Instrument an approved event
Do not begin when the event name, field allowlist, consent contract, or target files are unknown.
- Read project instructions, existing tracking code, and
../../references/clicktrail-safety-contract.md. - State the exact files, event name, fields, consent condition, and test changes.
- Get approval for that mutation set.
- Reuse the host's ClickTrail client and event taxonomy. Do not add a second client, direct vendor SDK, or hardcoded analytics call.
- Build the payload from an explicit allowlist. Never pass form objects, request
objects, cookies, user profiles, arbitrary
data, or spread caller input. - Keep attribution informational. Trusted context must control tenant and site routing.
- Add behavior tests proving denial produces no persistence/delivery and withdrawal clears owned state and queues.
- Run the host project's tests, typecheck, lint, and build. Report any skipped check and why.
Stop on the first unexpected mutation or live network request.