopTelemetrySink, discards the payload – this proves the gate-then-schema-then-emit pipeline end-to-end without any real transmission, per 2026-07-04-remote-telemetry-adr. HttpTelemetrySink is the real network-transmitting implementation of the same TelemetrySink protocol: it is structurally inert (a pure no-op) unless a caller both builds it with a configured settings.aeat_telemetry_endpoint AND the consent gate already permitted emission, and any transport failure is swallowed rather than raised. No caller wires it as a default sink in this slice; a producer or CLI surface must explicitly opt a call site into it.

Three non-sensitive operational producers are wired in this slice (emit_command_invocation_telemetry(), emit_llm_run_telemetry(), emit_error_frequency_telemetry()), each registered in TELEMETRY_METRIC_REGISTRY and exercising the full gate-then-schema-then-emit pipeline against the local sink.

See also

telemetry_emit_permitted()

Consent gate every remote-eligible event must pass.

build_telemetry_payload()

Payload builder that enforces the metric allowlist before emission.

HttpTelemetrySink

Optional network sink; never the default transport.

Submodules