Note that you can now specify an arbitrary beta survey link with the betaFeedback key in a module group:
https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/PersonalDashboard/+/refs/heads/master/extension.json#494

Verified on patchdemo

Patch Demo has no EventGate instance, so nothing leaves the browser there.
That keeps this task scoped to:

• enrollment through TestKitchen without an override
• sendExposure() firing
• personal-dashboard-health-metrics events arriving with module_group and a module_variants entry for review-changes-home

The Grafana work in T438883: PersonalDashboard: Report performance per special page and module group in Grafana: it can't tell one special page's numbers from another's until the instrument identity moves into the subclass here. I meant to note this when I filed.

That sounds like a good approach; I'll Connor to either doing or reviewing the fix next week.

My follow-up question would be: are there known clients that we would now break by changing back to snake case?

@MusikAnimal this is now ready for deploy

A note from my Suggested Edits migration work:
Special:Homepage has a route that Home needs too: Special:Homepage/newcomertask/. SpecialHomepage::handleNewcomerTask() validates the click parameters, resolves the task type, merges that type's redirect parameters, and sends the reader to the article with a suggested edit session started. It is what makes a suggested edits card open the editor rather than just the article. The post-edit panel links at it, and so does the PersonalDashboard Suggested Edits module in T432037.

New demo wiki: Special:PersonalDashboard, serving patchset 5 of change 1340093 plus the Cypress fixture change on T438486. Only Alice has been seeded with stuff.

Just verified it's in 1.47.0-wmf.21

I see: https://gerrit.wikimedia.org/r/c/1343126 in https://gerrit.wikimedia.org/r/q/project:mediawiki/extensions/PersonalDashboard+branch:wmf/1.47.0-wmf.20 we should be good to go on the PersonalDashboard side, no?

@KStoller-WMF @Samwalton9-WMF I've got as fully fleshed out patch demo as I can reasonably do and I'm currently on a wikibase fixtures sidequest to make that better for future patchdemos. Have a look!

pulling this out of onboarding and unassigning as @TheresNoTime is reasonably well onboarded at this point, and I'm setting up a team-wide board for stack rotation.

In T436156#12329472, @AnneT wrote:

In T436156#12320238, @jsn.sherman wrote:

@Rsilvola happy to run another round of this /vuln-audit against a poc of using this vendored version in the PersonalDashboard extension.

This makes sense to me; seems like we'll get more meaningful results that way. Thanks for doing this @jsn.sherman!

IMO, mod tools (ie. me) laid down a footgun when we vendored the resource without namespacing it. Lesson learned on my end for defensive coding.