feat(cli): point telemetry at the EU PostHog project by javirln · Pull Request #3421 · chainloop-dev/chainloop

javirln · 2026-09-09T08:51:29Z

Points the CLI telemetry at the EU PostHog project through t.chainloop.dev, and fixes two problems in the events themselves.

Telemetry destination

The endpoint and key now target the EU project. Both stay in-source defaults so builds outside the release pipeline (Homebrew, go install) keep reporting, and GoReleaser consumes POSTHOG_API_KEY / POSTHOG_ENDPOINT when they are set, falling back to those defaults otherwise. The release workflow already exported both secrets but nothing read them, so the endpoint was effectively a constant; it is now a release-time input.

The endpoint is compiled in and has no runtime override, so binaries released before this change keep reporting to crb.chainloop.dev. That host stays frozen on the previous project rather than being repointed, and the sandbox egress allowlist keeps both hosts so older tags still work in a sandbox.

Group assignment

Setting the organization group replaced the groups map instead of adding to it, so cp_installation was dropped from every event that carried an organization. Since only API tokens carry an org id, this split all traffic in two: API-token events had organization alone, everything else had cp_installation alone, and no event ever carried both. Installation-level aggregation therefore never saw CI traffic, and installations used exclusively from CI with an API token were absent from it entirely.

Both groups now travel together on a single event. The underlying values were always present as event properties, so this restores the group dimension rather than recovering lost data, and it does not backfill history.

organization remains API-token-only, because user and federated tokens do not carry an org id at that point in the command lifecycle. This makes the index assignment stable and both groups present when known; giving user-token events an organization group needs the org UUID on the telemetry path and is left as a follow-up.

Alias volume

An alias between the machine and the account was enqueued on every authenticated command, making $create_alias roughly a third of the project's total event volume. It is now limited to interactive user sessions outside CI, which is the only case where stitching a pre-login machine identity onto an account is meaningful. API tokens belong to an organization rather than a person, and federated tokens resolve to the issuer URL, which is identical across installations, so aliasing those merged unrelated CI runners into a single person.

Refs PFM-7213.

AI assistance: this change was produced with Claude Code. Affected commits carry an Assisted-by: trailer, per AI_POLICY.md.

The CLI telemetry endpoint and key now target the EU project via t.chainloop.dev. The endpoint is compiled in and has no runtime override, so crb.chainloop.dev stays frozen on the previous project to keep serving binaries released before this change, and the sandbox egress allowlist keeps both hosts. Both values were already overridable with -X but nothing consumed the release secrets, so every released binary shipped the hardcoded value. GoReleaser now reads them when present and falls back to the compiled-in defaults otherwise, which keeps builds outside the release pipeline working. Two fixes to the events themselves: - The organization group replaced the groups map instead of adding to it, so cp_installation was dropped from every event that carried an org. Both groups now travel together on a single event. - An alias between the machine and the account was emitted on every authenticated command, which accounted for a third of all events. It is now limited to interactive user sessions; API and federated tokens are shared identities running on ephemeral machines, where aliasing merges unrelated runners into one person. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 1c4d66be-c354-41b4-b484-81ddadcfc0a1

chainloop-platform · 2026-09-09T08:51:39Z

AI Session Checks — 🟢 89% · ⚠️ 2 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 89%	1	⚠️ 2	100% AI / 0% Human	7	+323 / -34	2h22m2s

🟢 89% — 100% AI — ⚠️ 2 policies failing

Sep 9, 2026 07:42 UTC · 2h22m2s · $94.87 · 1.3k in / 533.1k out · claude-code 2.1.266 (claude-opus-5)

View session details ↗

Change Summary

Points CLI telemetry at t.chainloop.dev while keeping legacy crb.chainloop.dev support.
Fixes PostHog group handling and limits aliases to interactive user sessions, with new telemetry tests.
Shares the telemetry flush timeout across the CLI hook and PostHog client.
Corrects the sandbox egress comment about blocked telemetry behavior.

AI Session Overall Score

🟢 89% — Well-planned, well-verified telemetry work with only minor late-session course corrections.

AI Session Analysis Breakdown

🟢 94% · verification

🟢 The AI wrote failing telemetry tests first and reran them green. · High Impact

🟢 93% · context-and-planning

🟢 A detailed plan with constraints and verification landed before edits. · High Impact

🟢 91% · solution-quality

No notes.

🟢 90% · scope-discipline

🟢 The AI rebased out the extra outcome work when the user asked to drop it. · High Impact

🟢 84% · alignment

🟡 The AI used a throwaway US-targeted binary instead of literally repointing source for verification. · Low Severity

🟡 72% · user-trust-signal

🟠 The user had to correct the wrong telemetry comment and then discard the extra outcome commit. · Medium Severity

💡 When a follow-up starts widening, restate the minimal requested delta before committing.

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	`app/cli/internal/telemetry/posthog/tracker_internal_test.go`	+192 / -0
modified	ai	`app/cli/internal/telemetry/posthog/posthog.go`	+31 / -19
modified	ai	`app/cli/internal/telemetry/telemetry_test.go`	+45 / -1
modified	ai	`app/cli/cmd/root.go`	+14 / -9
modified	ai	`app/cli/internal/telemetry/telemetry.go`	+22 / -1
modified	ai	`devel/sandbox-kit/spec.yaml`	+11 / -4
modified	ai	`.goreleaser.yml`	+8 / -0

Policies (4, 2 failing)

Status	Policy	Material	Messages
✅ Passed	`ai-config-ai-agents-allowed`	`ai-coding-session-1c4d66`	-
✅ Passed	`ai-config-no-dangerous-commands`	`ai-coding-session-1c4d66`	-
⚠️ Failed	`ai-config-no-secrets`	`ai-coding-session-1c4d66`	Secret (generic-api-key) was redacted from session content [turn=876, source=tool_result, line=1] Secret (generic-password) was redacted from session content [turn=225, source=tool_result, line=4] Secret (generic-password) was redacted from session content [turn=69, source=tool_result, line=74] Secret (generic-password) was redacted from session content [turn=71, source=tool_result, line=23] Secret (posthog-project-api-key) was redacted from session content [turn=0, source=user-message, line=11] Secret (posthog-project-api-key) was redacted from session content [turn=0, source=user-message, line=6] Secret (posthog-project-api-key) was redacted from session content [turn=100, source=tool_result, line=178] Secret (posthog-project-api-key) was redacted from session content [turn=107, source=tool_result, line=20] Secret (posthog-project-api-key) was redacted from session content [turn=1086, source=tool_result, line=1] Secret (posthog-project-api-key) was redacted from session content [turn=1110, source=assistant-tool_use:Bash, line=5] Secret (posthog-project-api-key) was redacted from session content [turn=1180, source=tool_result, line=3] Secret (posthog-project-api-key) was redacted from session content [turn=120, source=tool_result, line=3] Secret (posthog-project-api-key) was redacted from session content [turn=139, source=tool_result, line=107] Secret (posthog-project-api-key) was redacted from session content [turn=1434, source=tool_result, line=2] Secret (posthog-project-api-key) was redacted from session content [turn=154, source=tool_result, line=37] Secret (posthog-project-api-key) was redacted from session content [turn=156, source=tool_result, line=7] Secret (posthog-project-api-key) was redacted from session content [turn=16, source=tool_result, line=103] Secret (posthog-project-api-key) was redacted from session content [turn=164, source=tool_result, line=23] Secret (posthog-project-api-key) was redacted from session content [turn=169, source=assistant-text, line=11] Secret (posthog-project-api-key) was redacted from session content [turn=169, source=assistant-text, line=254] Secret (posthog-project-api-key) was redacted from session content [turn=179, source=tool_result, line=10] Secret (posthog-project-api-key) was redacted from session content [turn=179, source=tool_result, line=15] Secret (posthog-project-api-key) was redacted from session content [turn=185, source=tool_result, line=6] Secret (posthog-project-api-key) was redacted from session content [turn=186, source=tool_result, line=19] Secret (posthog-project-api-key) was redacted from session content [turn=207, source=assistant-text, line=115] Secret (posthog-project-api-key) was redacted from session content [turn=207, source=assistant-text, line=130] Secret (posthog-project-api-key) was redacted from session content [turn=207, source=assistant-text, line=181] Secret (posthog-project-api-key) was redacted from session content [turn=207, source=assistant-text, line=233] Secret (posthog-project-api-key) was redacted from session content [turn=207, source=assistant-text, line=33] Secret (posthog-project-api-key) was redacted from session content [turn=2115, source=tool_result, line=2] Secret (posthog-project-api-key) was redacted from session content [turn=2119, source=assistant-text, line=54] Secret (posthog-project-api-key) was redacted from session content [turn=2119, source=assistant-text, line=8] Secret (posthog-project-api-key) was redacted from session content [turn=293, source=queue-operation, line=18] Secret (posthog-project-api-key) was redacted from session content [turn=293, source=queue-operation, line=261] Secret (posthog-project-api-key) was redacted from session content [turn=298, source=queue-operation, line=18] Secret (posthog-project-api-key) was redacted from session content [turn=298, source=queue-operation, line=261] Secret (posthog-project-api-key) was redacted from session content [turn=30, source=tool_result, line=45] Secret (posthog-project-api-key) was redacted from session content [turn=37, source=tool_result, line=2] Secret (posthog-project-api-key) was redacted from session content [turn=387, source=queue-operation, line=122] Secret (posthog-project-api-key) was redacted from session content [turn=387, source=queue-operation, line=137] Secret (posthog-project-api-key) was redacted from session content [turn=387, source=queue-operation, line=188] Secret (posthog-project-api-key) was redacted from session content [turn=387, source=queue-operation, line=240] Secret (posthog-project-api-key) was redacted from session content [turn=387, source=queue-operation, line=40] Secret (posthog-project-api-key) was redacted from session content [turn=398, source=queue-operation, line=122] Secret (posthog-project-api-key) was redacted from session content [turn=398, source=queue-operation, line=137] Secret (posthog-project-api-key) was redacted from session content [turn=398, source=queue-operation, line=188] Secret (posthog-project-api-key) was redacted from session content [turn=398, source=queue-operation, line=240] Secret (posthog-project-api-key) was redacted from session content [turn=398, source=queue-operation, line=40] Secret (posthog-project-api-key) was redacted from session content [turn=48, source=tool_result, line=16] Secret (posthog-project-api-key) was redacted from session content [turn=500, source=assistant-tool_use:Write, line=1] Secret (posthog-project-api-key) was redacted from session content [turn=561, source=tool_result, line=51] Secret (posthog-project-api-key) was redacted from session content [turn=61, source=tool_result, line=99] Secret (posthog-project-api-key) was redacted from session content [turn=699, source=assistant-tool_use:Bash, line=10] Secret (posthog-project-api-key) was redacted from session content [turn=699, source=assistant-tool_use:Bash, line=25] Secret (posthog-project-api-key) was redacted from session content [turn=701, source=tool_result, line=13] Secret (posthog-project-api-key) was redacted from session content [turn=76, source=tool_result, line=54] Secret (posthog-project-api-key) was redacted from session content [turn=795, source=tool_result, line=30] Secret (posthog-project-api-key) was redacted from session content [turn=795, source=tool_result, line=32] Secret (posthog-project-api-key) was redacted from session content [turn=81, source=tool_result, line=9] Secret (posthog-project-api-key) was redacted from session content [turn=831, source=tool_result, line=2] Secret (posthog-project-api-key) was redacted from session content [turn=836, source=tool_result, line=11] Secret (posthog-project-api-key) was redacted from session content [turn=89, source=assistant-tool_use:Bash, line=1] Secret (posthog-project-api-key) was redacted from session content [turn=91, source=tool_result, line=21] Secret (posthog-project-api-key) was redacted from session content [turn=94, source=tool_result, line=28]
⚠️ Failed	`ai-config-mcp-servers-allowed`	`ai-coding-session-1c4d66`	MCP server 'claude_ai_PostHog' is not in the allowed list

Security Checks — ✅ 8 passing

✅ `secret-scan`

Status	Policy	Messages
✅ Passed	`secrets-detection`	-

✅ `sast-scan`

Status	Policy	Messages
✅ Passed	`cwe-top25`	-
✅ Passed	`owasp-top10-2025`	-
✅ Passed	`sast`	-
✅ Passed	`cwe-top26-40-cusp`	-

✅ `iac-scan`

Status	Policy	Messages
✅ Passed	`iac-misconfiguration`	-

PR info

Status	Policy	Messages
✅ Passed	`pr-description-required`	-
✅ Passed	`pr-user-story-linked`	-

⏭️ 2 scans not applied

Scan	Reason
`vulnerability-scan`	no manifest/lockfile changed
`github-actions-scan`	no workflow files changed

View attestation ↗

Powered by Chainloop and Chainloop Trace

The PostHog client's shutdown deadline and the deadline the command hook waits on were two separate literals that happened to hold the same value. Both now read a single constant, so they cannot drift apart. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 1c4d66be-c354-41b4-b484-81ddadcfc0a1

cubic-dev-ai

All reported issues were addressed across 7 files

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

The note claimed a blocked telemetry endpoint stalls every command and stops it failing cleanly. Neither holds: commands run and exit normally regardless of telemetry, commands that skip control plane initialization are unaffected, and a refused connection or an unresolvable host costs nothing. Only a silently dropped connection is slow, and only for tracked commands, which then wait on the send deadline. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez <javier@chainloop.dev> Chainloop-Trace-Sessions: 1c4d66be-c354-41b4-b484-81ddadcfc0a1

javirln marked this pull request as ready for review September 9, 2026 09:18

javirln requested review from a team and danlishka September 9, 2026 09:19

cubic-dev-ai Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread app/cli/internal/telemetry/posthog/tracker_internal_test.go

jiparis previously approved these changes Sep 9, 2026

View reviewed changes

Comment thread devel/sandbox-kit/spec.yaml Outdated

javirln dismissed jiparis’s stale review via 351e9bd September 9, 2026 10:05

jiparis approved these changes Sep 9, 2026

View reviewed changes

javirln merged commit 003d344 into chainloop-dev:main Sep 9, 2026
16 of 17 checks passed

Navigation Menu

Repository navigation

feat(cli): point telemetry at the EU PostHog project - #3421

feat(cli): point telemetry at the EU PostHog project#3421
javirln merged 3 commits into
chainloop-dev:mainfrom
javirln:javier/pfm-7213-point-the-chainloop-cli-telemetry-at-posthog-eu

javirln commented Sep 9, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

chainloop-platform Bot commented Sep 9, 2026 •

edited

Loading

🟢 89% — 100% AI — ⚠️ 2 policies failing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 94% · verification

🟢 93% · context-and-planning

🟢 91% · solution-quality

🟢 90% · scope-discipline

🟢 84% · alignment

🟡 72% · user-trust-signal

File Attribution

Policies (4, 2 failing)

⏭️ 2 scans not applied

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

javirln commented Sep 9, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Telemetry destination

Group assignment

Alias volume

Uh oh!

chainloop-platform Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AI Session Checks — 🟢 89% · ⚠️ 2 failing

🟢 89% — 100% AI — ⚠️ 2 policies failing

Change Summary

AI Session Overall Score

AI Session Analysis Breakdown

🟢 94% · verification

🟢 93% · context-and-planning

🟢 91% · solution-quality

🟢 90% · scope-discipline

🟢 84% · alignment

🟡 72% · user-trust-signal

File Attribution

Policies (4, 2 failing)

Security Checks — ✅ 8 passing

✅ secret-scan

✅ sast-scan

✅ iac-scan

PR info

⏭️ 2 scans not applied

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

javirln commented Sep 9, 2026 •

edited by cubic-dev-ai Bot

Loading

chainloop-platform Bot commented Sep 9, 2026 •

edited

Loading

✅ `secret-scan`

✅ `sast-scan`

✅ `iac-scan`

cubic-dev-ai Bot left a comment •

edited

Loading