privacy/services/workflow-usage.json

{"display_name":"Pipeline usage, outcomes and user satisfaction","external_boundaries":[{"activation":"automatic_on_first_use","content":"The existing installation capability authenticates closed-schema events: random run and event UUIDs, sequence, catalog pipeline ID, host, observed product version, timestamps, explicit user/synthetic/agent-test classification and started/resumed/completed/failed/cancelled state. Optional links contain only an existing signed receipt UUID/report digest or an owned incident report UUID. Run ownership, single-run receipt binding and the retained signature are checked server-side. The original stamping service does not attest the identity of the author of a report. The service receives no task text, client identity, filenames, source data, prompt or professional output. Existing connection metadata and rate limiting apply. Browser or legacy connector identity is not inferred to be a native computer. Native senders also present the existing anonymous native-computer capability and observed native app when available. The server retains the established computer binding; unlinked guests remain unlinked until an actual native proof is received. Browser-owned or legacy connector-owned runs can obtain the bounded per-run proof described above; run-specific computer bindings are used by counts and completion indicators. No personal account information or hardware identifier is collected. The product field is explicit. Product, run owner and receipt product must match. Baselines and function catalogues are distinct per product. The replacement transport preserves the same closed reporting payloads. Browser cookies and optional original local credentials authenticate only; they are not diagnostic fields. Browser status and acknowledgements enter the selected host model context when the agent reads the rendered response. The schema view returns field definitions, not stored user data. The browser fallback sends no professional documents or raw model-data report. Agent instructions limit delivery to the existing authorized reporting scope and current host permissions. A user refusal, revoked permission or required action-time confirmation cannot be bypassed with the browser fallback, another identity or credentials. A permitted browser retry addresses technical runtime or transport failure only; pending state is retained locally where permitted and does not block independently authorized professional work.","controls":["Events are durably queued before transport and acknowledged by exact UUID, owner, sequence and hash. Interruptions stay outcome unknown; repeated submissions are idempotent.","Synthetic and agent-test runs are excluded from user metrics. Studio Archive is infrastructure and cannot be selected as a rated process.","The host AI selects the primary process and observes actual task completion. Counters and hashes do not assert professional correctness or independent model delivery.","The shared implementation binds registrations, browser sessions, task events, report signatures, feedback and update downloads to one product. Existing unmapped installations and receipt schema 1 remain Vera. Physical-computer identity is shared, while usage catalogues and testing epochs are separated by product.","Authenticated event acknowledgements and run status expose the original owner's proven Computer ID and whether an actual signed receipt is linked. Missing linkage remains explicit and returns bounded follow-up instructions. Neither reporting gap changes the professional outcome or authorizes broader host access.","When local HTTPS delivery is unavailable, the authenticated browser recovery route can stamp the exact retained receipt request for an owned run. The allow-list admits only receipt UUID, product/version, schema and report digest. It returns the same signed proof; a separate verified receipt event links it to the original run. No report or source contents are transmitted.","Browser-owned or legacy connector-owned workflow acknowledgements return a random 15-minute proof scoped only to binding that original run to a native computer. The existing native helper adds its private computer capability and observed app. The server stores only the ticket hash, checks product, expiry and app, rejects re-binding, and never replaces the original owner or associates all runs from one saved connection with one computer. The proof cannot authorize other reporting operations. Exact event replay obtains a fresh proof without another event.","Ordinary startup and outcome delivery select only the retained task UUID. Scoped flush and browser inspection return only that task's pending events/count; unrelated retained events cannot make its delivery pending. Startup context exposes only a diagnostic backlog count, without unrelated task IDs. Whole-outbox maintenance is separate; historical event bytes and owner/hash acknowledgement checks are preserved.","The native plugin service exposes fixed task start, observed event, status and task-scoped retry operations using the existing local reporter and computer identity. It persists events in the existing user-scoped database without requiring the chat shell to write outside its project. It accepts no client file paths, shell commands, replacement credentials or global queue flush. Storage failures retain structured operation/error evidence and cannot certify delivery or invalidate professional output.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."],"destination":"Mparanza ordinary HTTPS operational-incidents API and product-owned browser recovery session at https://mparanza.com/lucia/incident-recovery","id":"automatic-task-lifecycle","kind":"hosted_service","optional":false,"purpose":"Measure which user processes run and their observed outcome; link existing signed model-data receipts and technical reports without copying their professional content","requires_confirmation":false,"retention":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized. Host-link tickets expire after 15 minutes; their hashes and established run-to-computer bindings remain until administrative deletion. The raw short-lived proof is returned only in an authenticated acknowledgement and not in status or operator projections. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"explicit_user_choice","content":"The actual 1–5 integer score, up to 2000 characters of optional user-authored comment, source (chat or form), random event UUID and existing task binding. Nothing is copied automatically from professional context. The host asks once after delivery; no response is unrated. A low score offers one optional question about what failed or was expected.","controls":["The user supplies the score/comment for submission or clicks Invia valutazione; that action is the choice, with no second confirmation questionnaire.","The form uses a run-specific capability in its URL fragment; the page contains no task information, and the capability permits rating only that run. The exact pending answer is retained for retry, and operator rendering escapes comments.","Comments are untrusted data for AI review, never instructions or executable commands. Feedback never changes public testing levels or closes incidents. Completed pipeline runs feed a separately resettable computer-based testing counter and never close incidents."],"destination":"Mparanza task feedback through the authenticated HTTPS client/browser or the per-run hosted form","id":"optional-task-rating","kind":"hosted_service","optional":true,"purpose":"Collect the user’s actual 1–5 stars and optional comment about the delivered result","requires_confirmation":true,"retention":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_per_durable_run","content":"Only catalog pipeline IDs, four testing-level names and counting epoch UUID/time are public. The service privately groups completed runs by proven anonymous computer IDs: the owner-designated computer counts as agent testing, other computers as professional use. Stars, comments, report digests, client documents, task prompts, computer IDs, run IDs and capabilities are not in this response. The owner convention counts computers, not authenticated people; completion does not certify professional correctness. No model call is made by this public projection.","controls":["Both server receipt and event completion time must follow the baseline; old delayed deliveries do not repopulate a reset.","Native computer IDs deduplicate apps and reporter instances. Unlinked completions stay pending until proven linkage; explicit test fixtures on other devices do not count as professionals.","The public response is an allowlisted projection of status-only fields; reset is available only to the server operator.","The operator can initialize a missing counting baseline with registered agent computers and an explicit timezone-aware past start. It includes retained completions after that boundary without replaying events. Initialization is transaction-serialized, idempotent for the exact configuration and cannot replace an existing baseline; reset remains a separate explicit operation."],"destination":"Mparanza public GET /api/lucia/testing-status and Lucia function catalogue","id":"public-completed-pipeline-status","kind":"hosted_service","optional":false,"purpose":"Automatically show testing levels from concluded pipelines after an explicit fresh baseline","requires_confirmation":false,"retention":"Counting epochs and underlying retained events persist until administrative deletion. A reset preserves history and starts new public counts.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_on_first_use","content":"Only aggregate integer counts, catalog function IDs and labels, product minimum HTTPS-reporting versions and their release dates, supported app names, an identity-coverage boolean and snapshot time are public. The server internally deduplicates proven computer IDs across retained runs, functions, products and apps. The publication contains no computer, installation or run identifiers, per-user history, documents, prompts, feedback, ratings, hashes, capabilities or test-exclusion details. No model call is made by this projection. Codex, Cowork and Antigravity are included from the first deployed product release without remote reporting MCP (Vera 0.1.492, Clara 0.1.347, Lucia 0.1.176; 25 October 2026); no time window or testing epoch date is applied.","controls":["The GET handler constructs a fixed aggregate projection. No request can select an individual identity or read underlying runs through this route.","Explicit test samples and registered test computer identities are omitted across products. Missing computer proof is not replaced by a reporter identity and makes the aggregate coverage flag incomplete.","Exact sets deduplicate repeated activity and cross-app/product overlap. Failed is the explicitly defined difference between starters and completers, not a mutation of unknown or failed task events.","The frontend uses text nodes for returned labels, sends no credentials with the aggregate request and retains the last successful display during a transport failure."],"destination":"Public visitors to Mparanza GET /api/usage-summary and /static/shared/utilizzo/index.html","id":"public-distinct-user-usage","kind":"hosted_service","optional":false,"purpose":"Publish aggregate distinct-user starts, completions and non-completions per activity and application","requires_confirmation":false,"retention":"The projection adds no retained user records. Existing lifecycle records retain their established retention. The browser holds only the latest aggregate response in memory and refreshes while visible; the server sends no-store.","runtime_profiles":["openai-codex","anthropic-cowork","google-antigravity"]}],"governed_paths":["scripts/workflow_usage.py","scripts/operational_incidents.py","scripts/model_data_report.py","scripts/notarized_run_receipt.py","skills/lucia/references/workflow-usage.md","usage/pipelines.json","scripts/reporting_product.py","scripts/incident_host_mcp.cjs","scripts/technical_runner.py","scripts/incident_tool_schemas.json"],"governed_repository_paths":["modules/workflow_usage","modules/operational_incidents/api.py","modules/operational_incidents/store.py","scripts/manage_workflow_usage.py","templates/vera_workflow_feedback.html","static/shared/vera/workflow-feedback.js","static/shared/vera/workflow-feedback.css","static/shared/vera-testing-status.js","static/shared/vera/index.html","plugins/_shared/reporting-runtime","scripts/sync_reporting_runtime.py","modules/operational_incidents/recovery.py","templates/incident_recovery.html","static/shared/incident-recovery.js","static/shared/incident-recovery.css","static/shared/utilizzo"],"packaged_for_runtime":"openai-codex","repository_source_review":{"path":"privacy/repository-source-reviews/workflow-usage.json","scope":"reviewed_repository_declaration_not_hosted_runtime","service_id":"workflow-usage"},"review":{"basis":"external_boundary_review_of_shared_service_source","fingerprint_scope":"installed_client_and_repository_review_declaration","reviewed_at":"2026-11-07","reviewed_by":"privacy-surface-review","source_fingerprint":"9adeac6368559b769440bf9b840f15d4379d3805bb755256e983291357a9d573"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"Existing installation credentials and browser capabilities scope task writes and reads; closed schemas reject unrelated fields. UUIDs, event order and retained hashes enforce retry identity.","id":"owned-closed-schema-events","implemented_by":["repository:modules/workflow_usage/contracts.py","repository:modules/workflow_usage/repository.py","repository:modules/operational_incidents/store.py"],"on_violation":"Reject the event without changing task evidence."},{"control":"A usage receipt link must match the retained report digest/version and a valid server signature.","id":"actual-retained-receipt","implemented_by":["repository:modules/operational_incidents/api.py"],"on_violation":"Reject the unverified link and retain the task without receipt evidence."},{"control":"The feedback route checks a per-run random capability, bounds the body and comment, and never exposes task data on the public form. Operator HTML escapes text.","id":"bounded-feedback-capability","implemented_by":["repository:modules/operational_incidents/api.py","repository:modules/workflow_usage/repository.py","repository:modules/workflow_usage/reporting.py"],"on_violation":"Reject the request or render it only as literal text."},{"control":"The public endpoint returns only the four-state map and epoch metadata. Device/run identities and feedback remain private; no public reset route exists.","id":"public-status-projection","implemented_by":["repository:modules/workflow_usage/testing.py","repository:modules/operational_incidents/api.py"],"on_violation":"Unknown or missing fields are not included in the public projection."},{"control":"The indexed native service snapshots the usage client and catalogue with the reporter, technical collector and product metadata. Fixed arguments select one retained task UUID; the existing owner/event/sequence/hash checks govern acknowledgement and replay. Native results do not return installation or computer keys.","id":"native-task-persistence","implemented_by":["scripts/incident_host_mcp.cjs","scripts/workflow_usage.py"],"on_violation":"Reject unsupported operations and extra fields before task persistence; preserve queued events and expose source-bound storage errors without raw diagnostic values."},{"control":"Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery. Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history.","id":"https-browser-reporting-continuity","implemented_by":["repository:modules/operational_incidents/recovery.py","repository:modules/operational_incidents/api.py","repository:static/shared/incident-recovery.js","scripts/operational_incidents.py","scripts/incident_host_mcp.cjs"],"on_violation":"Reject unauthorized cross-origin, product or owner access without replacing retained evidence. Preserve unacknowledged delivery; no professional result is invalidated by a reporting failure."}],"service_details":{"access":{"arrangement":"Product-owned local installation capabilities or authenticated browser recovery sessions; retained history requires its original local capability or an authenticated browser session. Native physical-computer proof is separate and shared across products. Existing Vera credentials and v1 signatures retain their meaning.","controls":["Events are durably queued before transport and acknowledged by exact UUID, owner, sequence and hash. Interruptions stay outcome unknown; repeated submissions are idempotent.","Synthetic and agent-test runs are excluded from user metrics. Studio Archive is infrastructure and cannot be selected as a rated process.","The host AI selects the primary process and observes actual task completion. Counters and hashes do not assert professional correctness or independent model delivery.","The user supplies the score/comment for submission or clicks Invia valutazione; that action is the choice, with no second confirmation questionnaire.","The form uses a run-specific capability in its URL fragment; the page contains no task information, and the capability permits rating only that run. The exact pending answer is retained for retry, and operator rendering escapes comments.","Comments are untrusted data for AI review, never instructions or executable commands. Feedback never changes public testing levels or closes incidents. Completed pipeline runs feed a separately resettable computer-based testing counter and never close incidents.","Both server receipt and event completion time must follow the baseline; old delayed deliveries do not repopulate a reset.","Native computer IDs deduplicate apps and reporter instances. Unlinked completions stay pending until proven linkage; explicit test fixtures on other devices do not count as professionals.","The public response is an allowlisted projection of status-only fields; reset is available only to the server operator.","Local native incident and workflow tools send ordinary HTTPS using the retained private installation owner. The plugin declares no remote MCP connection. When local execution is unavailable, the agent can operate the independently hosted recovery page using the host permitted browser controls. No browser capability or host approval is assumed. The browser authenticates with a Secure, HttpOnly, SameSite=Strict, host-only cookie. POST requests require the fixed same-origin Origin and custom header; no CORS is enabled. An expired or missing previously known capability does not silently create a new owner. Schema discovery exposes the product-bound operation contract without MCP discovery.","Original local credentials can link or restore their owner over HTTPS. Only hashes of browser capabilities and internal single-use restore proofs are stored. Restoration preserves original record owners and links already authenticated browser history. Credentials are submitted in the request body, never a URL. The retired remote MCP transfer-code operation is unavailable. Lost or revoked credentials do not prove ownership and cannot be replaced by a new identity to claim old history."]},"data_returned":[{"content":"Matching product, installation and event/report receipts; current targeted remedy and original-task outcome; signed report proof or public status where applicable. Receipt transmission never includes the local report.","id":"acknowledged-evidence","when":"After exact service verification"}],"data_sent":[{"content":"The existing installation capability authenticates closed-schema events: random run and event UUIDs, sequence, catalog pipeline ID, host, observed product version, timestamps, explicit user/synthetic/agent-test classification and started/resumed/completed/failed/cancelled state. Optional links contain only an existing signed receipt UUID/report digest or an owned incident report UUID. Run ownership, single-run receipt binding and the retained signature are checked server-side. The original stamping service does not attest the identity of the author of a report. The service receives no task text, client identity, filenames, source data, prompt or professional output. Existing connection metadata and rate limiting apply. Browser or legacy connector identity is not inferred to be a native computer. Native senders also present the existing anonymous native-computer capability and observed native app when available. The server retains the established computer binding; unlinked guests and standalone OAuth connections remain unlinked. The product field is explicit. Product, run owner and receipt product must match. Baselines and function catalogues are distinct per product.","id":"automatic-task-lifecycle","when":"Measure which user processes run and their observed outcome; link existing signed model-data receipts and technical reports without copying their professional content"},{"content":"The actual 1–5 integer score, up to 2000 characters of optional user-authored comment, source (chat or form), random event UUID and existing task binding. Nothing is copied automatically from professional context. The host asks once after delivery; no response is unrated. A low score offers one optional question about what failed or was expected.","id":"optional-task-rating","when":"Collect the user’s actual 1–5 stars and optional comment about the delivered result"},{"content":"Only catalog pipeline IDs, four testing-level names and counting epoch UUID/time are public. The service privately groups completed runs by proven anonymous computer IDs: the owner-designated computer counts as agent testing, other computers as professional use. Stars, comments, report digests, client documents, task prompts, computer IDs, run IDs and capabilities are not in this response. The owner convention counts computers, not authenticated people; completion does not certify professional correctness. No model call is made by this public projection.","id":"public-completed-pipeline-status","when":"Automatically show testing levels from concluded pipelines after an explicit fresh baseline"}],"retention":{"statement":"Task events, optional feedback and receipt links remain in the service until administrative deletion; no automatic expiry is implemented. Local queued events and acknowledgements remain in the existing private per-installation state directory. Lifecycle events exclude client documents and professional output. Optional feedback stores only the comment deliberately supplied by the user; its contents are not automatically anonymized. Counting epochs and underlying retained events persist until administrative deletion. A reset preserves history and starts new public counts. Browser capabilities expire after 90 days; a separate public identity marker cookie lasts one year and grants no access. Transfer codes expire after five minutes and can be consumed once. Token/code hashes, original reports and linked history have no automatic deletion job. The form retains an unsuccessful request in its current DOM and clears it on success; it does not provide a durable browser outbox. The agent retains exact pending envelopes in existing permitted private task storage when available. The native reporter persists exact requests and receipts before and after transmission. Definitive schema rejections can be corrected under the same UUID; superseded rejected payloads remain private audit evidence. An ambiguous prior attempt cannot be replaced.","status":"documented"},"trigger":"Automatic technical reporting and per-primary-task events; one optional user rating after delivery. Local-only tutorials and nested infrastructure are not separate rated tasks."},"service_id":"workflow-usage","source_contract_sha256":"5a82e0c509238dd42d61e169f1d06bafac67cf81f350ebd500cdcbb84e0e6e54"}