Tiered telemetry — RED, YELLOW, diagnostic
CareerVector has no user accounts, so it cannot beg-permission on signup or attach a user-level consent record. Telemetry is workspace-scoped and graduated by impact so the default level says only what is needed to keep the service alive and the deepest level is opt-in per session.
The three tiers
| Tier | Default | What it emits | Where it lands |
|---|---|---|---|
| RED | Always on | Coarse counters: workspace-open, pipeline-stage-completion, fatal error class | Aggregated, no payloads |
| YELLOW | Always on, sampled | Stage timings, provider error codes, queue depth | Bucketed aggregates only |
| GREEN / diagnostic | Opt-in per workspace, per session | Full event traces, op IDs, request IDs, latency breakdowns | Time-boxed window, expires automatically |
RED is what tells us "is the service alive". YELLOW is what tells us "is a provider degraded". Diagnostic is what a workspace owner enables when they are reporting a bug and need the dev to see the actual sequence.
No tier includes job content, profile prose, or workspace IDs that would re-identify a user. Diagnostic is the only tier with structured event payloads, and the opt-in is per workspace, per session — closing the tab ends the diagnostic window.
Diagnostic opt-in
The opt-in lives on the diagnostic toggle inside the toolbar. Toggling it on flips a workspace-scoped flag (not localStorage — peers should see the window is open) and starts emitting GREEN-tier events; toggling it off stops the stream immediately. A timer auto-expires the window after a fixed ceiling so a forgotten toggle does not leak indefinitely.
The same toggle gates the wire SDK in ui/src/lib/telemetry/wire-sdk.ts —
the SDK only attaches diagnostic-tier event handlers when the flag is set,
so the cost of GREEN is paid only by sessions that asked for it.
Internal analytics dashboard
ui/src/routes/admin/analytics/+page.svelte is the operator view over the
aggregated stream. It does not surface raw GREEN events; it surfaces:
- RED counters over time
- YELLOW provider-error rate
- Stage timing percentiles
- Active diagnostic windows (count, not contents)
The route is gated by ADMIN_TOKEN, not by any user identity — see
no-user-accounts.md for why product surfaces never authenticate, but
administrative surfaces do via shared bearer.
What this is not
- Not product analytics (DAU/MAU). The workspace is the identity unit, and the workspace is anonymous-by-construction.
- Not a tracing system. We do not promise distributed traces for every request — only the diagnostic window does, and only for the opted-in workspace.
- Not a substitute for the journal hub in the knowledge graph. Operational incidents still need a journal entry that interprets the telemetry events.