ADR-0018: Xianyun collects no telemetry
Status: accepted · Date: 2026-10-13 · Decision makers: James Hebden
Context and Problem Statement
The Go tool Xianyun forked from sent usage events to a GitLab-run collector. The Rust port carried over the pieces of that design (event types for commands, hooks, and edit-mode runs, an opt-out through environment variables, a user ID derived from the hostname and home directory) but never finished it: the emitter was a placeholder, and nothing outside the module called the tracker. It also decided whether to switch itself on by looking for an @gitlab.com address in git config, a GitLab Zoom configuration file, or a GitLab hostname pattern.
The project is becoming public. Dormant code that describes sending command arguments and hook scripts to a collector, and that special-cases one company’s employees, tells readers something false about the tool and invites someone to finish it.
Decision Drivers
- A public tool should say plainly what leaves the machine, and “nothing” is the easiest claim to keep true
- Hook scripts and command arguments can contain secrets, so an event carrying them is a liability (TM-TEL-001)
- The design rules say Xianyun knows nothing about any one application, and a GitLab-employee heuristic breaks that
- Dormant code still has to be read, tested, and maintained
Considered Options
- Remove the telemetry code, its environment variables, and its documentation
- Finish the emitter and ship it opt-in
- Keep the dormant code and document that it does nothing
Decision Outcome
Chosen option: “Remove it”. There’s no user need for it in this project, and removing it makes the strongest privacy statement available. Option 2 means designing what’s collected and where it goes, with no one asking for the result. Option 3 keeps the problems above and adds a promise to keep it dormant.
Removed: crates/xianyun-executor/src/telemetry/ (events, team detection, user ID, and the client), the XIANYUN_TELEMETRY, XIANYUN_TELEMETRY_URI, and CAPRONI_TELEMETRY* variables, and the two tests that existed only for it. The in-crate SHA-256 stays, because the file cache uses it for cache keys.
Consequences
Good:
- The claim “Xianyun collects no usage data” is true and checkable by searching the code
- TM-TEL-001 is eliminated, and the GitLab-employee heuristic is gone
Bad:
- The maintainers get no usage data, so decisions about which commands matter rest on feedback and issues
- The removed code took 27 tests with it (12 for events, 8 for the client, 5 for team detection, 2 for the user ID), measured by counting the test attributes in the deleted files. They covered only the removed code.
Neutral:
- A future change that adds telemetry needs a new ADR that supersedes this one, and a new threat model entry
Implementation Location
crates/xianyun-executor/src/lib.rscrates/xianyun-executor/src/sha256.rs