> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session05-analytics-consent-and-payload-controls/tasks.md). # Task Checklist **Session ID**: `phase07-session05-analytics-consent-and-payload-controls` **Total Tasks**: 25 **Estimated Duration**: 3-4 hours **Created**: 2026-05-30 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 2 | 2 | 0 | | Foundation | 8 | 8 | 0 | | Implementation | 12 | 12 | 0 | | Testing | 3 | 3 | 0 | | **Total** | **25** | **25** | **0** | *** ## Setup (2 tasks) Initial context review and evidence setup. ### Cross-package * [x] T001 \[S0705] Verify Sessions 01-04, routing matrix, hosted payload blocklist, ADR 0003, current settings behavior, analytics env examples, and local-only prerequisites before editing source (`.spec_system/PRD/phase_07/phase07_requirement_routing_matrix.md`) * [x] T002 \[S0705] \[P] Create implementation evidence notes shell for source changes, docs changes, test commands, skipped checks, and residual risks (`.spec_system/specs/phase07-session05-analytics-consent-and-payload-controls/implementation-notes.md`) *** ## Foundation (8 tasks) Core analytics guardrail artifact, shared contracts, and browser helper scaffolding. ### Cross-package * [x] T003 \[S0705] \[P] Create analytics consent and payload control artifact with provider, disabled-default, consent, opt-out, self-hosting, taxonomy, payload minimization, blocklist, local fallback, and Phase 08 handoff sections (`.spec_system/PRD/phase_07/analytics_consent_payload_controls.md`) ### packages/protocol * [x] T004 \[S0705] Create hosted analytics protocol contracts with provider, planned/disabled/unavailable/ready states, consent requirements, approved events, allowed payload fields, blocked payload labels, docs paths, unsupported claims, and bounded summary helpers (`packages/protocol/src/hostedAnalytics.ts`) * [x] T005 \[S0705] Add protocol tests for analytics vocabulary, consent gates, approved event taxonomy, allowed payload fields, blocked payload labels, summary helpers, and negative dashboard/recorder/erasure claims (`packages/protocol/tests/hostedAnalytics.test.ts`) * [x] T006 \[S0705] Export hosted analytics contracts from the protocol barrel for web and future hosted consumers (`packages/protocol/src/index.ts`) * [x] T007 \[S0705] Refine hosted config analytics metadata so reserved Umami variables point to disabled-default Session 05 ownership and do not imply activation (`packages/protocol/src/hostedConfig.ts`) * [x] T008 \[S0705] Add hosted config regression tests for reserved analytics variables and blocked browser mirrors with no raw secret, website id, or provider value exposure (`packages/protocol/tests/hostedConfig.test.ts`) ### apps/web * [x] T009 \[S0705] Create browser hosted analytics helper with config plus consent readiness evaluation, opt-out handling, local-only fallback, safe settings copy, payload scrubbing, and no network side effects (`apps/web/src/lib/hostedAnalytics.ts`) * [x] T010 \[S0705] Add web helper tests for disabled default, config-only denial, consent-only denial, malformed Umami URL handling, opt-out, payload scrubbing, blocked nested keys, and no beacon/script side effects (`apps/web/tests/hostedAnalytics.test.ts`) *** ## Implementation (12 tasks) Settings copy, environment comments, and documentation alignment. ### apps/web * [x] T011 \[S0705] Surface analytics disabled/unavailable settings status without adding a tracking control, with revalidation on drawer entry and platform-appropriate accessibility labels (`apps/web/src/components/SettingsDrawer.tsx`) * [x] T012 \[S0705] Add settings drawer coverage for analytics disabled/unavailable copy, consent-required wording, focus-safe rendering, and state revalidation on reopen (`apps/web/tests/SettingsHostedAnalytics.test.tsx`) * [x] T013 \[S0705] \[P] Update web README for browser analytics readiness helpers, disabled settings copy, local-only fallback, consent/opt-out boundaries, and no tracking runtime (`apps/web/README_web.md`) ### packages/protocol * [x] T014 \[S0705] \[P] Update protocol README for hosted analytics contract ownership, approved event taxonomy, payload allowlists, blocked labels, and future consumer rules (`packages/protocol/README_protocol.md`) ### docs * [x] T015 \[S0705] \[P] Align analytics env example comments with disabled-default source behavior, consent, opt-out, self-hosted Umami, payload tests, and no committed real keys (`.env.local.example`) * [x] T016 \[S0705] \[P] Update hosted-service docs with Session 05 analytics boundary, Umami/self-hosting posture, consent, opt-out, payload minimization, replaceability, and disabled-default behavior (`docs/hosted-services.md`) * [x] T017 \[S0705] \[P] Update privacy docs with analytics data inventory notes, blocked payload categories, consent boundaries, opt-out, local-only fallback, and no raw-value analytics guarantees (`docs/privacy-and-security.md`) * [x] T018 \[S0705] \[P] Update environment docs so analytics variables remain optional, disabled by default, and insufficient without consent and payload controls (`docs/environments.md`) * [x] T019 \[S0705] \[P] Update release docs with analytics release guardrails, negative-claim checks, and Phase 08 production-hosted validation and trusted-erasure deferrals (`docs/release.md`) * [x] T020 \[S0705] \[P] Update Phase 07 PRD status wording and Session 05 output list after analytics guardrails are implemented and validated (`.spec_system/PRD/phase_07/PRD_phase_07.md`) * [x] T021 \[S0705] \[P] Update master PRD status map and analytics guardrail wording without claiming analytics capture is active (`.spec_system/PRD/PRD.md`) * [x] T022 \[S0705] \[P] Update UX PRD analytics consent, opt-out, disabled-state, and no-dashboard wording after settings copy lands (`.spec_system/PRD/PRD_UX.md`) *** ## Testing (3 tasks) Verification and quality checks. ### Cross-package * [x] T023 \[S0705] Run focused protocol and web analytics tests and record command evidence, outcomes, and skipped-check rationale if any (`.spec_system/specs/phase07-session05-analytics-consent-and-payload-controls/implementation-notes.md`) * [x] T024 \[S0705] Run focused protocol and web typechecks or equivalent package checks for changed TypeScript packages and record skipped-check rationale if any (`.spec_system/specs/phase07-session05-analytics-consent-and-payload-controls/implementation-notes.md`) * [x] T025 \[S0705] Validate ASCII encoding, Unix LF line endings, and `git diff --check` for all changed files before handoff (`.spec_system/specs/phase07-session05-analytics-consent-and-payload-controls/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing or skipped with explicit rationale * [x] All files ASCII-encoded * [x] implementation-notes.md updated * [x] Ready for the validate workflow step *** ## Next Steps Run the implement workflow step to begin AI-led implementation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase07-session05-analytics-consent-and-payload-controls/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.