privacy/services/plugin-feedback.json

{"display_name":"Mparanza Plugin Feedback","external_boundaries":[{"activation":"explicit_user_choice","content":"Schema version, problem or capability kind, plugin name and version, idempotency identifier, and the selected JSON request. Problem reports must include occurred time, runtime, operation, reproduction, and at least one bounded diagnostic evidence string. The helper enforces that mechanical shape but does not detect personal data, judge semantic sufficiency, or anonymize the file. The current workflow shows proposed suggestion text before submission. New observed failures use automatic incident reporting; this legacy helper remains available for existing change requests. The shared API also admits partial diagnostics when every missing time/runtime/operation or reproduction value has an explicit reason and bounded evidence remains. Clara's existing client still requires its complete diagnostic shape; the broader server admission does not expand what that client submits.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"approved-text-request","kind":"hosted_service","optional":true,"purpose":"For an explicitly requested feature suggestion or a legacy approved change-request submission","requires_confirmation":true,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"explicit_user_choice","content":"Submission timestamp, operating-system family, Python version, and the fixed plugin-change-request client identifier. The helper does not collect a username, path, environment value, document, account identifier, or stable device identifier.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"automatic-client-context","kind":"hosted_service","optional":true,"purpose":"With an approved text problem or suggestion submission","requires_confirmation":true,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"explicit_user_choice","content":"Change-request identifier, locally held opaque status token, idempotent evidence-update identifier, bounded summary, and one or more sanitized evidence strings. The original request and client or case material are not resent.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"approved-follow-up-evidence","kind":"hosted_service","optional":true,"purpose":"After status polling returns a specific needs-information question and the user approves the exact sanitized answer","requires_confirmation":true,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"explicit_user_choice","content":"Plugin name and version, generic client-free opportunity text, language, and submission identifier; the participant's later hosted explanation is outside the text-submission payload. The service creates a prepared Hosted Interviews session for the plugin-improvement campaign; subsequent microphone audio, transcript, events and review use that service, with its separately recorded retained-session boundary.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"optional-suggestion-interview","kind":"hosted_service","optional":true,"purpose":"After the user separately chooses the short hosted voice route for a general improvement suggestion","requires_confirmation":true,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_after_prior_submission","content":"Change-request identifier and opaque status token for every locally stored receipt selected by the checker, including resolved requests; no original case or request text is resent by this poll.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"automatic-status-poll","kind":"hosted_service","optional":false,"purpose":"On SessionStart when stored request receipts exist","requires_confirmation":false,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]},{"activation":"automatic_after_prior_connection","content":"Connection recovery, browser playback-blocked and microphone mute/unmute events are stored by Mparanza with the active attempt. Page departure can finalise already received transcripts and audio for post-call processing. The microphone energy meter is computed and displayed locally in the browser; no meter samples are uploaded. Interrupted evidence remains stored and retryable under the existing interview retention arrangement.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."],"destination":"Mparanza plugin change-request service","id":"interview-recovery-events","kind":"hosted_service","optional":false,"purpose":"During the hosted microphone interview and when the participant leaves its page","requires_confirmation":false,"retention":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"]}],"governed_paths":["skills/clara/SKILL.md","scripts/change_requests.py","scripts/check_change_requests.py","scripts/check_for_update.py","hooks/cowork-hooks.json"],"governed_repository_paths":["modules/change_requests/api.py","modules/change_requests/store.py","modules/hosted_services/api.py","modules/pdp/legal_content.py","modules/hosted_interviews/api.py","modules/hosted_interviews/job_state.py","modules/hosted_interviews/review_service.py"],"packaged_for_runtime":"openai-codex","repository_source_review":{"path":"privacy/repository-source-reviews/plugin-feedback.json","scope":"reviewed_repository_declaration_not_hosted_runtime","service_id":"plugin-feedback"},"review":{"basis":"external_boundary_review_of_shared_service_source","fingerprint_scope":"installed_client_and_repository_review_declaration","reviewed_at":"2026-11-04","reviewed_by":"privacy-surface-review","source_fingerprint":"2fa58c1624fbb9c6b86d0210f4f4e4b89061553b9fb009fee57a2cf756e7d4ae"},"runtime_profiles":["openai-codex","anthropic-cowork","openai-chatgpt","google-antigravity"],"schema_version":2,"security_controls":[{"control":"The helper restricts remote requests to the Mparanza HTTPS origin and bounds request and response sizes before storing a receipt.","id":"fixed-origin-and-bounded-payloads","implemented_by":["scripts/change_requests.py"],"on_violation":"Reject invalid destinations or oversized/unregistered submission fields."},{"control":"Clara's client rejects incomplete problem diagnostics. The shared service accepts complete diagnostics or explicitly explained missing values with bounded evidence; it rejects unexplained or contradictory missing fields. Token-authorized follow-up evidence remains bounded and idempotent.","id":"bounded-diagnostic-contract","implemented_by":["scripts/change_requests.py","repository:modules/change_requests/api.py"],"on_violation":"Reject malformed technical context instead of copying arbitrary task logs."}],"service_details":{"access":{"arrangement":"The client submits to fixed Mparanza HTTPS endpoints and stores the returned opaque status token locally. In Claude Cowork that state is stored under CLAUDE_PLUGIN_DATA; in the OpenAI package it uses the plugin's existing private local state. Plugin source does not establish who inside Mparanza can access request content. Optional suggestion interviews exist only in the OpenAI package and use a returned Mparanza browser URL. Exact-text consent and sanitization are workflow obligations; the CLI does not authenticate consent or detect identifying information. Status tokens authorize status and evidence operations and must be treated as credentials. The default HTTP transport can retry a specific certificate error using a normal verified TLS context with X.509 strict-mode validation disabled; hostname and certificate verification remain enabled. Base-URL validation is not DNS pinning or a general redirect sandbox.","controls":["Remote requests are restricted to HTTPS mparanza.com or www.mparanza.com outside local tests.","Payload and response sizes are bounded.","A durable idempotency record prevents a network retry from creating a second request.","Problem files without the required bounded diagnostic shape are rejected before transmission.","Claude Cowork does not package the hosted voice interview or custom version-update client.","Follow-up evidence requires the locally stored opaque status token and a separate idempotent update identifier."]},"data_returned":[{"content":"Change-request identifier, opaque status token, legacy open or fixed release status, explicit disposition, needs-information question when applicable, fixed version when available, and validated install URL","id":"submission-receipt","when":"After a successful problem or suggestion submission"},{"content":"Mparanza interview URL and associated durable receipt fields","id":"suggestion-interview-link","when":"After creating the optional one-minute suggestion interview"},{"content":"Whether each request exists, its legacy release status, explicit disposition, needs-information question when applicable, fixed version, and install URL","id":"status-update","when":"During automatic polling of previously submitted requests"}],"data_sent":[{"content":"Schema version, problem or capability kind, plugin name and version, idempotency identifier, and the selected JSON request. Problem reports must include occurred time, runtime, operation, reproduction, and at least one bounded diagnostic evidence string. The helper enforces that mechanical shape but does not detect personal data, judge semantic sufficiency, or anonymize the file. The current workflow shows proposed suggestion text before submission. New observed failures use automatic incident reporting; this legacy helper remains available for existing change requests. The shared API also admits partial diagnostics when every missing time/runtime/operation or reproduction value has an explicit reason and bounded evidence remains. Clara's existing client still requires its complete diagnostic shape; the broader server admission does not expand what that client submits.","id":"approved-text-request","when":"For an explicitly requested feature suggestion or a legacy approved change-request submission"},{"content":"Submission timestamp, operating-system family, Python version, and the fixed plugin-change-request client identifier. The helper does not collect a username, path, environment value, document, account identifier, or stable device identifier.","id":"automatic-client-context","when":"With an approved text problem or suggestion submission"},{"content":"Change-request identifier, locally held opaque status token, idempotent evidence-update identifier, bounded summary, and one or more sanitized evidence strings. The original request and client or case material are not resent.","id":"approved-follow-up-evidence","when":"After status polling returns a specific needs-information question and the user approves the exact sanitized answer"},{"content":"Plugin name and version, generic client-free opportunity text, language, and submission identifier; the participant's later hosted explanation is outside the text-submission payload. The service creates a prepared Hosted Interviews session for the plugin-improvement campaign; subsequent microphone audio, transcript, events and review use that service, with its separately recorded retained-session boundary.","id":"optional-suggestion-interview","when":"After the user separately chooses the short hosted voice route for a general improvement suggestion"},{"content":"Change-request identifier and opaque status token for every locally stored receipt selected by the checker, including resolved requests; no original case or request text is resent by this poll.","id":"automatic-status-poll","when":"On SessionStart when stored request receipts exist"},{"content":"Connection recovery, browser playback-blocked and microphone mute/unmute events are stored by Mparanza with the active attempt. Page departure can finalise already received transcripts and audio for post-call processing. The microphone energy meter is computed and displayed locally in the browser; no meter samples are uploaded. Interrupted evidence remains stored and retryable under the existing interview retention arrangement.","id":"interview-recovery-events","when":"During the hosted microphone interview and when the participant leaves its page"}],"retention":{"statement":"Submitted feedback remains a Mparanza support record until administrative deletion. The plugin also stores local pending payloads, receipts, and status tokens for retry and status notification until local plugin state is removed. Hosted suggestion interview sessions have their own retained records/media under Hosted Interviews; finishing or expiring the link does not delete them. Local state writes use mode 0600 where supported and retain retry payloads, receipts and tokens; this does not erase separately saved approved request files or establish provider/log retention. Hosted interview temporary audio assembly is session-owned and removed on normal worker exit or the next lock-protected inspection/dispatch after interruption; active work is preserved and cleanup failure propagates. This does not delete the original retained interview media or establish a timed cleanup guarantee.","status":"documented"},"trigger":"An explicit feature or capability suggestion uses the existing change-request route after the user sees the proposed sanitized text. Observed technical failures use the separate automatic operational-incidents service. Existing legacy receipts may still be polled for status or answered through the legacy route."},"service_id":"plugin-feedback","source_contract_sha256":"f95d732eec32564b2a7119b9f79476e3524ca6109b3f44d238571a7f7c6706e8"}