Pseudonymous-by-default governance for external telemetry emission

Status: accepted (extends ADR-0008; governs the emit rail of ADR-0041)

The Caliper Sensor (and the xAPI emitter) of ADR-0041 transmit learning telemetry off-box, and Caliper mandates a persistent IRI per Entity (CAL-ENT-1 / CAL-ID-1), forcing a learner-identity decision onto the wire. Once emitted to an endpoint we do not control, the data cannot be unsent — so identity, consent, and erasure must be decided at the projection, not after.

The decision

1. Pseudonymous by default. Emitted Person/Agent entities carry a stable pseudonymous IRI derived from the existing account-IFI identity (ADR-0008’s de-identified projection). A pseudonym is still a “unique, persistent IRI”, so the Caliper identifier MUST is satisfied without exporting PII.
2. Real identity is opt-in per endpoint. Emitting a learner’s real identity IRI is gated behind explicit per-endpoint trust/contract configuration — never the default, never to an untrusted third party.
3. Operational basis; capture-all/gate-use honoured. Analytics emission is operational telemetry under ADR-0008’s capture-all basis, not research. A separate per-endpoint “external export” flag governs transmission to third parties; self-dogfooded internal emission needs no extra consent.
4. Erasure is registered, best-effort externally. The new caliper.* endpoint tables get erasure-registry declarations; the external emit is declared external class with an ifi subject-link, so withdrawal/erasure propagates a best-effort signal. We document that data already delivered to a foreign store is beyond our hard-erase guarantee.

Considered alternatives

• Real-identity emission, consent-gated. Rejected as default: exports PII and suppresses telemetry for non-consenters (coverage gaps + a harder erasure story). Retained as the opt-in per-endpoint mode.
• Defer governance, dogfood internally only. Rejected: ships a known governance gap pre-launch; the pseudonymous default costs little and closes it now.

Consequences

• The projection seam needs a stable pseudonym derivation keyed off the account IFI, applied uniformly to Caliper Person/Agent and xAPI actor IFIs.
• Endpoint configuration carries { trust level, export flag, identity mode }; the default target (our own endpoint/LRS) is trusted-internal.
• Erasure for emitted telemetry is explicitly best-effort; this limit is documented for certifiers.