Telemetry: server-side filtering to prevent spoofing of public prod ingestion key

[amilandi]

Background

The ESS ADK / FlightCheck telemetry (PR #165) emits to a prod 1DS OneCollector by default, using a write-only ingestion key that is embedded in a public repo (the standard 1DS pattern). Because the key is public and DEFAULT_ENV is prod, anyone can POST arbitrary ESSMakerKit.* / adk.* envelopes to the production dashboards. The env dimension alone does not prevent spoofing.

These dashboards (usage, FlightCheck pass/fail/"success rate") are reported up to leadership, so we want defense against inflated or spoofed numbers.

Ask

Add server-side / dashboard-side filtering so the leadership-facing metrics are resilient to spoofed ingestion. Options to evaluate:

• Filter envelopes on a signed / hard-to-guess dimension (e.g. an HMAC over stable dimensions with a rotating secret) at the Aria cube/RTA layer.
• Drop envelopes with implausible dimension combinations (unexpected adk_version / surface / env).
• Consider a gateway/collector that validates a shared secret before forwarding to the prod cube.

Notes

• This is a known, accepted limitation of the write-only-key model — tracking here so it's addressed before the numbers are trusted for decisions.
• Raised in PR Add Aria/1DS telemetry for ESS ADK & FlightCheck #165 review by Dawn Jeong (@daeunJe0ng).