[jwrosewell]

Problem

#321, merged into rc on 15 November, describes the usage sharing rules of the specification after specifications#155 and #156 as if every language followed them. At 02:06 UTC on 15 November that was true of two languages for one change, from a search of each language repository's pull requests.

1. Every query value by default, and no cookie but 51D_ ones even with all Evidence shared. Go (51degrees-go#154) and Rust (51degrees-rust#458) have it on rc for their Monday releases. Node.js (51degrees-node#135) and .NET (51degrees-dotnet#244) have it in open drafts. Java and Python have no pull request for it.
2. Every package's version in each record. No language ships it. Go (51degrees-go#155), Node.js (51degrees-node#136) and .NET (51degrees-dotnet#245) have drafts, and the change waits until 51Degrees confirms that the later processing of shared records accepts the new elements, as specifications#156 says under What remains.

What the four languages do today

Each at its rc on 15 November.

Language	Query and form values by default	All Evidence shared
.NET	51D_ ones and the included list, empty by default (ShareUsageBuilderBase.cs line 128), every one only after SetShareAllQueryStringParameters(true) (line 295)	every key the never-shared list allows, cookies included (EvidenceKeyFilterShareUsage.cs line 276)
Java	51D_ ones and the included list, empty by default (ShareUsageBuilderBase.java line 59, EvidenceKeyFilterShareUsage.java line 230)	every cookie (EvidenceKeyFilterShareUsage.java line 200)
Node.js	51D_ ones and queryWhitelist, "By default query string and HTTP form parameters are not shared unless prefixed with '51D_'" (shareUsage.js lines 106 to 110 and 174 to 178)	every cookie (shareAll, line 154)
Python	51D_ ones and query_whitelist, empty by default (share_usage.py line 106)	every cookie (share_all, line 111)

In all four the raw Cookie header is never shared, as #321 already says.

What changed

1. src/pipelineapi/features/usagesharing.md. After the rules, a paragraph says Go and Rust follow them, and that in .NET, Java, Node.js and Python sharing all query string parameters is still off by default and sharing all Evidence shares every cookie, never the Cookie header. "What else each record carries" no longer lists every package's version as something the record holds. It names the version of the Pipeline, which is what the Version element carries today, and says naming every package in use is not in any package yet.
2. src/pipelineapi/concepts/data/evidencekeyfilter.md. The same exception for the four languages, after the paragraph on what is never shared.

When this merges

Before the documentation's rc reaches main, once the Monday language releases are known, so that #321 and this draft reach main together. The language list is finished then. If Node.js #135 or .NET #244 is in its language's Monday release, that language moves to the Go and Rust sentence. If a language ships the package versions, the record sentence changes too.

What remains

Finishing the language list once the Monday releases are known.

Build

Checks on the head, 14f1755, all green.

• Preview built the documentation with Doxygen, with no warning from usagesharing.md or evidencekeyfilter.md. The one warning on a page under src/pipelineapi is the existing one on examples/customelement/cloud.md line 130.
• utm-link-lint found no campaign tag, as this repository's .utm-lint.json ({ "mode": "forbid" }) requires.
• Only rc into main passed.