CLI telemetry and privacy

C3 automatically sends operational telemetry when you run c3 deploy. It helps us diagnose submission failures, latency, routing, and capacity. There is currently no per-user telemetry opt-out.

The deploy summary includes the CLI version, entrypoint, outcome, stable failure code and stage, total and phase timings, job and journey identifiers, selected route and hardware, and a limited configuration snapshot: provider pinning, hardware constraints, capacity wait policy, timeout, environment kind, and dataset mount count. Workspace statistics contain aggregate file and byte counts, including uploaded and deduplicated bytes.

The initial deploy summary ends after submission and response rendering, before optional log following. A successful summary means the deploy command completed its initial work, not that the submitted job eventually succeeded. Dry runs record route preview and response timing without claiming an upload or job. Started phases retain elapsed time on failure; phases that never ran are absent. The upload phase includes workspace and local-dataset upload preparation and artifact-reference resolution; workspace byte/file counters remain workspace-only.

Configuration fields describe declared project choices. A provider flag or C3_PROVIDER override does not overwrite a provider declared in .c3; the accepted job's route is recorded separately. Legacy script deployments record their supported safe directive choices without treating a provider flag as a project declaration. Unknown telemetry configuration is omitted from the job request rather than making an otherwise valid deployment fail.

When compiler metadata is available, the summary also includes the source line of the CLI's own deploy entrypoint. Together with the CLI version, the server's fixed C3 source-file path and function name help locate the implementation that ran. This is C3 implementation metadata, not a path or function from your workspace. Older CLI summaries without this metadata remain accepted.

Telemetry excludes user file contents and names, local paths, script text, dataset names and mount paths, environment variable values, credentials, raw .c3 configuration, Docker image references, and arbitrary error messages. The server derives pseudonymous actor, organization, and project identifiers using an environment-specific HMAC key; it does not copy their raw values into these events. Authenticated receipt and rate-limit records remain associated with your account for ownership and abuse controls.

The CLI makes at most one authenticated summary request after the initial deploy boundary, with a 750 ms timeout and a 16 KiB payload limit. Sending is best effort: validation or relay failures do not change the deploy result. There are no relay retries and no offline telemetry queue. The journey identifier also connects server-side admission, scheduling, capacity, completion, and cleanup events. Summary requests do not follow redirects. Unexpected CLI aborts retain only a stable failure classification, never the panic value or runtime dump; telemetry does not intercept or change the original failure.