[jwrosewell]

Built on #316

#316, which rewrote the usage sharing page's Evidence shared section, merged into rc on 15 November. rc is merged into this branch at b1f5eec, so the diff holds only this change.

Problem

The usage sharing specification changed on 14 November 2026, and two pages describe the rules as they were.

1. The usage sharing page (src/pipelineapi/features/usagesharing.md, as Say what usage sharing shares and how to hand it the web request #316 leaves it) says query string and form parameters are shared only when their names start 51D_ or are on the allow list, and that the 51D_ rule for cookies applies only while all Evidence is not shared. It says nothing of the package versions each record now carries.
2. The Evidence key filter page (src/pipelineapi/concepts/data/evidencekeyfilter.md lines 41 to 57 on rc) lists "Any HTTP header" where the Cookie header is never shared, says only .NET refuses id.email, id.salt, request-query and request-path, says only .NET and Java have session tracking, and gives the query string allow list as the only way query values are shared.

What the specification says

All at usage-sharing-element.md at b3b2c0dd, the specification's rc holding specifications#155 and #156.

Lines 65 to 69:

It MUST also return false, whatever the configuration and even when all Evidence is shared, for any key whose prefix is cookie. and whose field does not start with 51D_. The 51D_ cookies carry the values the 51Degrees JavaScript sends, and they are the only cookies shared. A cookie a site sets for itself, such as its session cookie, is never shared.

Lines 80 and 81:

Share all query string parameters is on by default, so every query string and HTTP form parameter is shared unless a user turns it off.

Lines 208 to 216:

Package - An xml element MUST be written for every 51Degrees package in use, being the package that holds the Pipeline, the package that holds each FlowElement in the Pipeline, and every 51Degrees package those depend on. ... Each package is released at its own version, so these elements say which release of each package is running, and so how far each release has spread.

What changed

1. usagesharing.md. A cookie whose name does not start 51D_ joins the list of what is never shared. The query rule says every query string and form parameter is shared, and only the 51D_ ones and the allow list once sharing all query string parameters is turned off. The options sentence says that option is on by default and that sharing all Evidence still shares no cookie but the 51D_ ones. A short new section, "What else each record carries", says each record names the Flow Elements, the language and its version, the platform, the server's IP address and every 51Degrees package in use with its version, as the message format at lines 167 to 227 has them.
2. evidencekeyfilter.md, the share usage filter. Any HTTP header other than Cookie, any query string or form parameter, and the session cookie line moved to the options. What is never shared now applies to every language, with the cookie rule added and a link to the usage sharing page for the full list. The options are the block list, turning off sharing every query parameter with the allow list, session tracking, and sharing all Evidence.

The session tracking item rests on each language's rc. Every language with usage sharing has it, .NET (ShareUsageBuilderBase.cs line 120, the ASP.NET session cookie), Java (ShareUsageBuilderBase.java line 57, JSESSIONID), Node.js (shareUsage.js line 155), Python (share_usage.py line 112), Go (builder.go lines 184 to 200, no default name) and Rust (configuration.rs lines 283 to 284 and 312 to 313, no default name). PHP has no usage sharing element.

When this merges

Only once every language with usage sharing has both changes on main. This is where each language's change stood at 01:28 UTC on 15 November. A cell saying none means a search of that repository's pull requests found none then.

Language	Every query value by default, no cookie but 51D_ ones	Package versions in each record
.NET	none	none
Java	none	none
Node.js	51degrees-node#135, open draft	51degrees-node#136, open draft
Python	none	none
Go	51degrees-go#154, merged into Go's rc at 01:02	51degrees-go#155, open draft
Rust	51degrees-rust#458, merged into Rust's rc at 01:03	none

If a language's change misses the Monday release, this page needs a sentence for that language before it merges, and I will add it.

What remains

The table above, kept up to date as the language changes merge.

Build

Checks on the head, 3ce5f6e, all green.

• Preview built the documentation with Doxygen, with no warning from usagesharing.md or evidencekeyfilter.md, and the @ref PipelineApi_Features_UsageSharing the filter page adds resolved. The one warning on a page under src/pipelineapi is the existing one on examples/customelement/cloud.md line 130, which the run for Add a page for the derived property element #315 had too.
• utm-link-lint found no campaign tag, as this repository's .utm-lint.json ({ "mode": "forbid" }) requires.
• Only rc into main passed.

[github-actions]

Documentation preview 👀