[zaxovaiko]

Summary

ANPI-117: opt-out anonymous usage telemetry. The server sends a random instance id, the @openora/core version, the node runtime and active player counts (1d/30d) to an Umami collector on start (at most hourly per deployment) and once a day through a JOB_QUEUE scheduler. npm create @openora sends one report per scaffold. docs/platform/telemetry.md lists every field and every way to turn it off.

Why

We have no count of active installs. npm downloads mix CI, mirrors and bots, and say nothing about a server that keeps running. The ticket asks for an anonymous, on-by-default count with an easy opt-out and docs.

Alternatives considered

• Opt-in: only counts people who read the docs. Opt-out comes with a boot log line and four switches (OPENORA_TELEMETRY_DISABLED, DO_NOT_TRACK, createApp({ telemetry: false }), --no-telemetry).
• Instance id in Redis: a flush mints a new id and inflates the count. It lives in a single-row openora_instance engine table instead.
• A postinstall ping: scanners flag it, pnpm 10 blocks it, and CI installs swamp the count.
• A custom collector: the Umami event format reuses the existing instance, and its distinct id maps to installs.

Risks

• telemetry.openora.ai/api/send is live (demo-openora-ai !1 is deployed). The docs link in the boot line (openora.ai/documentation/telemetry) is still a 404 until the page is published.
• The user agent is Mozilla/5.0 (compatible; openora/<version>). Umami answers 200 {"beep":"boop"} and records nothing for anything its bot check flags, and openora/x (node) was flagged. Checked live: the new one gets recorded, the old one didn't.
• Telemetry is off when CI is set, on the server and in the scaffolder, so pipeline and e2e runs don't count as installs.
• PlayerActivityTracker gains an optional countActiveSince. A consumer tracker without it reports null counts.
• New engine migration (openora_instance) and a player_last_seen_at_idx index on player, both additive. The index also backs the backoffice lastSeenAt sort. It costs HOT updates on the throttled touchLastSeen write, and the plain CREATE INDEX locks player writes while it builds, which is short on an operator-sized table.
• In a split deployment only the service that provides PLAYER_ACTIVITY_TRACKER reports, so the player counts don't randomly come back null from a service without the player module.
• The scaffolder copies the payload and opt-out rules instead of importing the core runtime, so the two have to change together. Its opt-out lives in render.ts now and has tests.
• Rebased onto dev and squashed into one commit; the scaffolder change now sits on top of the render.ts split.
• Manual check: scaffolded against a local echo server. One scaffold event arrived with the documented payload, --no-telemetry sent nothing, and an unreachable endpoint still exited 0.

[zaxovaiko]

/codex all

[blurify-codex]

Not quite yet - the scaffolder sends telemetry before showing its opt-out notice. Blocker: the required PlayerActivityTracker change breaks existing consumer bindings, and the default telemetry site ID is still a placeholder.

Reviewed security, compliance, conventions, performance, reliability, rollout, spec, the whole change.

[zaxovaiko]

Not mergeable yet: no commit since the reviews on 2f0cc59, so every requested change is still open.

• contracts/adapters/player-activity.ts:6 (codex and @marek-chmielowski-blurify threads): make countActiveSince? optional and treat a missing method as null in collectTelemetry. A required method on a public port breaks every consumer that binds its own PLAYER_ACTIVITY_TRACKER.
• create-openora/src/index.ts:224 (codex and @marek-chmielowski-blurify threads): print the opt-out notice before await sendScaffoldPing(). Right now the ping goes out before the user is told how to opt out, which the ADR's visible opt-out does not allow.
• runtime/telemetry.ts:18 and create-openora/src/index.ts: UMAMI_WEBSITE_ID is still the all-zero placeholder, and telemetry.openora.ai does not exist yet. That is the merge blocker the description lists. Put in the real id once the collector is live.
• player.service.ts:368 (@klaudia-blazyczek-blurify thread): add an index on last_seen_at in the profile schema plus its migration, so the daily count does not scan the whole player table.

New, from rebasing onto dev after #298 lands:

• runtime/telemetry.ts startTelemetry: calls jobQueue.registerWorker directly, so it bypasses JOB_WORKERS and every process consumes telemetry, JOB_WORKERS=none included. Register it through the plugin registry's jobs.worker (or run it through selectJobWorkers) so the selection applies.
• ADR-0044 and ADR-0045 are taken by fix(core)!: apply the service manifest to any plugin list and pick job queues per process #298: rename docs/adr/0044-opt-out-anonymous-usage-telemetry.md to the next free number and update its links in docs/platform/telemetry.md.
• The engine migration 0001_watery_turbo.sql uses the same journal slot as fix(core): deliver domain events at least once #297's 0001_event_delivery.sql. Whichever lands second regenerates its migration as 0002.

Reply on each thread once fixed.