feat: allow production event parameter capture

[Chinmay-KB]

Summary

• Add TugboatParameterPolicy.allowAllInProduction as an explicit production opt-in.
• Keep namesOnly as the default.
• Keep the existing allowAll policy exploration-only.
• Retain the existing allow_all wire value and all JSON and payload limits.
• Bump tugboat and tugboat_dio to 0.7.0.
• Update the changelogs, package documentation, examples, and release acceptance version.

Why

Production integrations need Tugboat and ClickHouse to retain external-event parameter values. The prior production policy kept parameter names only.

This change provides an explicit opt-in. It does not weaken the default production privacy policy.

Impact and privacy

The new policy can retain feedback, search terms, URLs, IDs, and other user content. Hosts must confirm consent, privacy, access, and retention rules before they enable it.

Validation

• flutter analyze for tugboat: passed.
• flutter analyze for tugboat_dio: passed.
• flutter test test/sdk_version_test.dart test/external_event_and_network_test.dart: 24 passed.
• Complete tugboat_dio test suite: passed.
• dart pub get --enforce-lockfile: passed. The lock file did not change.
• git diff --check: passed.
• Production-lean smoke session: 34 external events used allow_all. ClickHouse stored the values. No parameter values were truncated or dropped.

Known full-suite failures

The complete core suite reached 347 passing tests and 2 failures. Both failures are existing route-pop timing tests outside this diff:

• modal_capture_visual_test.dart: dismiss restores base-route pixels for action, barrier, and back
• replay_overlay_nested_navigation_matrix_test.dart: dialog and modal bottom sheet retain their own route evidence

Both timed out while waiting for route_pop /root. This draft does not claim that the full production release gate is complete.

[cursor]

@copilot please review this pull request.

[cursor]

Blocked on requesting Copilot Code Review from this agent: the available GitHub token cannot call POST /pulls/{n}/requested_reviewers (403 Resource not accessible by integration; needs pull_requests=write).

Please click Request next to Copilot in the Reviewers sidebar (or run locally:
gh api repos/blendto/tugboat-flutter/pulls/35/requested_reviewers --method POST -f 'reviewers[]=copilot-pull-request-reviewer[bot]').

Once Copilot comments land, I will address them and re-request until clean.

Thermo-nuclear follow-up already applied in 5fdbd14: allowAllInProduction is a first-class TugboatParameterCaptureMode; private boolean/constructor split removed. CI version-bump check is green.

[Copilot]

Pull request overview

Adds an explicit production opt-in for retaining bounded external-event parameter values while preserving privacy-safe defaults.

Changes:

• Adds allowAllInProduction with the existing allow_all wire value.
• Adds production-policy tests and privacy guidance.
• Bumps tugboat and tugboat_dio to 0.7.0.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/tugboat/lib/src/external_event.dart	Implements the production parameter policy.
packages/tugboat/lib/src/sdk_version.dart	Updates the SDK version.
packages/tugboat/test/external_event_and_network_test.dart	Tests production and exploration policy behavior.
packages/tugboat/pubspec.yaml	Bumps tugboat to 0.7.0.
packages/tugboat/example/pubspec.yaml	Updates the example dependency.
packages/tugboat/README.md	Documents usage and privacy implications.
packages/tugboat/CHANGELOG.md	Records the new policy.
packages/tugboat_dio/pubspec.yaml	Bumps the adapter and core dependency.
packages/tugboat_dio/README.md	Updates installation versions.
packages/tugboat_dio/CHANGELOG.md	Records the compatibility release.
docs/README.md	Updates the current package version.
docs/integration/production-replay-acceptance.md	Updates the acceptance-test release version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.