You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Adds the Conceptual Analytics front-end pixel to the dev docs site, so ad click IDs and page views are captured on /docs/* as well as the marketing site. Pairs with kernel/website#305, which covers the marketing site.
Why a custom script
www.kernel.sh/docs/* is a Next rewrite that proxies to this Mintlify app, so the marketing site's root layout — and the pixel component in it — never renders on a docs page. Docs currently have no pixel at all.
Mintlify loads every .js file in the content directory on every page, which is the supported way to inject a third-party script. docs.jsonintegrations is a fixed vendor allowlist with no Conceptual entry, so a custom script is the only route short of adding a GTM container.
How it decides whether to load
If a c15t decision is already stored, honour it. Docs share an origin with the marketing site, so the cookie set there is readable here and an accept or decline carries over.
Otherwise apply the same rule c15t applies on the marketing site: ask /api/c15t/show-consent-banner, which is same-origin here, and load only where no banner is required. In regulated jurisdictions c15t prompts; everywhere else it auto-grants marketing and measurement, so this matches the behaviour a visitor would get had they landed on a marketing page instead.
Any failure — endpoint unreachable, non-OK response, parse error — leaves the pixel unloaded.
The gate is needed because the consent banner lives in the marketing site's React tree and never renders on a docs page. Requiring a stored decision would have meant almost no coverage for visitors whose first page is a docs page, which is the traffic this is for.
It also turns on respectDNT and anonymizeIP, both off in the shipped pixel config, before the loader runs, and sends a page_view on docs navigation — the pixel sends one on init and has no router hooks, so client-side navigation between docs pages is otherwise invisible.
The key in this file is the public pixel key, which is designed to be visible in browser code. The server-side conversion key is not used here and must never appear in a browser.
Testing
Verified end to end against the live www.kernel.sh/docs origin by injecting this script with the vendor's dev key, which validates requests but stores nothing:
egress
resolved
jurisdiction
banner required
pixel loaded
device cookie
events
us-east
US
NONE
no
yes
set
1 page_view
eu-west
GB
GDPR
yes
no
none
none
node --check passes. Not verified in a Mintlify preview deployment — the jurisdiction endpoint is only reachable when the docs are served under the marketing domain, and the script fails closed anywhere else.
Note for reviewers
The consent category is marketing, matching kernel/website#305. Our privacy policy files ad-campaign measurement under analytics, so measurement is arguable; it is one constant in each PR if we want to switch.
Note
Medium Risk
Introduces third-party analytics and consent logic that reads cookies/localStorage and mutates outbound links; behavior is fail-closed on errors but still affects privacy-sensitive traffic on docs.
Overview
Adds conceptual.js, a Mintlify-injected script that loads the Conceptual Analytics pixel on docs pages (where the marketing layout never runs), so /docs/* can record page views and preserve ad attribution like the main site.
Consent gating: If a shared-origin c15tmarketing decision exists (cookie or localStorage), the pixel starts only on grant and stays off on decline. With no decision yet, it calls /api/c15t/show-consent-banner and loads only when no banner is required (mirroring auto-grant outside regulated regions); any fetch/parse failure leaves the pixel unloaded.
Tracking behavior: Before the vendor loader runs, __CA_CONFIG turns on respectDNT / anonymizeIP and disables built-in trackPageViews and trackUnload so events are explicitly gated. The script sends an initial page_view, hooks pushState / replaceState / popstate for SPA navigations (re-checking consent each time), and appends ca_device_id to clicks toward onkernel.com for signup attribution when consent is not declined.
Reviewed by Cursor Bugbot for commit f54f885. Bugbot is set up for automated code reviews on this repo. Configure here.
Mintlify loads every .js file in the content directory on every page, which
is how the pixel reaches docs pages that the marketing site's layout never
renders.
The docs are served under www.kernel.sh/docs, so the c15t consent cookie set
on the marketing site is readable here and gates the pixel the same way.
respectDNT and anonymizeIP are off in the shipped pixel config and are turned
on before the loader runs. The pixel has no router hooks, so docs navigation
sends its own page_view.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The consent banner lives in the marketing site's app and never renders on a
docs page, so a visitor whose first page is a docs page had no way to reach a
decision and never got the pixel — which is most of the traffic this is meant
to cover.
An existing decision still wins. Absent one, ask the same c15t endpoint the
marketing site uses and apply its rule: prompt in regulated jurisdictions,
auto-grant elsewhere. The endpoint is same-origin here. Any failure leaves the
pixel unloaded.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Medium
Verdict: Do not auto-approve.
This is not a documentation-only change. The diff adds conceptual.js, which Mintlify loads on every docs page. That script injects a third-party analytics loader from plfalg.kernel.sh, reads c15t consent state from cookies and localStorage, calls /api/c15t/show-consent-banner, and monkey-patches history.pushState / history.replaceState to emit page_view events.
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. The new file runs for all /docs/* visitors, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored decision whenever the jurisdiction endpoint returns showConsentBanner === false. The second commit widened that from fail-closed (require stored consent) to geo-gated auto-load.
Third-party script injection. A remote loader is appended to document.head on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's own client router.
Blast radius is the full docs origin. A wrong consent parse, endpoint response, or loader behavior affects measurement and privacy for every visitor.
Why this is not High
The change is a single self-contained file, fails closed on fetch/parse errors, uses credentials: "same-origin", and does not touch auth, billing, infra, or server-side code in this repo. Those bounds keep it at Medium rather than higher.
Action: Comment only. Human review of the consent/geo-gate and third-party loader is required before merge.
Sent by Cursor Automation: Assign PR reviewers
andrewleesteele
changed the title
Add consent-gated Conceptual Analytics pixel to docs
Add consent-gated Conceptual Analytics pixel to devdocs
Sep 5, 2026
andrewleesteele
changed the title
Add consent-gated Conceptual Analytics pixel to devdocs
Add consent-gated Conceptual Analytics pixel to dev docs
Sep 5, 2026
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Medium
Verdict: Do not auto-approve.
This is not a documentation-only change. The diff adds a single new file, conceptual.js (110 lines). Mintlify loads every .js file in the content directory on every docs page, so this runs for all /docs/* visitors.
What the code actually does
Injects a third-party loader from https://plfalg.kernel.sh/analytics/loader-v1.js into document.head
Reads c15t consent state from cookies and localStorage
If no stored decision exists, calls /api/c15t/show-consent-banner and starts tracking when showConsentBanner === false
Monkey-patches history.pushState / history.replaceState and listens for popstate to emit page_view events
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. Every docs visitor executes this script, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored user decision whenever the jurisdiction endpoint returns showConsentBanner === false. The second commit widened this from fail-closed (require stored consent) to geo-gated auto-load.
Third-party script injection. A remote analytics loader is appended on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's client router.
Blast radius is the full docs origin. A wrong consent parse, unexpected endpoint response, or loader behavior affects measurement and privacy for every visitor.
Why this is not High
The change is one self-contained file. Fetch/parse failures leave the pixel unloaded, the jurisdiction request uses credentials: "same-origin", and this repo's auth, billing, infra, and server-side code are untouched. Those bounds keep it at Medium rather than higher.
Action: Comment only. Human review of the consent/geo-gate and third-party loader is required before merge.
The device ID is stored per-domain, so the dashboard mints its own and the ad
click that led to a signup is never credited. The docs link to dashboard
sign-up in several places, so this path matters here too.
Appends the ID to onkernel.com links on click. The dashboard side reads it
back, which is not in this repo.
Pushed the cross-domain device ID handoff here too.
The docs link to dashboard.onkernel.com/sign-up in several places, so a reader signing up from a docs page hits the same problem: the device ID is domain-scoped, the dashboard mints its own, and the ad click is never credited. This appends the ID to outbound onkernel.com links on click.
Verified against the live www.kernel.sh/docs origin with the vendor's dev key: the pixel loads, getDeviceId() returns an ID, a dashboard.onkernel.com/sign-up link is decorated with it, and a notonkernel.com lookalike is left untouched.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Medium
Verdict: Do not auto-approve.
Re-evaluated after the 00f2bf5 synchronize (outbound ca_device_id handoff). This is still not a documentation-only change. The diff adds a single new file, conceptual.js (138 lines). Mintlify loads every .js file in the content directory on every docs page, so this runs for all /docs/* visitors.
No prior approval from this automation exists, so there is nothing to revoke.
What the code actually does
Injects a third-party loader from https://plfalg.kernel.sh/analytics/loader-v1.js into document.head
Reads c15t consent state from cookies and localStorage
If no stored decision exists, calls /api/c15t/show-consent-banner and starts tracking when showConsentBanner === false
Monkey-patches history.pushState / history.replaceState and listens for popstate to emit page_view events
New in this update: capture-phase click interceptor that mutates a[href] toward onkernel.com / *.onkernel.com by appending ca_device_id
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. Every docs visitor executes this script, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored user decision whenever the jurisdiction endpoint returns showConsentBanner === false.
Third-party script injection. A remote analytics loader is appended on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's client router.
Cross-domain identifier handoff (new). A visitor identifier is written into outbound URLs. That expands privacy blast radius (query strings, logs, Referer, history) beyond same-origin measurement.
Blast radius is the full docs origin. A wrong consent parse, unexpected endpoint response, or loader behavior affects measurement and privacy for every visitor.
What changed vs. the last assessment
Risk stays Medium, not High. The new click interceptor increases the tracking/privacy surface but does not touch auth, billing, infra, or server-side code. Those bounds still keep it below High.
Action: Comment only. Human review of the consent/geo-gate, third-party loader, and cross-domain device-ID handoff is required before merge.
c15t omits false booleans from its cookie rather than writing them, so a
decline never appears as `c.marketing:0` — it's the absence of the key. Reading
only for an explicit `:0` made a decline indistinguishable from no decision,
and the jurisdiction fallback then loaded the pixel for someone who had opted
out.
Any stored consent record now means a decision was made, and a missing category
in one means no.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Medium
Verdict: Do not auto-approve.
Re-evaluated after the e2a4b02 synchronize (treat a stored consent record without marketing as a decline). This is still not a documentation-only change. The diff adds a single new file, conceptual.js (140 lines). As the only .js file in this Mintlify content root, it is loaded on every docs page and runs for all /docs/* visitors.
No prior approval from this automation exists, so there is nothing to revoke. No CODEOWNERS file is present.
What the code actually does
Injects a third-party loader from https://plfalg.kernel.sh/analytics/loader-v1.js into document.head
Reads c15t consent state from cookies and localStorage
If a stored consent record exists, starts tracking only when marketing is explicitly granted; otherwise treats the record as a decline and does not fall through to geo-gating
If no stored decision exists, calls /api/c15t/show-consent-banner and starts tracking when showConsentBanner === false
Monkey-patches history.pushState / history.replaceState and listens for popstate to emit page_view events
Capture-phase click interceptor that mutates a[href] toward onkernel.com / *.onkernel.com by appending ca_device_id
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. Every docs visitor executes this script, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored user decision whenever the jurisdiction endpoint returns showConsentBanner === false.
Third-party script injection. A remote analytics loader is appended on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's client router.
Cross-domain identifier handoff. A visitor identifier is written into outbound URLs (query strings, logs, Referer, history).
Blast radius is the full docs origin. A wrong consent parse, unexpected endpoint response, or loader behavior affects measurement and privacy for every visitor.
What changed vs. the last assessment
Risk stays Medium, not High, and did not increase.
e2a4b02 is a consent-parse tightening: a present c15t cookie or localStorage record without an explicit marketing:1 / marketing === true now returns decline (false) instead of "no decision" (null). That closes a path where an opt-out could fall through to the geo-gate and load the pixel. It reduces one privacy-bug risk; it does not shrink the site-wide tracking, third-party loader, History API, or device-ID handoff surface.
This repo's auth, billing, infra, and server-side code remain untouched, which keeps the rating below High.
Action: Comment only. Human review of the consent/geo-gate, third-party loader, and cross-domain device-ID handoff is required before merge.
Both from review on the marketing-site pixel, which shares this approach.
Consent is decided once at page load here, but it can be withdrawn on the
marketing site while a docs page stays open — and Mintlify is a single-page app,
so that page can live a long time. There's no consent UI on docs to react to, so
navigation page views and the device-ID handoff now re-read the decision instead
of trusting the one made at load.
anonymizeIP is documented as inert rather than implied to be active: the shipped
script defines it and never reads it, and resolves the visitor's full address to
send as client_ip regardless.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk assessment: Medium
Verdict: Do not auto-approve.
Re-evaluated after the fd57bcc synchronize (re-read consent on navigation/handoff; document that anonymizeIP is inert). This is still not a documentation-only change. The diff adds a single new file, conceptual.js (150 lines). As the only .js file in this Mintlify content root, it is loaded on every docs page and runs for all /docs/* visitors.
No prior approval from this automation exists, so there is nothing to revoke. No CODEOWNERS file is present.
What the code actually does
Injects a third-party loader from https://plfalg.kernel.sh/analytics/loader-v1.js into document.head
Reads c15t consent state from cookies and localStorage
If a stored consent record exists, starts tracking only when marketing is explicitly granted; otherwise treats the record as a decline and does not fall through to geo-gating
If no stored decision exists, calls /api/c15t/show-consent-banner and starts tracking when showConsentBanner === false
Monkey-patches history.pushState / history.replaceState and listens for popstate to emit page_view events
Capture-phase click interceptor that mutates a[href] toward onkernel.com / *.onkernel.com by appending ca_device_id
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. Every docs visitor executes this script, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored user decision whenever the jurisdiction endpoint returns showConsentBanner === false.
Third-party script injection. A remote analytics loader is appended on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's client router.
Cross-domain identifier handoff. A visitor identifier is written into outbound URLs (query strings, logs, Referer, history).
Blast radius is the full docs origin. A wrong consent parse, unexpected endpoint response, or loader behavior affects measurement and privacy for every visitor.
What changed vs. the last assessment
Risk stays Medium, not High, and did not increase.
fd57bcc tightens two runtime paths and corrects a comment:
Navigation page_view and the ca_device_id click handoff now re-read storedConsent() and skip when the stored decision is a decline, instead of trusting the page-load decision for the life of the SPA session.
Comments now state that anonymizeIP is set but unused by the shipped pixel, so full client IP can still be sent. That documents residual privacy behavior; it does not add new codepaths.
Those edits reduce one consent-withdrawal gap and make IP handling explicit. They do not shrink the site-wide tracking, third-party loader, History API, geo-gate, or device-ID handoff surface.
This repo's auth, billing, infra, and server-side code remain untouched, which keeps the rating below High.
Action: Comment only. Human review of the consent/geo-gate, third-party loader, and cross-domain device-ID handoff is required before merge.
The reason will be displayed to describe this comment to others. Learn more.
Stale device ID after withdrawal
Medium Severity
The new decline check returns before rewriting the link, but a prior click already wrote ca_device_id onto href. That param stays, so a later click on the same onkernel.com link still sends the device ID after consent is withdrawn.
Same finding as kernel/website#305, same shared vendor script.
The consent re-check on navigation couldn't govern the pixel's internal
emissions: trackPageViews sends a page view at init and trackUnload installs
scroll, click and form-submit listeners, all routed through the vendor's own
track() rather than through ours. Both off, so the script emits nothing on its
own and the landing page view is ours to send along with the navigation ones.
The reason will be displayed to describe this comment to others. Learn more.
Risk assessment: Medium
Verdict: Do not auto-approve.
Re-evaluated after the f54f885 synchronize (disable the vendor's own trackPageViews / trackUnload emissions and send the landing page_view from this script). This is still not a documentation-only change. The diff adds a single new file, conceptual.js (161 lines). As the only .js file in this Mintlify content root, it is loaded on every docs page and runs for all /docs/* visitors.
No prior approval from this automation exists, so there is nothing to revoke. No CODEOWNERS file is present.
What the code actually does
Injects a third-party loader from https://plfalg.kernel.sh/analytics/loader-v1.js into document.head
Reads c15t consent state from cookies and localStorage
If a stored consent record exists, starts tracking only when marketing is explicitly granted; otherwise treats the record as a decline and does not fall through to geo-gating
If no stored decision exists, calls /api/c15t/show-consent-banner and starts tracking when showConsentBanner === false
Monkey-patches history.pushState / history.replaceState and listens for popstate to emit page_view events
Capture-phase click interceptor that mutates a[href] toward onkernel.com / *.onkernel.com by appending ca_device_id
Sets __CA_CONFIG.trackPageViews and trackUnload to false, then emits the initial page_view itself
Why this is Medium (not Low / Very Low)
Site-wide user-facing surface. Every docs visitor executes this script, not an isolated page or internal tool.
Privacy / consent model. Tracking can start without a stored user decision whenever the jurisdiction endpoint returns showConsentBanner === false.
Third-party script injection. A remote analytics loader is appended on production docs traffic.
Global History API patching. Wrapping pushState / replaceState can interact with Mintlify's client router.
Cross-domain identifier handoff. A visitor identifier is written into outbound URLs (query strings, logs, Referer, history).
Blast radius is the full docs origin. A wrong consent parse, unexpected endpoint response, or loader behavior affects measurement and privacy for every visitor.
What changed vs. the last assessment
Risk stays Medium, not High, and did not increase.
f54f885 turns off the vendor script's built-in page-view and unload/interaction emitters so those events go through this file's consent-aware window.ca("track", ...) path instead. That reduces one ungated vendor-emission path. It does not shrink the site-wide tracking, third-party loader, History API, geo-gate, or device-ID handoff surface.
This repo's auth, billing, infra, and server-side code remain untouched, which keeps the rating below High.
Action: Comment only. Human review of the consent/geo-gate, third-party loader, and cross-domain device-ID handoff is required before merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
andrewleesteele
changed the title
Summary
Adds the Conceptual Analytics front-end pixel to the dev docs site, so ad click IDs and page views are captured on
/docs/*as well as the marketing site. Pairs with kernel/website#305, which covers the marketing site.Why a custom script
www.kernel.sh/docs/*is a Next rewrite that proxies to this Mintlify app, so the marketing site's root layout — and the pixel component in it — never renders on a docs page. Docs currently have no pixel at all.Mintlify loads every
.jsfile in the content directory on every page, which is the supported way to inject a third-party script.docs.jsonintegrationsis a fixed vendor allowlist with no Conceptual entry, so a custom script is the only route short of adding a GTM container.How it decides whether to load
/api/c15t/show-consent-banner, which is same-origin here, and load only where no banner is required. In regulated jurisdictions c15t prompts; everywhere else it auto-grantsmarketingandmeasurement, so this matches the behaviour a visitor would get had they landed on a marketing page instead.The gate is needed because the consent banner lives in the marketing site's React tree and never renders on a docs page. Requiring a stored decision would have meant almost no coverage for visitors whose first page is a docs page, which is the traffic this is for.
It also turns on
respectDNTandanonymizeIP, both off in the shipped pixel config, before the loader runs, and sends apage_viewon docs navigation — the pixel sends one on init and has no router hooks, so client-side navigation between docs pages is otherwise invisible.The key in this file is the public pixel key, which is designed to be visible in browser code. The server-side conversion key is not used here and must never appear in a browser.
Testing
Verified end to end against the live
www.kernel.sh/docsorigin by injecting this script with the vendor's dev key, which validates requests but stores nothing:NONEpage_viewGDPRnode --checkpasses. Not verified in a Mintlify preview deployment — the jurisdiction endpoint is only reachable when the docs are served under the marketing domain, and the script fails closed anywhere else.Note for reviewers
The consent category is
marketing, matching kernel/website#305. Our privacy policy files ad-campaign measurement under analytics, someasurementis arguable; it is one constant in each PR if we want to switch.Note
Medium Risk
Introduces third-party analytics and consent logic that reads cookies/localStorage and mutates outbound links; behavior is fail-closed on errors but still affects privacy-sensitive traffic on docs.
Overview
Adds
conceptual.js, a Mintlify-injected script that loads the Conceptual Analytics pixel on docs pages (where the marketing layout never runs), so/docs/*can record page views and preserve ad attribution like the main site.Consent gating: If a shared-origin c15t
marketingdecision exists (cookie orlocalStorage), the pixel starts only on grant and stays off on decline. With no decision yet, it calls/api/c15t/show-consent-bannerand loads only when no banner is required (mirroring auto-grant outside regulated regions); any fetch/parse failure leaves the pixel unloaded.Tracking behavior: Before the vendor loader runs,
__CA_CONFIGturns onrespectDNT/anonymizeIPand disables built-intrackPageViewsandtrackUnloadso events are explicitly gated. The script sends an initialpage_view, hookspushState/replaceState/popstatefor SPA navigations (re-checking consent each time), and appendsca_device_idto clicks towardonkernel.comfor signup attribution when consent is not declined.Reviewed by Cursor Bugbot for commit f54f885. Bugbot is set up for automated code reviews on this repo. Configure here.