mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-09-10 10:35:51 +00:00
rcourtman
72eaab444f
Schema v6 shipped audit_logging_persistent and audit_events_30d as Pro adoption signals. Neither discriminated. pkg/server installs the SQLite audit logger on every install for defense in depth and gates only the read/export endpoints, so the boolean was true on all 8 installs that had taken rc.8 and 0 rows in the retained table have ever had it false. The event count measured that background write volume: three of those eight unlicensed community installs were pegged at the receiver's 100000 clamp ceiling, with the rest between 4863 and 67509. Schema v7 replaces both with audit_reads_30d, a count of requests that cleared the license gate on an audit read or export surface. A read requires a human action, so unlike store presence or write volume it cannot settle into a constant. The recorder is wrapped INSIDE RequireLicenseFeature so unentitled requests never count, and the persisted marker carries a timestamp and a coarse activity class from a fixed allowlist. Query filters, actors, ranges, and every audit row read stay on the install. The retired columns are left in the live database. They hold real rc.8 rows and migrations only add, so dropping them would be a pointless risk; nothing writes them once the receiver struct loses the fields. Adds the guard this class needed. LicensedFeatureAdoptionFields registers every field that exists to measure licensed-feature adoption, and TestLicensedFeatureAdoptionFieldsDiscriminate builds an unused install through the real production snapshot paths, installs a real SQLite audit logger exactly as pkg/server does, records a baseline audit event, and fails if any registered field is non-zero. Pinning a console logger there would have made the guard pass while the payload lied, so it deliberately does not. The guard was verified by reintroducing the v6 sourcing and confirming it fails with the field named. A companion test pins the three retired fields so they cannot return under their old names. This is the third instance of one bug class. v6 removed pulse_intelligence_patrol_autofixes_30d, hardcoded to zero with no increment site, and then introduced two fields that were constant in the other direction. Three occurrences is a guard, not a habit. Verified end to end on a running unlicensed install: the payload that reported audit_logging_persistent true under v6 now reports audit_reads_30d 0, and seeding two in-window reads, one outside the window, and one with an invalid activity class yields 2.
32 lines
1.3 KiB
Go
32 lines
1.3 KiB
Go
package telemetry
|
|
|
|
// LicensedFeatureAdoptionFields lists every telemetry field whose only purpose
|
|
// is to measure adoption of a licensed feature.
|
|
//
|
|
// Membership carries an obligation, enforced by the guard in
|
|
// pkg/server/telemetry_licensed_features_guard_test.go: an install that uses
|
|
// none of these features must report the zero value for every field here. A
|
|
// field that reads the same on a used and an unused install measures nothing,
|
|
// and is worse than no field at all because it looks like data.
|
|
//
|
|
// This registry exists because that exact defect shipped twice. Schema v6 added
|
|
// audit_logging_persistent and audit_events_30d, both sourced from an audit
|
|
// store that is installed unconditionally for defense in depth, so both
|
|
// reported identically on free and paid installs. The same schema removed
|
|
// pulse_intelligence_patrol_autofixes_30d, which had been hardcoded to zero
|
|
// with no increment site anywhere. Three instances of one bug class is a guard,
|
|
// not a habit.
|
|
//
|
|
// Adding a field here without teaching the guard how to exercise it fails the
|
|
// guard, which is the intended friction.
|
|
var LicensedFeatureAdoptionFields = []string{
|
|
"alert_ai_enabled",
|
|
"rbac_custom_roles",
|
|
"rbac_user_assignments",
|
|
"audit_reads_30d",
|
|
"report_schedules",
|
|
"report_schedules_enabled",
|
|
"report_schedules_run_30d",
|
|
"agent_profiles",
|
|
}
|