+ jHj^#bRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI H t H t H t ^RI H t ^RIHt]P !]4tRtRt^@t]P,!R4t]!0Rm4tR tR R ltR R ltR RltRRltRRltRRlt RRlt!RRlt"RRlt#RRlt$RRlt%R#)!aYhermes.install.run: fresh installs through scripts/install.sh and scripts/install.ps1. The installer runs before the user is asked about shared metrics and must never send anything, so a full-ladder run only leaves ONE small local receipt (closed tokens plus two epoch timestamps) under the profile's store dir. A later Hermes start that runs the process-exit reporter reads it: - collection off: ``shared_metrics_process.begin_process`` (and every opt-out answer) deletes every receipt unreported, the same rule as parked update receipts; - collection on, sending off: the row is recorded now (it stays on this machine); - collection on, sending on: the row is recorded only on a day whose package the sender's consent gate can ever pass, i.e. a send consent window opened at or before today 00:00Z. On the opt-in day itself (setup asked during the install) the receipt waits for the first start on a later day; - a receipt older than ``MAX_RECEIPT_AGE_SECONDS``, unparseable, or with any value outside the contract is deleted unreported (an old receipt would count under whatever version records it). ) annotationsN)datetimetimezoneUTC)Path)Anypending_installsrecorded_installsz [0-9a-f]{32}c V^8dQhRRRR/#)homerreturn)formats"X/home/ubuntu/.hermes/hermes-agent/hermes_cli/observability/shared_metrics_install_run.py __annotate__r+sCCtCCc8VR, R, \, # telemetryshared_metrics)PENDING_DIRNAMEr s&rpending_installs_dirr+s +  0 0? BBrc V^8dQhRRRR/#r r rr Noner)rs"rrr/sBBB$BrcH\P!\V4RR7R#)T) ignore_errorsN)shutilrmtreerrs&rpurge_pending_installsr!/s MM&t,DArc V^8dQhRRRR/#)r valuerr z int | Noner)rs"rrr3scc#c*crcp\V\4'd \V\4'g V^8dV#R#)N) isinstanceintbool)r#s&r_epochr)3s-uc**:eT3J3JuWXy5b^bbrc V^8dQhRRRR/#)r receiptrr zdict[str, str] | Noner)rs"rrr7s(=rc ~^RIHp\V\4'd\ V4\ 8wdR#\VR,\ 4'd#\PVR,4'gR#\VR,4\VR,4r2Ve VeW28dR#RVPW2, R,4RVR,R VR ,R VR ,R VR ,/pVPVPV4'gR#VR ,R 8HpWTR,R 8H8wgWTR ,R 8H8wdR#V#)zWhermes.install.run dims for one receipt, or None when anything is outside the contract.shared_metrics_contractNid started_at finished_atduration_bucketi failed_stage failure_class installeroutcomesuccessnone) r.r&dictset _RECEIPT_KEYSstr _RECEIPT_ID fullmatchr)update_duration_bucketcounter_dimensions_are_validINSTALL_RUN_METRIC)r+contractstartedfinishedfields succeededs& rinstall_run_fieldsrH7s5 gt $ $G (E gdmS ) )1F1Fwt}1U1Uw|45vgm>T7UX(*h.@8::H _mark_recorded..\s!&&(BSBSr)keyreverseN) missing_ok)parentmkdirtouchsortediterdir_RECORDED_KEEPunlinkOSError)rOstales& r_mark_recordedreVss  4$7 ELL0028S]abcqcrsE LLDL )t    sA4A88 BBcV^8dQhRR/#)r r r=r)rs"rrrbs\\c\rc^RIHpHpV!\P!V!4P 4\P P4\R74#)z^Today's package ``period_start``, in the store's stamp format (``shared_metrics._isoformat``). _isoformat_utc_now)tzinfo) rrirjrcombinedatemintimerrhs r _today_startrpbs64 h&&xz'8(,,:K:K:MVYZ [[rc V^8dQhRRRR/#)r r rr r(r)rs"rrrisrc^RIHp^RIHpT!V!4;'g/4pVP'gR#VP 'gR#^RIHpVR, R, pV!VR, VR , 4P4;_uu_4pVPR \434P4pR R R 4VR J# +'giXR J#;i \PdR#i;i) akWhether a row recorded now lands in a package the user agreed to: collection on, and either sending off (it stays local) or a send consent window opened at or before today 00:00Z. The sender's ``CONSENT_GATE_SQL`` passes a day's package only when ``period_start >= opened_at``, so a row recorded on the opt-in day itself would sit in a package that is never sent.)read_raw_config_readonly)resolve_send_configFT)SharedMetricsStorerrzmetrics.sqlite3outboxzUSELECT 1 FROM send_consent_windows WHERE closed_at IS NULL AND opened_at <= ? LIMIT 1N)hermes_cli.configrsshared_metrics_send_configrtenabledsendrru _connectionexecuterpfetchonesqlite3Error)r rsrtrzruroot connectionrows& r consented_dayris ;? 79??R @D <<< 9992 +  0 0D '8 8$/ J V V X X\f$$g!hj Y d?Y X d? ==s0#-C*C:C C CCC54C5c V^8dQhRRRR/#)r pathrr z Path | Noner)rs"rrrs   + rc`^RIHpHpVPP V4'dV!V4'dR#VP VPP R4^, R\P!4 V 24p\P!W4V# \dR#i;i)zRename a receipt so exactly one reporter owns it. Unlike the process-marker claim it never reads the file first: an unparseable receipt is claimed too, so it can be deleted.) _REPORTING_claimer_aliveN.jsonz.json.) shared_metrics_processrrnameendswith with_namesplitosgetpidreplacerc)rrrclaimeds& r_claim_receiptrsC yy*%%.*>*>nn  8 ;PAR R R7R#i;i)zVRecord each receipt once, on a consented day (see the module docstring). Never raises.) relay_runtimer-) emit_saved) settle_claimN.rz utf-8-sig)encodingTr/Fz%Pending install receipts not reported)exc_info)!agentrr9r.shared_metrics_eventsrrrris_dirrelay_instrumentation_enabledrr_r`r startswithrjsonloads read_textrc ValueErrorrHr&r:rrMexistsINSTALL_RUN_MARKre Exceptionloggerdebug) r rrCrr directory reportablerrr+rFrOsaveds & rreport_pending_installsrs*M'958(. !! ::<< "4( 9,,./Dyy##C((G499,D$T*G **W%6%6 %6%LM(0F~Z%>%>&//WD1#D$-8E||~~WD1WE2!:!:F CDEJEu%  .30Z(  $ M GGG"G*)G*>r/r6r5r0r1r3r4i: )&__doc__ __future__rrloggingrrerr~rrrpathlibrtypingr getLogger__name__rrrLracompiler> frozensetr<rrr!r)rHrMrerprrrrrrrrs #  ,,   8 $$'jj) vw %CBc6Q  \8 U,Mr