Skip to content

[PRO-4275] Enforce docs analytics consent with Fern 5.169.0 - #1405

Draft
haotian-vapi wants to merge 1 commit into
mainfrom
haotian/PRO-4275-docs-consent
Draft

haotian-vapi wants to merge 1 commit into
mainfrom
haotian/PRO-4275-docs-consent

Conversation

@haotian-vapi

@haotian-vapi haotian-vapi commented Nov 9, 2026 •

Copy link
Copy Markdown

Client consent enforcement

Description

Pin Fern 5.169.0 with the approved package hash and update both compatibility wrapper markers. Integrate native consent before analytics initialization, latch withdrawal until reload, remove ungated GA4/unverified custom collectors, and add current consent headers to first-party fetch/XHR requests.

Before (audit) After (generated-runtime evidence)
Native/custom analytics can initialize without resolved permission Denial blocks optional analytics; grant permits collection; withdrawal stops further sends
Native runtime lacks the approved consent integration Pinned package hash and both wrapper compatibility checks pass

Testing Steps

  • Generate and exercise the local docs runtime: six Chromium scenarios passed, including CI preview startup.
  • Run 13 privacy/header, 39 subscription, 14 cache and 18 CLI compatibility checks.
  • Run Fern check: zero errors, 19 existing warnings.
  • Verify hosted provider/region configuration, full API-reference playground and search backend.

The historical 37-probe CLI suite was unavailable; 18 available compatibility probes were run. Analytics regrant after withdrawal requires reload. The Validation Report includes tested revisions, simplify-cycle results and the initial newsletter-interception incident.

[Client consent enforcement](https://linear.app/vapi/issue/PRO-4275/client-consent-enforcement)

## Description

Pin Fern 5.169.0 with the approved package hash and update both compatibility wrapper markers. Integrate native consent before analytics initialization, latch withdrawal until reload, remove ungated GA4/unverified custom collectors, and add current consent headers to first-party fetch/XHR requests.

| Before (audit) | After (generated-runtime evidence) |
| --- | --- |
| Native/custom analytics can initialize without resolved permission | Denial blocks optional analytics; grant permits collection; withdrawal stops further sends |
| Native runtime lacks the approved consent integration | Pinned package hash and both wrapper compatibility checks pass |

## Testing Steps

- [x] Generate and exercise the local docs runtime: six Chromium scenarios passed, including CI preview startup.
- [x] Run 13 privacy/header, 39 subscription, 14 cache and 18 CLI compatibility checks.
- [x] Run Fern check: zero errors, 19 existing warnings.
- [ ] Verify hosted provider/region configuration, full API-reference playground and search backend.

The historical 37-probe CLI suite was unavailable; 18 available compatibility probes were run. Analytics regrant after withdrawal requires reload. The [Evidence Report](https://linear.app/vapi/document/pro-4275-evidence-report-95d2b5d18e2a) includes tested revisions, simplify-cycle results and the initial newsletter-interception incident.
@github-actions

github-actions Bot commented Nov 9, 2026

Copy link
Copy Markdown
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant