Agent-era builds · Drift desk

The drift desk

A tag added with good intentions in January is a leak by June. Nobody meant to ship it; nobody watched it. The drift desk is the monthly watch that keeps a site's trackers, pixels, and server feeds on the record they were approved on. One register, one cadence, one evidence file a month, and a hard rule: nothing new fires before a human stamps it.

Register template v0.1.0 · Published 2026-11-04 · french_completeness_status: complete · This page is an open description of the method. It is not legal advice, and it is not a movahedi.ca compliance certification.

The register

One register every site gets

The register is the source of truth for everything that carries data off the page. One row per host, seven fields, no exceptions. Download the template and start from it:

Field	What goes in it
`host`	The hostname observed in the DOM crawl, or the webhook destination for server-side feeds. Bare hostname, no scheme.
`delivery_vector`	`client_dom` (script, pixel, or beacon in the page) or `server_webhook` (the first-party server forwards data to this destination).
`legal_recipient`	The organisation that receives and uses the data for its own purposes. Often different from the domain that set the cookie; the vendor cookie knowledge base keeps both.
`owner`	Who inside the client organisation owns this row (site-operator, marketing, product, privacy-officer).
`consent_category`	strictly_necessary, security, functional, analytics, or marketing_profiling. Law 25 s. 8.1: only strictly necessary (and security, where demonstrably needed) may be active by default.
`decision`	approve (known host, runs under the recorded category), gate (runs only behind the consent gate; any scope widening needs a fresh stamp), or remove (scheduled for removal; the next monthly file must show it gone).
`expiry_date`	The row expires here. A host with no fresh row after expiry counts as unexplained in the next cycle.

The cadence

Seven steps, once a month

Dual observation. A headless DOM crawl records what the page actually does: pre-consent cookies, local storage, beacons, and whether the consent banner's buttons are symmetric in English and French. Alongside it, a read-only JSON ingest pulls the tag manager container and the server-side webhook destinations. The crawl sees the browser; the ingest sees what the browser cannot, because server-side forwarding leaves no trace in the DOM.
Register diff with delivery_vector. The observed hosts are diffed against the register, keeping client_dom and server_webhook separate. A host that moved from the DOM to a server feed is a change, not a disappearance.
Corpus classification. Every host is classified against the vendor cookie knowledge base and the corpus. Behavioral hosts are tagged with Law 25 s. 8.1 and with the Bill C-36 behavioral-influence bar, labeled pending, because the bill is at second reading and is not law.
Triage. Known hosts with an unchanged footprint get draft decisions. Anything new, anything with a widened scope, or anything consequential is flagged human_review_required and waits for a person.
The canonical stamp. Before any tag container publish, the change carries a v0.1 stamp (spec) with OPC-2023-001 or CAI-LOI25-S8.1 citations, binding the exact container diff to the exact draft a person approved.
The monthly evidence file. One client-tenant PDF plus JSON per cycle: what changed, what expired, what is unexplained (with each tracker's age in days), and every signed stamp from the cycle.
Scorecard telemetry. Every cycle logs cost per file, first-pass knowledge-base accuracy, intervention hours, reversal rate, and unexplained-tracker age. The desk is a product with numbers, not a ritual.

The manifest ingest

Where the tag manager plugs in

The read-only ingest expects a JSON manifest the client exports from their tag manager: container id, every tag with its trigger and destinations, and every server-side webhook destination with the data categories it forwards. The desk never writes to the container; the only write it ever makes is the stamp that a person signs before a publish. The expected shape:

{
  "container_id": "GTM-XXXXXXX",
  "exported_at_utc": "2026-11-01T09:00:00Z",
  "tags": [
    { "name": "ga4-pageview", "vendor": "Google Analytics",
      "trigger": "consent_analytics_granted",
      "destinations": ["analytics.google.com"] }
  ],
  "server_webhooks": [
    { "destination": "warehouse.example.com",
      "events": ["purchase"], "data_categories": ["purchase_event"] }
  ]
}

movahedi.ca itself publishes no tag manager container and no server-side webhook destinations, so this step had no container manifest to ingest on the reference run. The googletagmanager.com reference in the page source is the consent-gated Google Analytics 4 loader (gtag.js, G-0MXQWZ2HBE), not a tag manager container: it appears in the register as an analytics host, but there is no container to pull a manifest from. That distinction is stated plainly below rather than papered over.

The reference run

Run end-to-end on movahedi.ca, 2026-11 cycle

The desk eats its own cooking. The full cadence ran on this site as the public reference implementation. What it actually found:

No pre-consent trackers observed by static fetch; runtime behavior unverified. The static HTML fetch observed no pre-consent cookies and no tracker loads. Google Analytics 4 and Microsoft Clarity are coded to load only after the visitor opts into analytics; the consent default denies analytics storage and keeps ad storage denied. No runtime browser session ran, so that gating is read from the code, not observed live.
Four register rows. googletagmanager.com (Google LLC, GA4 loader gtag.js, consent-gated), clarity.ms (Microsoft, analytics, gated), challenges.cloudflare.com (Cloudflare Turnstile, security, approved: loads only when a visitor submits to the site chat), and first-party movahedi.ca (consent state and theme, strictly necessary, approved).
One human review flag. The French banner renders English copy on the server before the consent island hydrates and applies the French strings. Buttons are symmetric after hydration. No trackers fire either way, but the SSR default needs fixing. Update November 4, 2026: consent banner SSR fixed. French strings now render server-side on /fr/ pages (CookieConsent lang prop passed from BaseLayout), verified live via curl.
One gate recommendation. Clarity is session-replay capable but bundled under a single generic analytics opt-in with GA4. The draft decision keeps it gated and recommends a separate session-replay toggle or an explicit replay disclosure before the pilot phase.
Zero unexplained trackers. Changed: 0. Expired: 0. Signed stamps this cycle: 0 (no container publish was proposed).

The evidence file from that run, in both formats:

The method limits, honestly

The reference run used static HTML fetches, not a runtime browser, so runtime-set cookies, runtime beacons, and the hydrated banner text sit outside what it could observe. Pre-consent network behavior was inferred from the consent gate code, not from a live pre-consent session. A production client cycle runs the headless DOM crawl plus the manifest ingest described above.

The guardrails

What the monthly desk does not absorb

Every quote carries these in writing. They are what keep a flat monthly desk from quietly becoming an unbounded engagement:

1.5 hours of human supervision per base production site per month.The desk is scoped to fit inside it. If a cycle needs more, the client sees why in the scorecard before anything else happens.
More than five new third-party domain families, or an unannounced server-side CDP in one cycle, triggers the pre-quoted new-domain/tag-manager project fee. That is a project, not a monthly file.
A baseline scan with more than 15 unexplained pre-consent trackers, or a dark-pattern banner, disqualifies the site from the monthly desk until a fixed-fee remediation sprint completes. The desk watches drift; it does not launder a broken baseline.

The desk opens to pilot clients in April 2027, stamped monthly files and all. It becomes a standing product only if the numbers hold: supervision under 1.5 hours a file, first-pass knowledge-base accuracy above 85%, reversals under 5%, and renewals at full margin.

Standing note

What this page is not

This page describes an open method. It is not legal advice, and the stamps and files it describes are not movahedi.ca compliance certifications. Pending legislation (Bill C-36) is labeled pending wherever it appears.