How it works

Insight is a derived artefact, never raw payload passthrough. If a field cannot be justified as model input, it is not collected.Test: every stored field maps to a documented feature.

Every insight ships with a confidence value and its evidence. An unexplainable score is a defect, not a feature.

The host site must remain fully functional if TravelSpy is unavailable. All integration points degrade silently.

Consent state travels with the record and is enforced at the point of use, not only at the point of collection.

Both envelopes MUST carry an explicit schema version. Consumers MUST reject unknown major versions rather than best-effort parse.

Schema changes are additive within a major version. Removing or retyping a field requires a new major version and a documented dual-write window.

Every signal MUST carry an idempotency_key. Ingest MUST deduplicate on it for at least 24 hours, because the collector retries.

The insight envelope MUST NOT contain free text originating from a traveller. Values are enums, numbers, ranges and codes only.This is what keeps us out of the message-handling business.

Loader MUST be async and MUST NOT block rendering. Total transferred budget 10 KB gzipped for the loader plus core.

No network request of any kind before a consent decision is recorded. A dormant tag is the default state.Acceptance: fresh session with no CMP response produces zero requests to our origin.

MUST capture only declared signals. No automatic DOM scraping, no keystroke capture, no form value capture, no query strings.

Batch signals and flush on a timer, on batch size, and on visibilitychange to hidden. Final flush MUST use navigator.sendBeacon so it survives unload.

Buffer to memory when offline; retry with exponential backoff and jitter. Drop the buffer, never the host page, on sustained failure.

Serving and training MUST read feature definitions from the same store. A feature computed two ways is a defect.

Every emitted insight carries confidence, evidence[] and the model_version that produced it.

Recompute is incremental and event-driven. A single new signal MUST NOT trigger a full profile rebuild.

Emit an insight only when it materially changes. Define per-key thresholds; suppress noise below them.Rationale: the stream is a change feed, not a metronome.

Drift monitoring with automatic rollback to last known-good version. Bias testing against protected attributes before any promotion.

Stream served as text/event-stream over HTTP/2+, with Cache-Control: no-cache and proxy buffering disabled.

Exactly one stream connection per browser. Fan out to tabs and frames via BroadcastChannel, with a leader election so a single tab owns the socket.Directly mitigates the six-connection cap.

Every event carries id: set to the insight sequence. On reconnect the server MUST honour Last-Event-ID and replay only what was missed.

Server sends a comment keep-alive at least every 20 seconds to stop intermediaries closing an idle connection, and sets retry: explicitly.

Replay buffer is bounded. If a client is too far behind, the server MUST send a snapshot event instead of a replay and the client MUST accept it as authoritative.

Close the stream when the document is hidden beyond a grace period; reopen on visible. Battery and connection budget are not ours to spend.

Subscribes to the insight stream for the current traveller and re-renders on change. Cold start MUST render from a snapshot before the first delta arrives.

Holds no durable state. Everything it displays MUST be reconstructible from a snapshot after a hard reload.

Captured input is constrained: selections, confirmations, corrections and numeric ranges. No free-text field that we persist.Acceptance: no request body from either frame contains an author-written string.

Renders a visible confidence indication. Nobody is shown a guess presented as a fact.

Degrades to a static last-known state if the stream drops, with a visible stale indicator. It MUST NOT show an error the host's customer has to interpret.

The two surfaces ship from separate URLs with separate tokens. A workspace may enable either or both. One surface MUST NOT be reachable by changing a parameter on the other.

The team surface token is issued only to an authenticated staff context and MUST be rejected if the embedding origin is a public host page.Acceptance: pasting a team embed onto the public site renders nothing.

Commercial vocabulary — margin, discount, propensity, spend band, lead score — MUST NOT appear in the traveller surface. Enforce with a copy lint in CI against a banned-term list.

Confidence is presented differently per audience: plain language on the traveller surface (“we think”, “fairly sure”), numeric plus evidence on the team surface.

The traveller surface MAY present a packaged trip, assembled from host-contracted inventory and priced within host guardrails. It MUST NOT display a price the host's own systems would not honour.

The widget MUST be served from a dedicated origin, separate from the marketing site and the portal, so a compromise cannot pivot into a session.

targetOrigin MUST always be an exact origin. Using * is prohibited, because a host can navigate the frame and intercept the message.

Every receiver MUST verify event.origin and validate message shape. Any window in the frame hierarchy can post to any other.

Embedding is restricted by a per-workspace origin allowlist, enforced with Content-Security-Policy: frame-ancestors. An unregistered origin gets no frame and no token.

Never combine allow-scripts with allow-same-origin on a same-origin embed — the framed document can then remove its own sandbox, making the attribute worthless.

Stream and API tokens are short-lived, workspace-scoped and traveller-scoped. A leaked embed token MUST NOT read another traveller.

The frame MUST NOT request top navigation. Browsers already gate this behind sticky activation; we do not rely on that as our only control.

No profile is created and no insight computed until a consent decision is recorded. The host CMP is authoritative.

Consent state is carried on the record and enforced at the point of use. A traveller with analytics but not advertising consent is modelled but never exported to an ad platform.

Withdrawal propagates to every connected destination and returns a completion receipt. Target: under 60 seconds internally, under 24 hours end to end.

Retention is configurable per market and enforced by deletion, not archival.

No special category data, no financial account data, no precise GPS, no private message content, at any layer.