feat: harden orchestrator execution runtime

docs/local-analytics.md

@@ -1,37 +1,51 @@
-# Local Memind + Umami analytics
+# Local Memind analytics (Umami + Rybbit)
 
-The integration is local-only by default. Memind proxies `/analytics/*` to the
-local Umami service at `http://127.0.0.1:3100`; it does not contact 103/105.
+## Umami (optional)
 
-1. Start `/Users/john/Project/memind-analytics` and verify:
+Memind can still proxy `/analytics/*` to a local Umami service at
+`http://127.0.0.1:3100`.
 
-   ```bash
-   curl --fail http://127.0.0.1:3100/api/heartbeat
-   ```
+```dotenv
+MEMIND_ANALYTICS_ENABLED=true
+MEMIND_ANALYTICS_URL=http://127.0.0.1:3100
+MEMIND_ANALYTICS_WEBSITE_ID=<website-id>
+MEMIND_ANALYTICS_ID_SECRET=<random-local-secret>
+MEMIND_ANALYTICS_DOMAINS=127.0.0.1,localhost
+```
 
-2. Create one Umami Website for the local generated-page host. Do not create a
-   Website per page or per user.
+## Rybbit (recommended for behavior analytics)
 
-3. Put the Website ID and a local-only pseudonymization secret in Memind's
-   `.env`:
+Rybbit runs on 105 as `https://rybbit.tkmind.cn`. Local Memind does not talk to
+103 for analytics. It proxies same-origin `/rybbit/*` to Rybbit `/api/*` so the
+browser script stays first-party:
+
+```text
+Generated Page
+  -> /rybbit/script.js  -> https://rybbit.tkmind.cn/api/script.js
+  -> /rybbit/track      -> https://rybbit.tkmind.cn/api/track
+```
+
+1. In Rybbit, create one Site for the local host you use (`127.0.0.1` or
+   `localhost`). Do not create a Site per page or per user.
+2. Put the numeric Site ID and a local pseudonymization secret in Memind `.env`:
 
    ```dotenv
-   MEMIND_ANALYTICS_ENABLED=true
-   MEMIND_ANALYTICS_URL=http://127.0.0.1:3100
-   MEMIND_ANALYTICS_WEBSITE_ID=<website-id>
-   MEMIND_ANALYTICS_ID_SECRET=<random-local-secret>
-   MEMIND_ANALYTICS_DOMAINS=127.0.0.1,localhost
+   MEMIND_RYBBIT_ENABLED=true
+   MEMIND_RYBBIT_URL=https://rybbit.tkmind.cn
+   MEMIND_RYBBIT_SITE_ID=2
+   MEMIND_RYBBIT_ID_SECRET=<random-local-secret>
    ```
 
-4. Restart the local Memind server. Full generated HTML pages will receive a
-   same-origin `/analytics/script.js` tracker. The tracker identifies the
-   visitor with a stable pseudonymous owner ID before sending a standard Umami
-   page view, so Users and Pageviews are populated. The Identify properties
-   include the readable Memind username and current public page URL for
-   operational analytics. Click, form, scroll, and engagement events retain the
-   pseudonymous `owner_id`, `page_id`, and `channel` dimensions.
+3. Restart the local Memind server. Full generated HTML pages receive a
+   same-origin `/rybbit/script.js` tracker. The tracker identifies the visitor
+   with a stable pseudonymous owner ID, then records engagement events such as
+   `page_click`, scroll depth, and dwell time. Initial pageviews come from
+   Rybbit's site setting `trackInitialPageView`.
 
-The integration is fail-open: missing configuration, disabled analytics, or a
-down Umami service leaves page generation and page delivery unchanged. User
-facing analytics must be queried through a future Memind API that filters by
-the authenticated owner; do not expose the Umami dashboard directly to users.
+4. Open Rybbit from local `memind_adm` → Analytics 配置 →「打开 Rybbit 分析后台」
+   (SSO). That path requires matching `MEMIND_RYBBIT_SSO_SECRET` /
+   `RYBBIT_SSO_EMAIL` with the 105 Rybbit deployment.
+
+Both integrations are fail-open: missing configuration or a down analytics
+service leaves page generation and page delivery unchanged. Do not expose the
+Rybbit or Umami dashboards directly to end users.