feat(telemetry): Tier-2 opt-in fleet sharing — consent + egress + backfill (ent#12)

[dolho]

ent#12 — Tier-2 opt-in fleet sharing (OSS consent + egress + backfill)

The opt-in egress layer on top of Tier-1 (ent#184). Default-OFF, reversible. Gating shape confirmed: OSS-core consent+egress+backfill, enterprise-gated benchmark carrot.

⚠️ Stacked on #1721 (ent#184). Base is the ent#184 branch so this diff shows only Tier-2 — retarget to dev when #1721 merges.

Never egresses without consent — two independent gates

Both re-checked in share_now: the stored telemetry_sharing_enabled consent (default-off) AND the config switch TELEMETRY_SHARING_ENABLED (honors DO_NOT_TRACK). Either off ⇒ nothing leaves the box.

What ships

• services/telemetry_sharing_service.py — consent state, build_aggregate_payload (anonymized: install id + version/edition/platform/python + coarse enterprise_features + agent/execution counts + Tier-1 funnel counts; no PII, content, prompts, emails, agent names), share_now (gated, fail-open, honest 2xx), and a sleeps-first jittered heartbeat (default 24h). Reuses the operator-intake Task Actions UI #38 credential-free transport.
• Retroactive backfill at consent — on off→on, an immediate fire-and-forget backfill over a disclosed window (default 30d) from Tier-1 product_events.
• API — GET /api/settings/telemetry-sharing (status + inspectable payload_preview — see exactly what would be sent before consenting) + PUT (admin + human-only, audit-logged, 409 when hard-disabled). feature-flags exposes telemetry_sharing_enabled.
• Frontend — value-framed optional non-blocking wizard ask (hidden when hard-disabled) + reversible default-off Settings → General panel with payload preview + backfill picker; the gated funnel panel shows the benchmark status.
• Docs — docs/PRODUCT_EVENTS.md Tier-2 section (schema + reversibility + backfill) + requirements §45.1.

AC coverage

• Consent surface in wizard (value-framed) + Settings toggle (default-off, reversible), each stating what's shared
• On consent: optional retroactive backfill, disclosed explicitly
• Anonymized aggregate payload (documented schema, no PII) on a periodic heartbeat
• Opt-out stops egress immediately; docs cover schema + reversibility
• v1 carrot: participants view a benchmark status keyed by installation_id (gated view lands with the enterprise PR; hosted percentile service is its own issue)
• Hosted aggregation intake scoped out (separate issue)

Verification

tests/unit/test_ent12_telemetry_sharing.py (8): no-PII payload, both-gate egress, opt-out stops egress, fail-open, non-2xx not marked shared, consent round-trip. Live on the Postgres stack: gating + delivery to a local sink + no-PII + reversibility (21 checks) + router/preview end-to-end. No real external egress in any test.

Related to ent#12 · Tier-1 ent#184 · pairs with trinity-enterprise feature/12-telemetry-benchmark

🤖 Generated with Claude Code

[github-actions]

⚠️ Nightly unit-suite check skipped — merge conflict against dev.

Resolve by running git merge dev locally and pushing the result. The next nightly run will re-test once the conflict is gone.

[vybe]

Validated via subagent review: payload is genuinely anonymized (allowlist-filtered, no PII), double gate re-checked at send time, opt-out immediate. Three criticals fixed on the branch (nonexistent audit enum, dead TELEMETRY_SHARING_* compose wiring, generic-PUT consent bypass) + wizard backfill disclosure — all with regression tests, CI green. Residual: per-worker heartbeat dup under --workers 2 (dedupe on installation_id server-side) — follow-up.