Repository navigation
feat(framework): upload out of band, never at the session's expense #662
Description
Outcome
Measured data reaches a hosted dashboard reliably, and never at the cost of the session that produced it.
Scope
#652 claims the upload in its boundaries and no issue builds it. #656 reports across repositories and people, which is impossible while data expires locally on N laptops.
- Includes: what is sent — the run journal and the aggregates, never raw telemetry payloads.
- Includes: authentication, and where the credential lives. Not in a committed file.
- Includes: batching, retry with backoff, and idempotency, so a retried batch does not double a figure.
- Includes: backpressure and a bounded local queue, so an unreachable endpoint degrades rather than grows without limit.
- Includes: upload before local expiry. The sink's retention floor becomes a function of the upload cadence, or data is lost between the two.
- Includes: the redaction of feat(framework): redact again on the upload path #655 applied on this path, before anything leaves.
- Excludes: the hosted side — storage schema, tenancy, query model, server retention. That is the dashboard's product, not this repository's.
- Excludes: any behaviour that blocks, delays or alters a session. Upload is out of band, always.
Done When
- A session is unaffected in duration and outcome whether the endpoint is reachable, slow or absent.
- A batch delivered twice produces one figure, asserted against a duplicate delivery.
- An endpoint down for a day loses nothing, and an endpoint down past the retention bound says what it lost rather than silently truncating.
- Nothing the redaction list forbids appears in a captured request body.
- Disabling upload stops it immediately and leaves local reading intact.
Completion Evidence
A capture of what actually left the machine over a working week, checked against the redaction list, with the delivered totals matching the local ones.
Relations
| Field | Value |
|---|---|
| parent | #652 |
| depends_on | #647, #655 |
| blocks | #656 |
Activity
blafourcade commentedon Aug 31, 2026
This issue now carries #655's outbound-redaction clause
#655 was closed: it redacted an upload path that was deleted along with the OTLP export route. Its storage-side half already holds — the record contract is a closed allowlist, verified against every stored record. Its outbound half lands here, because this is where sending is now designed:
That is now a condition of this issue, not a separate one.
And this issue's own premise changed
It described uploading out of band from an export route that no longer exists. Sending is now a new thing to build, not a restoration. Two things from the decision of record bind it:
This stays framework-side — sending is exposure, not analysis. What it feeds (#656: per person, team and epic across repositories) is the destination's.
Also unbuilt and load-bearing, with no issue of its own yet:
aidd telemetry connect, which binds a machine's identity to an account at that destination. This issue sends records;connectis what makes a claim about whose they are checkable by something other than the person asserting it.docs(framework): three documents catch up with the code they describe
blafourcade commentedon Sep 12, 2026
telemetry connectis part of this issue, not a second backlog item: it is the authentication and credential boundary already listed in scope. It must bind a person to a destination they name, without selecting or defaulting that destination. Sending remains separate consent from local measurement.