From 2264e10f3fedbe60ba0eeda1438059e7be8fd7d9 Mon Sep 17 00:00:00 2001 From: AutoGenUI <231675956+AutoGenUI@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:55:29 +0800 Subject: [PATCH] docs: record Brevo consent deployment and owner settings --- docs/CURRENT_STATE.json | 158 +++++++++++++++--- docs/PROJECT_CONTEXT.md | 4 +- .../2026-10-14-brevo-tracking-consent.md | 14 +- docs/operations/README.md | 6 +- docs/operations/email-subscriptions.md | 4 +- 5 files changed, 152 insertions(+), 34 deletions(-) diff --git a/docs/CURRENT_STATE.json b/docs/CURRENT_STATE.json index a140366..0499a3b 100644 --- a/docs/CURRENT_STATE.json +++ b/docs/CURRENT_STATE.json @@ -13,17 +13,17 @@ "documentsAndCodeIntegrityVerified": true }, "production": { - "evidence": "Sites v17 terminal succeeded; exact release tree and read-only public HTTP verified", + "evidence": "Sites v18 terminal succeeded; exact GitHub iteration tree matched; provider account settings reported complete by owner", "url": "https://ag-ui.ai", "platformUrl": "https://ag-ui-ai.channely.chatgpt.site", "projectId": "appgprj_6a5dcacfcbb4819193bac2b2104ed926", - "publishedVersion": 17, - "versionId": "appgprj_6a5dcacfcbb4819193bac2b2104ed926~appgver_e9520e6fde348191a354c9847bc078b5", - "deploymentId": "appgdep_6ace369800908191869b5b0e3df5297d", + "publishedVersion": 18, + "versionId": "appgprj_6a5dcacfcbb4819193bac2b2104ed926~appgver_498187b5f2b4819193c2017ce0f9f283", + "deploymentId": "appgdep_6acf894d40c081918a34737f2fbf1c3a", "deploymentStatus": "succeeded", - "deploymentCompletedAt": "2026-10-13T13:48:23.323550+00:00", - "sourceCommit": "88a840a2052d312dbd5b1a04a3f5cb7c36422744", - "sourceTree": "93352d2871a89b8c9b398bc5aaf2e8bae0c88861", + "deploymentCompletedAt": "2026-10-14T13:53:31.694330+00:00", + "sourceCommit": "44b23a03dad8bd597f564d2187df708e89d473f1", + "sourceTree": "eea00579439d7f576c310acdddda49cb51ff3af8", "githubReleaseCommit": "fae53ff09c26ca10985e5a48d04a76fc1511046b", "environmentSetRevision": 12, "hasMcp": true, @@ -32,32 +32,33 @@ "publicMailEnabledAtObservation": true, "confirmedSubscriberCapacity": 250, "publicAggregateAtObservation": { - "confirmedPublic": 1, - "remaining": 249, - "scope": "Public aggregate only; no subscriber rows or signed links read" + "confirmedPublic": 2, + "remaining": 248, + "scope": "Public aggregate only; no subscriber rows or signed links read", + "observedAt": "2026-10-14T13:54:43.214568+00:00" }, "existingSchedulesPreserved": true, "automationCountAtObservation": 2, - "observedOn": "2026-10-13", - "githubIterationCommit": "fae53ff09c26ca10985e5a48d04a76fc1511046b" + "observedOn": "2026-10-14", + "githubIterationCommit": "0f52548272e40812a31889360f32085e9d376a3e" }, "github": { - "observedOn": "2026-10-13", + "observedOn": "2026-10-14", "repository": "AutoGenUI/ag-ui.ai", "defaultBranch": "main", - "mainAtObservation": "fae53ff09c26ca10985e5a48d04a76fc1511046b", - "evidence": "PR13 verify passed; main initial HTTP failure preserved, exact-commit attempt 2 passed; immutable tag and Sites v17 verified", + "mainAtObservation": "0f52548272e40812a31889360f32085e9d376a3e", + "evidence": "PR15 verify passed; main initial local HTTP failure retained and exact-commit attempt2 passed; Sites v18 verified", "syncBranch": null, - "pullRequest": "https://github.com/AutoGenUI/ag-ui.ai/pull/13", + "pullRequest": "https://github.com/AutoGenUI/ag-ui.ai/pull/15", "draftAtObservation": false, "mergedAtObservation": true, - "mergedAt": "2026-10-13T13:47:08Z", - "validatedPullRequestHead": "542ee0457738e11f344ad5528166a514f4859938", - "validatedTree": "93352d2871a89b8c9b398bc5aaf2e8bae0c88861", + "mergedAt": "2026-10-14T13:49:26Z", + "validatedPullRequestHead": "05540b88b0081b01e60a5bf39da068ab0e39b997", + "validatedTree": "eea00579439d7f576c310acdddda49cb51ff3af8", "requiredCheck": "verify", "branchProtectionPreserved": true, "branchPolicy": "Keep only main after completed iterations; temporary PR branches allowed and cleaned after verified merge", - "documentationFollowup": "Receipt-only protected PR after publication; does not redeploy Sites or move v1.0.1; query current GitHub main for its final SHA", + "documentationFollowup": "Receipt-only protected PR after deployment; does not redeploy application or move immutable tags. Query GitHub for final main SHA.", "recoverablePreCleanupBundleVerified": true, "protectedManagedWorktreeRetained": true }, @@ -269,10 +270,11 @@ "openEngineeringWork": [ "Track 8 moderate dependencies without weakening the audit gate", "Preserve bundle budgets; raw JavaScript remains close to the unchanged 920000-byte gate", - "Verify complete Brevo tracking disablement and keep bilingual disclosures accurate", + "Verify final delivered MIME pixel/link removal after owner-reported account consent settings; keep bilingual disclosures accurate", "Recheck restricted-network accessibility without promising global access", "Observe real queued cancellation and additional bounce scenarios only under authorized acceptance", - "Before authorized production maintenance, refresh account permissions, full DNS/DKIM inventory, actual Sites deployment, D1 migration ledger and backup/restore capability, schedules and provider allowance" + "Before authorized production maintenance, refresh account permissions, full DNS/DKIM inventory, actual Sites deployment, D1 migration ledger and backup/restore capability, schedules and provider allowance", + "Investigate recurring first local Worker POST /mcp 500 in CI; preserve strict 403 assertion and capture Worker log on failure before drawing a root-cause conclusion" ], "refreshRule": "Read live GitHub and Sites before maintenance. User authorized v1.0.1 on 2026-10-13; use release.phase and verified tag/deployment evidence, preserving historical snapshots and v1.0.0.", "operationsHandoff": { @@ -993,7 +995,7 @@ }, "trackingConsentIteration": { "authorizedOn": "2026-10-14", - "phase": "local-candidate", + "phase": "deployed", "baseMain": "983a21cf579eb11176bd307fc9016286f6ef9780", "notes": "docs/iterations/2026-10-14-brevo-tracking-consent.md", "recipientParameter": { @@ -1007,7 +1009,13 @@ "zh", "en" ], - "providerAccountSetting": "pending verification after browser login connection failure", + "providerAccountSetting": { + "perContactConsentEnabled": true, + "trackUnknownConsent": false, + "evidence": "Owner reported completing the supplied settings on 2026-10-14; not independently read back by agent after browser login connection failure", + "confirmedOn": "2026-10-14", + "independentlyVerified": false + }, "completePixelAndLinkRemovalVerified": false, "realMailSent": false, "newTagCreated": false, @@ -1038,7 +1046,105 @@ "cssGzipBytes": 23035, "budgetsPreserved": true }, - "browser": "Local zh/en subscription and privacy; 390x844 en subscription no horizontal overflow; mail disabled" - } + "browser": "Local zh/en subscription and privacy; 390x844 en subscription no horizontal overflow; mail disabled", + "productionReadOnlyChecks": { + "observedAt": "2026-10-14T13:54:43.214568+00:00", + "scope": "Read-only public HTTP with QA user agent; no signup, signed link, queue, owner write or mail", + "checks": [ + { + "path": "/zh/subscribe", + "status": 200, + "contentType": "text/html; charset=utf-8", + "updatedDisclosure": true + }, + { + "path": "/en/subscribe", + "status": 200, + "contentType": "text/html; charset=utf-8", + "updatedDisclosure": true + }, + { + "path": "/zh/privacy", + "status": 200, + "contentType": "text/html; charset=utf-8", + "updatedDisclosure": true + }, + { + "path": "/en/privacy", + "status": 200, + "contentType": "text/html; charset=utf-8", + "updatedDisclosure": true + }, + { + "path": "/zh/feed.xml", + "status": 200, + "contentType": "application/rss+xml; charset=utf-8" + }, + { + "path": "/en/feed.xml", + "status": 200, + "contentType": "application/rss+xml; charset=utf-8" + }, + { + "path": "/feed.xml", + "status": 200, + "contentType": "application/rss+xml; charset=utf-8" + }, + { + "path": "/api/subscription/status", + "status": 200, + "contentType": "application/json", + "publicStatus": { + "enabled": true, + "confirmedCount": 2, + "capacity": 250, + "remaining": 248, + "full": false, + "dailyLimit": 300, + "weeklyLimit": 250 + } + }, + { + "path": "/api/admin", + "status": 403, + "contentType": "application/json" + } + ] + } + }, + "recordedAt": "2026-10-14 13:53:54 UTC", + "github": { + "commit": "0f52548272e40812a31889360f32085e9d376a3e", + "tree": "eea00579439d7f576c310acdddda49cb51ff3af8", + "pullRequest": "https://github.com/AutoGenUI/ag-ui.ai/pull/15", + "mergedAt": "2026-10-14T13:49:26Z", + "pullRequestHead": "05540b88b0081b01e60a5bf39da068ab0e39b997", + "requiredVerify": { + "status": "passed", + "url": "https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38574795407/job/115888950947" + }, + "postMergeVerify": { + "status": "passed", + "attempt": 2, + "url": "https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38575068866/job/115890916808", + "initialFailure": "Attempt 1: first anonymous local /mcp returned 500 instead of 403; subsequent anonymous MCP test passed. Same pattern as dated v1.0.1 record; worker log not captured by existing CI, root cause unproven." + } + }, + "sites": { + "projectId": "appgprj_6a5dcacfcbb4819193bac2b2104ed926", + "versionNumber": 18, + "versionId": "appgprj_6a5dcacfcbb4819193bac2b2104ed926~appgver_498187b5f2b4819193c2017ce0f9f283", + "sourceCommit": "44b23a03dad8bd597f564d2187df708e89d473f1", + "sourceTree": "eea00579439d7f576c310acdddda49cb51ff3af8", + "matchesGithubTree": true, + "deploymentId": "appgdep_6acf894d40c081918a34737f2fbf1c3a", + "status": "succeeded", + "completedAt": "2026-10-14T13:53:31.694330+00:00", + "environmentSetRevisionPreserved": 12, + "hasMcp": true, + "audience": "public", + "automationCount": 2 + }, + "documentationFollowup": "Receipt-only protected PR after deployment; does not redeploy application or move immutable tags. Query GitHub for final main SHA." } } diff --git a/docs/PROJECT_CONTEXT.md b/docs/PROJECT_CONTEXT.md index 3b3b1c6..b7be4c4 100644 --- a/docs/PROJECT_CONTEXT.md +++ b/docs/PROJECT_CONTEXT.md @@ -4,7 +4,7 @@ ## 当前迭代：Brevo 收件人级跟踪退出（2026-10-14） -用户已授权每封邮件收件人设置 `contactPixelTrackingConsent: false`、提交推送并更新应用。确认/周报及公众/测试发信共用入口；双语披露同步说明明确退出请求与实际像素/链接移除证据的区别。账户侧功能尚待安全登录核验，当前已发布版本仍为下述 v17，不能把本地参数当作生产或服务商执行证据。详见 [迭代记录](iterations/2026-10-14-brevo-tracking-consent.md)。 +用户已授权每封邮件收件人设置 `contactPixelTrackingConsent: false`、提交推送并更新应用。确认/周报及公众/测试发信共用入口；双语披露同步说明明确退出请求与实际像素/链接移除证据的区别。账户设置由所有者于 2026-10-14 确认完成（非本代理独立读回）；[PR #15](https://github.com/AutoGenUI/ag-ui.ai/pull/15) 已合入 main `0f52548272e40812a31889360f32085e9d376a3e`，Sites **v18** 于 13:53:31 UTC 部署成功。源码 `44b23a03dad8bd597f564d2187df708e89d473f1` 的 tree `eea00579439d7f576c310acdddda49cb51ff3af8` 与 GitHub 验证版本一致，env revision12、公开权限、MCP、2 项任务保留。124 项本地测试与原预算通过；PR verify 成功，main 首次本地 MCP 500 失败后同提交重跑通过，原记录保留。部署后中英订阅/隐私新文案、RSS 与状态 HTTP200，匿名管理403；公开人数2、余位248（仅聚合）。没有新增真实邮件或新标签，最终邮件像素/链接移除仍待验证。详见 [迭代记录](iterations/2026-10-14-brevo-tracking-consent.md)。 ## 最近语义化发布：v1.0.1（2026-10-13） @@ -117,7 +117,7 @@ Sites 数字版本 **14** 于 11:34:36 UTC 部署成功，version ID `appgprj_6a ## 隐私与访问限制 -交接曾接受并披露 Brevo 匿名跟踪；2026-10-14 用户进一步授权每位收件人发送明确跟踪退出参数。账户侧功能启用及最终邮件像素/链接改写移除仍需核验，订阅与隐私页面必须保持准确的双语披露。本站浏览统计不存原始 IP、不关联订阅邮箱与浏览轨迹，访客数为估算；这是第一方统计的边界，不代表邮件没有第三方跟踪。 +交接曾接受并披露 Brevo 匿名跟踪；2026-10-14 用户进一步授权每位收件人发送明确跟踪退出参数。账户设置已有所有者完成确认，最终邮件像素/链接改写移除仍需核验，订阅与隐私页面必须保持准确的双语披露。本站浏览统计不存原始 IP、不关联订阅邮箱与浏览轨迹，访客数为估算；这是第一方统计的边界，不代表邮件没有第三方跟踪。 中国大陆部分网络的 Cloudflare 拦截为已知限制。后续手机流程曾成功，不证明拦截原因、地域覆盖或全球可访问性。继续保留 Sites；不能从旧的某个出口成功推断所有网络均已恢复。 diff --git a/docs/iterations/2026-10-14-brevo-tracking-consent.md b/docs/iterations/2026-10-14-brevo-tracking-consent.md index ff305ad..62ceb96 100644 --- a/docs/iterations/2026-10-14-brevo-tracking-consent.md +++ b/docs/iterations/2026-10-14-brevo-tracking-consent.md @@ -8,11 +8,21 @@ 依据 2026-10-14 查阅的 [Brevo 官方说明](https://help.brevo.com/api/v2/help_center/en-us/articles/37113920427922.json)，API 参数属于每个 `to`/`cc`/`bcc` 收件人，当前本站仅使用 `to`。该功能还要求先在账户 Settings → Contacts → Per-contact pixel tracking consent 中启用；将未知同意状态跟踪设为 No。此设置不影响 delivered、bounce、spam、invalid、blocked、unsubscribed 等投递/抑制事件。 -账户状态核验尚未完成：现有浏览器登录跳转连接失败，已请求所有者安全登录或反馈上述开关状态。不读取密码、会话或密钥；代码发出明确退出请求不等于账户功能已启用。中英订阅页、隐私页和模板同步说明“要求关闭打开与点击跟踪”，并保留最终邮件像素与链接改写是否完全移除的未验证边界。本轮没有发送真实邮件或检查真实 MIME，因此即便账户开关后续确认，也不能据本地 mock 宣称所有客户端完全无跟踪。 +账户设置于 2026-10-14 由所有者确认已完成：启用 per-contact consent，并按此前给出的步骤将未知同意状态跟踪设为 No。浏览器登录跳转连接失败，本代理没有独立读回设置，证据归因所有者确认。不读取密码、会话或密钥；API 参数与账户设置分别记录，不能由代码部署推断账户状态。中英订阅页、隐私页和模板同步说明“要求关闭打开与点击跟踪”，并保留最终邮件像素与链接改写是否完全移除的未验证边界。本轮没有发送真实邮件或检查真实 MIME，不能据账户确认或本地 mock 宣称所有客户端完全无跟踪。 ## 验证与发布记录 - 隔离数据库和 mock provider：新闻/邮件 69 项通过；新增中英 × 公众/测试四组，验证确认和周报都携带退出参数、投递关联仍在、提交与送达区分、跟踪事件不改变状态、硬退信抑制及额度保留。 - 本地共 124 项通过：35 基础、69 新闻/邮件、12 订阅 UI、8 隔离 Worker HTTP；内容校验、TypeScript、lint、构建与原预算通过。审计仍为 8 moderate、0 high/critical，lint 两项既有 warning。JS 919926/gzip267601、CSS116185/gzip23035 字节，未放宽预算。 -- 独立只读代码审查未发现问题。本地浏览器核对中英订阅和隐私文案，390×844 英文订阅无横向溢出；本地邮件关闭，不代表真实收件或生产 DOM。CI 与部署凭据完成后另行追加。 +- 独立只读代码审查未发现问题。本地浏览器核对中英订阅和隐私文案，390×844 英文订阅无横向溢出；本地邮件关闭，不代表真实收件或生产 DOM。以下记录实际 CI 与部署结果。 - 未修改 DNS、Sites 环境、D1 schema、任务、生产邮件开关或额度；不调用真实发信或投递队列。测试与真实收件验收分开记录。 + +## GitHub 与生产回执 + +- [PR #15](https://github.com/AutoGenUI/ag-ui.ai/pull/15) 于 2026-10-14T13:49:26Z 正常 rebase 合入，main `0f52548272e40812a31889360f32085e9d376a3e`；[required verify](https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38574795407/job/115888950947) 通过，严格保护未变。 +- main 第一次检查的首个匿名本地 `/mcp` 返回 500 而非 403，后续 MCP 检查通过；[同提交 attempt 2](https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38575068866/job/115890916808) 全部通过。未改变断言或加自动重试。缺少当次 Worker 日志，Wrangler POST 转发瞬断只是可能原因，不能宣称根因已确定。 +- 原 Sites 项目保存为 **v18**，version `appgprj_6a5dcacfcbb4819193bac2b2104ed926~appgver_498187b5f2b4819193c2017ce0f9f283`；source `44b23a03dad8bd597f564d2187df708e89d473f1`，tree `eea00579439d7f576c310acdddda49cb51ff3af8` 与 GitHub 迭代完全一致。 +- deployment `appgdep_6acf894d40c081918a34737f2fbf1c3a` 于 2026-10-14T13:53:31.694330+00:00 返回 succeeded；env revision12、public/active、MCP、2 项既有任务保留。 +- 保留 v1.0.0/v1.0.1 原标签；没有新 tag。发布回执的文档 PR 可领先部署提交，不为文档再次部署；最终 main SHA 从 GitHub 查询。 + +发布后 2026-10-14T13:54:43.214568+00:00 使用 QA User-Agent 只读检查：中英订阅/隐私页 HTTP200 且含新披露，三个 RSS 和公开状态200，匿名管理403；公众邮件 enabled，聚合人数2、余位248、容量250。未读取订阅行、访问真实签名链接或调用发信。生产 DOM 与真实邮件未新增验收；当前出口通过不代表所有网络可达。 diff --git a/docs/operations/README.md b/docs/operations/README.md index 2d1af7a..caf740b 100644 --- a/docs/operations/README.md +++ b/docs/operations/README.md @@ -13,7 +13,9 @@ ## 当前主线与证据 -2026-10-13 **v1.0.1 标签已推送、正式站点已更新为 Sites v17**；发布提交 `fae53ff09c26ca10985e5a48d04a76fc1511046b`，部署 13:48:23 UTC 成功，119 项 CI 与原构建预算通过。首次本地 HTTP 失败及同提交重跑成功均保留。最新完成状态、源码、tag 和 Sites 映射见 [v1.0.1 回执](../releases/v1.0.1.md) 与 [CURRENT_STATE.json](../CURRENT_STATE.json) 的 `release`。以下 v1.0.0 项保留为历史证据，不作为最新运行版本；当前发布不新增真实收件验收或改变邮件额度。 +2026-10-14 **Sites v18 已部署**，对应 [PR #15](https://github.com/AutoGenUI/ag-ui.ai/pull/15) 的 main `0f52548272e40812a31889360f32085e9d376a3e`。统一退出跟踪参数、中英披露和 124 项测试记录见 [本轮回执](../iterations/2026-10-14-brevo-tracking-consent.md)；账户设置由所有者确认完成，未新增真实邮件验证。下面 v1.0.1 是最近语义化标签的历史映射，不是最新 Sites 数字版本。 + +2026-10-13 **v1.0.1 标签已推送、正式站点已更新为 Sites v17**；发布提交 `fae53ff09c26ca10985e5a48d04a76fc1511046b`，部署 13:48:23 UTC 成功，119 项 CI 与原构建预算通过。首次本地 HTTP 失败及同提交重跑成功均保留。该版本完成状态、源码、tag 和 Sites 映射见 [v1.0.1 回执](../releases/v1.0.1.md) 与 [CURRENT_STATE.json](../CURRENT_STATE.json) 的 `release`。以下 v1.0.0 项保留为历史证据，不作为最新运行版本；当前发布不新增真实收件验收或改变邮件额度。 - GitHub 主线为 [AutoGenUI/ag-ui.ai 的 main](https://github.com/AutoGenUI/ag-ui.ai)。[PR #5](https://github.com/AutoGenUI/ag-ui.ai/pull/5) 已正常合并，远端带注释 tag [v1.0.0 / 正式 Release](https://github.com/AutoGenUI/ag-ui.ai/releases/tag/v1.0.0) 指向 `71ff116e033f0295a44415d13acd92bf1c0b97b6`；[PR verify](https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38381641758/job/115243248665) 和 [main verify](https://github.com/AutoGenUI/ag-ui.ai/actions/runs/38381929658/job/115244227252) 通过。每次迭代可使用临时 PR 分支，合并并核对内容后清理，长期仅保留 main，不改主分支保护。 - 正式 v1.0.0 已于 2026-10-13 10:15:25.780042 UTC 部署至原 Sites 项目，数字版本序号 13，deployment `appgdep_6ace04b15f408191ad18bdcbbe4be3d3` 终态 succeeded。Sites source `8512d230c7df3bece70c503af02ff2acce0dbe9d` 的 tree 与 release tree `661f59e806ce2174a33d6d87b9b44d0959400554` 一致。完整 version_id、tag 对象及验收见 [发布回执](../releases/v1.0.0.md)。GitHub 合并仍不自动代表 Sites 部署；本次两者各有独立凭据。 @@ -44,7 +46,7 @@ ## 尚需后续验证 - 8 项 moderate 依赖问题与 v1.0.1 JS 原始体积仅 39 字节余量（919961 / 920000）：未来依赖/页面修改重新审计和构建，不降门槛。旧 CI 修复的 1169 字节余量仅属于历史构建。 -- 邮件当前明确请求关闭打开/点击跟踪；账户侧功能状态及最终像素/链接改写移除仍待核验。中国大陆可访问性不保证。 +- 邮件当前明确请求关闭打开/点击跟踪；账户设置已由所有者确认完成，最终像素/链接改写移除仍待核验。中国大陆可访问性不保证。 - 当前账户权限、完整 DNS 清单、DKIM selector、实际部署版本、迁移 ledger、托管 D1 备份/恢复方式、实时任务状态与 provider 剩余额度均需在授权的生产维护中刷新。 - 真实 queued cancellation 与完整退信场景未全部观察；本地测试和历史验收不能扩写为所有生产情形都已验收。 diff --git a/docs/operations/email-subscriptions.md b/docs/operations/email-subscriptions.md index 75d6263..11ccf69 100644 --- a/docs/operations/email-subscriptions.md +++ b/docs/operations/email-subscriptions.md @@ -8,7 +8,7 @@ 共享发信入口对每个 `to` 收件人设置 `contactPixelTrackingConsent: false`，覆盖公众/测试确认和周报，不按语言例外，也不在参数被拒后去掉它重发。若以后增加 `cc`/`bcc`，每位收件人也必须携带 false。本站不使用打开/点击事件判断已读或控制后续发信，投递与抑制回调继续处理。 -[Brevo 官方设置说明](https://help.brevo.com/api/v2/help_center/en-us/articles/37113920427922.json) 要求先启用账户功能：Settings → Contacts → Per-contact pixel tracking consent → Yes；Track contacts whose consent is unknown → No；保存后读回。只通过安全账户会话操作，不导出 contacts、会话、原始邮件或秘密。本轮账户登录跳转失败，状态尚待所有者核验；不能从部署成功推断账户开关已开启。该策略无需新增站内跟踪同意勾选框。 +[Brevo 官方设置说明](https://help.brevo.com/api/v2/help_center/en-us/articles/37113920427922.json) 要求先启用账户功能：Settings → Contacts → Per-contact pixel tracking consent → Yes；Track contacts whose consent is unknown → No；保存后读回。只通过安全账户会话操作，不导出 contacts、会话、原始邮件或秘密。本轮账户登录跳转失败；所有者于 2026-10-14 确认已按上述步骤设置完成，代理未独立读回。记录用户确认与实际账户读回的区别，不能从部署成功推断账户状态。该策略无需新增站内跟踪同意勾选框。 真实 MIME 的像素/链接移除尚未验收；不把 API 参数、匿名统计或本地模板预览当作证明。若后续另获真实邮件验收授权，分别记录提供商提交、送达、收件、最终 HTML/链接检查，保留退订/投诉/硬退信停发机制；不能为了检查参数调用生产队列或重置额度。 @@ -123,7 +123,7 @@ release 不发信，不调用 drain 或提供商，不要求关闭公众邮件 ## 隐私、密钥轮换与故障处理 -邮件记录含个人信息；管理员聚合不等于数据库匿名。签名管理链接本身具有访问权限，所有公开记录、PR、任务提示、截图和日志必须排除邮箱、密钥、会话与真实签名 URL。浏览统计和邮箱不关联；不利用 opens/clicks 作阅读证明或是否继续发信依据。交接曾接受并披露匿名跟踪；当前每位收件人发送明确退出参数，账户功能是否启用另行核验。匿名化和退出请求均不证明最终像素或改写链接完全移除。HTML/纯文本提供原网址文本可复制，但直接点击/自动识别仍可能经跟踪。全面关闭尚未验证，修改跟踪须同步中英订阅及隐私披露并重新验证，不能只删说明。 +邮件记录含个人信息；管理员聚合不等于数据库匿名。签名管理链接本身具有访问权限，所有公开记录、PR、任务提示、截图和日志必须排除邮箱、密钥、会话与真实签名 URL。浏览统计和邮箱不关联；不利用 opens/clicks 作阅读证明或是否继续发信依据。交接曾接受并披露匿名跟踪；当前每位收件人发送明确退出参数，账户设置由所有者确认完成，未作独立账户读回。匿名化和退出请求均不证明最终像素或改写链接完全移除。HTML/纯文本提供原网址文本可复制，但直接点击/自动识别仍可能经跟踪。全面关闭尚未验证，修改跟踪须同步中英订阅及隐私披露并重新验证，不能只删说明。 API key 轮换由 owner 在安全配置中操作：确认当前消费者及任务、配置新 key 并验证获授权的连接后再撤销旧 key；不要在仓库保存旧/new 值。webhook 当前只接受一个 secret，没有双 key 过渡；需协调服务端与 Brevo 回调配置、provider retry 及积压回调的处理，不能单边轮换。`SUBSCRIPTION_SECRET` 没有 key ring，直接换值使所有既有确认/管理链接失效，需先设计读者恢复和重新验收方案。`ANALYTICS_SECRET` 更换可改变当天访客估算，记录统计影响。身份与绑定迁移另见 owner 文档。