Dependency map

Implementation dependency #174. #176 consumes the fixed catalog and typed correlated evidence. Integration gate #178. Parent #173.

Design/plan only. No implementation, local gates or exact-SHA code review claimed yet.

Starting O2 from clean main 4a7ae1817a5e0a6f48810a9121e1adb20042ae07; O1/#174 is merged with green exact-head/resulting-main CI. Authoritative scope: original #101 plus reviewed design193140025/193140595 and clarification193140886. Dependency #174 satisfied; #176 consumes O2, UI #177 and integration #178 remain explicit rollout gates.

Implementation plan:

1. Add a fixed machine-readable metric catalog (types/units/finite dimension domains/origins/availability/reset/window), per-boot atomic counters/fixed histograms and 15s sampler. Use 60 UTC one-minute buckets with explicit completeness/missing/boot/reset boundaries and no fabricated zero-fill or cross-boot rate.
2. Instrument actual admission/terminal, collection fetch/provider transport attempts, confirmed stage commit and successful embedding, writer contention, retry scheduling, recovery and Admin finite route/outcome boundaries. Emit outside execution locks; no callback may block on disk, networking or a user-supplied sink. Loaded durable state/recovery/coalescing must not increment actual-attempt or committed-throughput counters.
3. Derive bounded128 active/recovered incidents from existing durable job/collection/frontier truth, preserving retry deadlines/last success separately from collector coverage. Correlation references are internally generated opaque IDs; no raw routes, coordinates, errors, headers or source text in telemetry.
4. Add deterministic fake-clock/null-probe/missing samples/reset/clock-rollback/cardinality/hostile-input tests and actual hook tests for replay, cancellation, contention, partial commit and recovery. Verify full Go, relevant race, vet, docs/diff and applicable Admin semantic gates, then independent exact-SHA review, required head CI and resulting-main CI before closure.

Non-goals: no new observation transport endpoints or UI in this child, no remote telemetry/external TSDB/schema migration, no host install/upgrade/release. Transport/UI cohort stays #176/#177; these backend primitives are not advertised as feature completion. Key risks are measurement semantics/double counting, execution-lock coupling, cardinality, reset history and self-observation recursion. Progress and any design corrections stay in comments; original issue title/body remain fixed.

Implementation increment (not O2 completion): ad9439e06980a31e49766c6b5effdbbae9eb4c3b on codex/issue-175-runtime-metrics, based on 4a7ae1817a5e0a6f48810a9121e1adb20042ae07.

Added the fixed machine-readable catalog, finite prebuilt series, per-boot counters/duration histograms, deep-copy DTO snapshots, 60 UTC minute ring, four distinct15s sample slots, null+reason probes, missing/baseline/boot boundaries, histogram interval accumulation and bounded cancellation-aware runtime sampler. Deterministic tests cover hostile dimensions, non-finite values, copy isolation, missing/duplicate/rollback samples, counter resets/rates, histogram extrema/counts, retention/serialized footprint, concurrency and a stalled probe. A stalled probe cannot block recording/snapshot reads or be certified as joined.

Implementation detail correction to the initial framing: recording uses short bounded TryLock-only critical sections with an atomic dropped-evidence counter, rather than claiming exact atomic aggregation of every counter/histogram contribution. Contended/invalid telemetry is explicitly partial; it never blocks execution or silently fabricates zero. No disk/network/probe callback runs from recording. Catalog cardinality and history are fixed; unavailable origins remain null until their actual hook is attached.

Passed locally at this increment: go test ./...; go test -race ./internal/observability; go vet ./...; ./scripts/check-product-docs.sh; git diff --check. Focused metric tests also passed uncached. Independent code review and required remote CI: not yet qualified. No PR/merge/closure.

Remaining required scope: wire the sampler lifecycle to the daemon; actual admission/terminal/provider/staging/confirmed-throughput/writer/retry/Admin boundaries outside execution locks; safe event correlation; durable-truth bounded128 active/recovered health projection; actual-hook replay/recovery/cancellation/fault regressions; final full gates, independent exact-SHA review/head CI and resulting-main CI. Transports/UI stay #176/#177 and integrated gate #178. This increment is a foundation, not the complete feature or O2.

Independent post-PR gate: CLEAR

Independent reviewer validated live PR !168: open, base main at 4a7ae1817a5e0a6f48810a9121e1adb20042ae07, head codex/issue-175-runtime-metrics at exact previously reviewed 4e313073c987d4940de9d4b3bbc7589744c4c38a. Body includes Closes #175, full scope, design/dependencies, verification, risks and recovery. Fresh live PR discussion sync completed with zero comments/no failures; all and unresolved discussion queries are empty. Exact-head required CI was independently rechecked successful. No code changed after the full exact-SHA review.

All pre-merge gates are clear. Proceeding with normal merge through the audited CLI fallback because this connected MCP catalog does not expose merge_pr. Full expected-head guard and a durable idempotency key are used; no force or check bypass. Resulting main CI remains required before closure.

Merge confirmed; resulting main verification pending

PR !168 is canonically merged. Audited normal merge succeeded with full expected-head guard and durable key; provider-confirmed merge revision and remote main are 64b1e31d1a57402fd47f30c517a3326b241838fd.

Luna located resulting main CI run 38123994077, attempt 1, push, .github/workflows/ci.yml, exact merge SHA. It is currently in progress, not yet passed. #175 remains open until this required gate finishes green. No release, installation, service restart or forced mirror action.

O2 complete — merged and main CI green

PR !168 merged as 64b1e31d1a57402fd47f30c517a3326b241838fd. Git parents are intended base 4a7ae1817a5e0a6f48810a9121e1adb20042ae07 and independently reviewed head 4e313073c987d4940de9d4b3bbc7589744c4c38a.

Independent exact-SHA accumulated O2 review: CLEAR, no remaining P0–P2; post-PR live refs/body/discussions independently clear. Full local Go, relevant six-package race, vet, product-docs and whitespace gates passed; exact reviewed-head CI 38103152507 succeeded. Earlier failed probes and their corrections remain in preceding comments.

Resulting main CI 38123994077, attempt 1, push, .github/workflows/ci.yml, was independently observed by Luna at exact merge SHA: terminal success; required job 114424408713 succeeded with no failed steps.

All six O2 backend acceptance criteria are satisfied: documented fixed catalog; finite public-safe dimensions; truthful missing/reset/history semantics; actual counting without replay double-counting; bounded retained-authority health distinct from observation health; bounded nonblocking cancellation/restart/fault behavior. #176 transports, #177 Admin UX and #178 integrated rollout remain explicit open children. #188 is not claimed fixed and remains an O5 disposition dependency. No release or installed-service mutation occurred.