Telemetry Privacy Contract (telemetry/contract.ts)

Machine-enforced allowlist of telemetry events, keys, and bucketed values. Unknown events and keys are dropped so only audited properties leave the process. Reuse when product metrics must not carry paths or free-form strings.

// Source: https://github.com/trailhq/Trail-Code | License: MIT | Copyright 2026 Context Graph Engine contributors
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * The telemetry contract: the complete, machine-enforced list of what graft may
 * send. `TELEMETRY.md` is the same list in prose, and the two are kept in
 * lockstep — an event or property that is not in this file cannot be sent, and
 * one that is not in `TELEMETRY.md` must not be added here.
 *
 * Why an allowlist rather than a review rule: every telemetry incident in the
 * tools we studied came from a call site quietly adding a property nobody
 * audited. `track()` (track.ts) drops unknown events and unknown keys instead of
 * trusting its callers, so a future `track('query', { path })` sends `query`
 *

... (truncated -- full source via MCP)