What TracerAi Is

TracerAi answers the question rankings and traffic reports cannot: which pages, sources, and keywords produce signed cases and dollars, not just sessions. Each firm gets its own unique pixel; the pixel records every visit with frozen first-touch attribution, every tel: link tap, and every form submit, and the ingest stamps each session server side with IP and city-level location. The Journeys view walks every unique click end to end: source, keyword, location, entry page through exit page, pages viewed, time on site, and outcome, with a click-by-click drill-down per session, and the Consumers view rolls clicks up to people: one row per consumer, with a full journey visualization showing every visit and every click from first touch to signed. Geography adds a geo-coded consumer map with device and time-on-site reporting, Abandoned Pages shows where non-converters leave, and a Google Ads style date control (presets plus custom range) governs every report. Organic search passes no click ID and no query, so organic query data joins at the landing-page grain through the Search Console import and is labelled modelled; everything else is measured.

One-Time Setup

1. Database. In the Corridore Supabase project, open the SQL editor and run migrations/033_tracer.sql through 037_email_log.sql in order (the supabase bundle carries all of them). 037 adds the email delivery log behind the Users table's Emails status. 034 adds the per-firm pixel registry and the journey, geography, and abandonment reporting; 035 adds firm access keys, session coordinates, and the consumer journey, geo map, and device reporting; 036 links pixels to Corridore firm accounts so the login itself decides who sees what. All idempotent; nothing else in the schema is touched.
2. Environment variable. In Netlify, Site configuration, Environment variables, add TRACER_DASH_KEY set to a strong secret. This is the console password. SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are already set for Corridore and are reused; nothing else is needed. Redeploy so the functions pick it up.
3. Connect the console. Signed in as super admin, the console connects itself: it inherits your Corridore session, the badge reads Live, and you get the all-firms view with the firm selector. The TRACER_DASH_KEY is only typed into Setup when the console is used outside a Corridore login. Before the database and deploy steps land, the console runs on generated demo data so every screen can be previewed.
4. Install the pixel on the tracked website. See The Pixel below.
5. Email delivery truth (optional but recommended). In Resend: switch on Open Tracking for the sending domain, then add a webhook endpoint pointed at /.netlify/functions/email-events subscribed to all email events, and put its signing secret in RESEND_WEBHOOK_SECRET in Netlify. Welcome and reset sends then show Delivered, Bounced, and Opened in the Users table's Emails view; without the webhook the same view still works by polling Resend on demand.

The Pixel

Every firm gets a unique pixel. Create it in the console's Pixels view: pick an ID, name the firm, and list the https origins of the sites allowed to send data. The view hands back that firm's one-line snippet, which loads tracer.js from this deploy with the pixel ID attached; the script derives its own ingest endpoint from the URL it was loaded from, so nothing is configured on the client site. Place it on every page, ideally just before the closing body tag:

Who sees what. Access follows the Corridore login. Link a pixel to its firm's account in the Pixels view and that firm's logins open TracerAi already locked to their data: no All Firms view, no firm selector, no other clients' data, no pixel management, no this guide, purge limited to their own data, and a client-facing Setup Guide holding only their four go-live steps. Your super admin login gets the all-firms console with the selector and full pixel management, and when you stand inside a firm through the firm switcher, TracerAi shows exactly that firm's console, labelled Viewing As Firm, so you can confirm what the client sees. All of it is enforced server side in tracer-api, which resolves the signed-in session through my_context and forces a firm identity onto every query, whatever the client sends; the interface hiding is just presentation on top. Each pixel row also carries an access key, generated and rotated in the Pixels view, for the rare case a firm needs the console outside a Corridore login; it enforces the identical wall, and the master TRACER_DASH_KEY stays with the Corridore team.

Where pixels are created and what they scope. Pixels live in the console's Pixels view, backed by the trk_pixels table; no deploy or environment change is needed to add a firm. Each pixel carries its own authorized origins, enforced per pixel by CORS at the ingest, so one firm's sites cannot write into another's dataset and strangers cannot write at all. Every visit, call, and lead is stamped with its pixel ID, the selector in the console's top bar switches every report between one firm and all firms, and beacons carrying an inactive pixel are refused outright. The old global ALLOWED_ORIGINS variable still works and applies to the default pixel, so the original Glassman install keeps running untouched.

Install by platform.

• Plain HTML or any CMS with a global footer. Paste the snippet into the site-wide footer template so it renders on every page.
• WordPress. Appearance, Theme File Editor, footer.php before the closing body tag, or use a header and footer scripts plugin and paste it into the footer box. Site-wide, not per page.
• Google Tag Manager. New tag, Custom HTML, paste the snippet, remove the defer attribute (GTM injects it after load anyway), trigger All Pages, publish. Tel: click and form capture work normally under GTM.

Verify it is firing. Load a page on the tracked site, open the browser network panel, and look for a request to /.netlify/functions/tracer-ingest returning 2xx. Within a minute the visit appears in the console's Overview for today.

What Gets Captured Automatically

• First touch. On a browser's very first visit, the landing page, referrer, source, medium, UTMs, and device are frozen. Every future lead credits this, so an organic visitor who returns direct three days later still credits the organic landing page.
• Sessions. 30-minute sliding window with per-session attribution.
• Source classification. gclid, gbraid, wbraid, msclkid, or cpc UTMs count as paid; a search engine referrer with no click ID is organic; social hosts are social; no referrer is direct; everything else is referral.
• Calls. Every tel: link tap is logged as an event and a call-channel lead for intake to reconcile.
• Forms. Submits are captured with common intake field names: name, phone, email, case type.
• Location and IP. Stamped server side at ingest from the edge (x-nf-client-connection-ip and the edge geo header): IP, city, region, country per session. Nothing runs in the visitor's browser for either and no third-party geo service is involved.
• Abandonment. On leaving a page the pixel beacons the exit page and total session time via sendBeacon, which survives navigation, so exit pages, time on site, and bounces are recorded rather than inferred. The Abandoned Pages view rolls up where non-converting sessions end.

Custom Events And Chat Widgets

The pixel exposes a small API on window.jgt for intake flows the automatic capture cannot see. When a chat widget converts, call:

And for engagement events worth counting:

Google Search Console Import

In Search Console open Performance, set the date range to one calendar month, add the Query and Page dimensions, and export as CSV. In the console's GSC Import view, set the period as YYYY-MM and paste the rows as page, query, clicks, impressions, position. Header rows and full URLs are handled, and re-importing a month overwrites it cleanly. The Pages view then joins clicks and positions against sessions, leads, and signed value per landing page; clicking a row shows its top queries.

Working The Pipeline

Leads land as new. Intake moves them along contacted, qualified, signed, or rejected from the Leads And Cases view, adding case value on signed. Those statuses roll up everywhere: the funnel, the per-page table, and the source breakdown, which is what turns is the SEO working into a dollars-per-landing-page answer.

Reading The Numbers

• Pages view, Lead Rate is leads over organic sessions. This is the relevance test. Informational pages will show big GSC clicks and a rate under 1 percent; commercial pages should run 3 to 8 percent.
• Sources view reads right to left: signed value first, then lead rate, then volume.
• Overview funnel shows Organic Clicks, Contacts, Qualified, Signed Cases, and Case Value with stage-to-stage conversion.

Security And Data Notes

• All trk_ tables have row level security enabled with no public policies. The only doors are the two functions: tracer-ingest is write-only, unauthenticated, origin-checked, with whitelisted event types and clipped values; tracer-api requires the TRACER_DASH_KEY header for every read.
• Data is first party. No third-party cookies and no external scripts on the firm site.
• The pixel stores two localStorage keys on the tracked site, _jgft for first touch and _jgss for the session window.

Troubleshooting

• Badge stays on Demo Data. The key saved in Setup does not match TRACER_DASH_KEY in Netlify, or the site was not redeployed after the variable was added.
• Pixel fires but nothing arrives. Check the tracer-ingest response in the network panel. A CORS refusal means the site's origin is missing from that pixel's authorized domains in the Pixels view. A 403 means the pixel was set inactive. A 500 names the Supabase error; the usual cause is migrations 033 and 034 not yet run.
• Journeys shows blank keywords on paid clicks. The ad account is not passing utm_term; set the final URL suffix as described under The Pixel.
• Location shows Unknown. The deploy is not serving through Netlify's edge (the geo header is absent). IP still records when a forwarding header exists.
• The console shows All Firms while standing inside a firm. The deploy predates R259, where the console began forwarding the acting firm. Deploy the current build and purge the CDN; while acting inside a firm the console then locks to that firm and labels itself Viewing As Firm.
• Console loads stale after a deploy. app.corridore.com sits behind Cloudflare; purge the cache after deploying, the same standing step as the rest of Corridore.
• Full runbook. docs/tracerai-setup.md in the repository carries this guide plus the standalone-deploy variant.