O2 contract dependency checkpoint: #175 has an independently CLEAR and exact-head CI-green execution-event foundation at c4d0f1298e9cabbbe91a835530ee3172ee2f506e; O2 itself is still incomplete and not merged. Its comment193170972 records the code-specific finite compatibility table.
When implementing transport parity here, include strict supported selectors for execution outcome/failure class plus the relevant phase/collection and opaque correlation refs. Validate before observation reads and bind the complete normalized filter into cursors across Admin/IPC/CLI/MCP. Fixed unified info templates are neutral completion statements, NOT success indicators; severity alone must not silently hide failed provider/job outcomes. Preserve the readonly/no-provider/no-admission/no-recursive-event-storm contract. Coordinate the same fields/deeplinks/empty/degraded states with #177. This records the dependency explicitly without replacing the original issue input.
O2 contract dependency clarification (implementation still pending O2 review/merge): repository-document health separates inspection from indexing; index-job success cannot establish Git/policy/revision-state inspection availability. Inspection history is a fixed retained episode with actual owner timestamps, not polling-time fabricated success. Legacy/unobserved/malformed evidence is partial/unknown; failed retention preserves the preceding episode with incomplete coverage. Independent admission faults remain indexing incidents. O3 must expose finite phases, active/recovered state, retry/last-success and partial reasons in shared DTOs across Admin/IPC/CLI/MCP, without serializing private registry paths, raw error classes or source coordinates. Observation reads must remain side-effect free, including when inspection authority is busy/missing. Current df3e86e7 exact-SHA review/CI are pending, so this is a required cross-child contract, not clearance or early rollout.
O2/Admin integration dependency clarification from #175 design comment193174688: when registering the new observability summary/metrics/events GET endpoints, exclude their registered patterns from admin_request_completed event emission before exposing them. Do not infer exclusion from arbitrary request path prefixes. Add a deterministic endpoint/polling regression proving observation reads do not append their own events or create SSE log-change feedback loops. Ordinary Admin request metrics remain separate fixed-cardinality observations. This is a visible rollout gate, not current O3 implementation or acceptance; O2 remains incomplete.
O3 implementation plan and shared contract (r1)
Starting from merged, independently reviewed and main-CI-green 64b1e31d1a57402fd47f30c517a3326b241838fd; issue branch codex/issue-176-observation-transports is clean. #174 and #175 are complete. Original input and #101 reviewed architecture remain fixed; this comment specifies the transport boundary, including later O2 corrections.
Ownership and scope
A single daemon-owned observation reader composes the concrete O1 collector, O2 metrics and bounded durable-authority execution-health projection. Shared request/result DTOs live below Admin/IPC adapters, avoiding import cycles. Admin calls it in-process; CLI/MCP call it through local IPC. No transport independently reinterprets counters, incidents or ledger state.
Three methods: summary, metrics, events. Summary separates execution health from observation health, includes boot/reset/start identity, managed-output/retention readiness, bounded current resource/queue state and capability limits. Metrics returns the fixed machine-readable catalog and bounded current/history with unavailable values preserved as null + reason. Events returns typed safe events, coverage and signed cursor; sparse pages advance scanned position.
No source/cache/provider body, private path/coordinate, credential, arbitrary destination or endpoint input. No start, credential resolution, provider call, sync/index/admission, OS discovery command, install, cleanup or repair from a read. Reads do not ingest legacy files or sample probes synchronously; they consume existing observations only. Missing/busy telemetry or authority returns explicit unavailable/partial state, never a healthy invented zero.
Validation and bounds
Validate before invoking an observation reader or connecting for a query. Unknown/duplicate fields, wrong JSON shape/type, trailing JSON, malformed encoding and invalid/conflicting selectors fail with a fixed public-safe error. HTTP requires one value per supported query field; CLI rejects unexpected positionals or flags not applicable to its observation action; MCP schemas and runtime decoding are strict.
Events retain stream/severity/component/code and add finite phase/collection/outcome/failure-class selectors plus typed opaque job/registration/cache/repository/correlation/stage/source/predecessor refs. Validate closed catalog membership and incompatible combinations. The whole normalized filter, including UTC time range and refs, binds the cursor. Times are explicit RFC3339Nano UTC; since/until must appear together, ordered, with at most seven days between them. No range means only retained evidence, not an unbounded history scan. Events default limit 50, accept 1..200; existing 64 KiB output/scan and 512-byte cursor caps remain. Changing any selector rejects the old cursor; generation/loss/retention boundaries remain typed snapshot_required reasons.
Metrics accepts only an optional fixed catalog metric name and history_minutes 1..60 (default 60); no arbitrary labels, entity labels or cross-boot rates. Summary has no caller-driven filesystem or entity discovery input. Shared response byte ceilings apply consistently: event page 64 KiB; summary 128 KiB; complete fixed catalog/history metrics at most 4 MiB. Oversize output fails explicitly rather than truncating JSON or silently claiming complete coverage. Observation RPC uses bounded request/response decoding and a cancellable two-second read budget; deadlines never cancel core work.
Transports, capability and errors
IPC advertises observability.v1 with limits and exposes Observability.Summary / Metrics / Events. CLI service observe|metrics|events and MCP service_observability|service_metrics|service_events negotiate this capability. An older daemon yields typed unsupported_capability and a fixed explicit update handoff; a missing daemon yields service_unavailable. Neither condition starts or updates anything. New MCP tools are discoverable under read policy and have no write_mode/idempotency/credential requirement.
Admin registers GET /api/admin/v1/observability, /observability/metrics, /observability/events behind session, Host, same-origin/Fetch Metadata and no-store boundaries. Invalid input, authentication failure and method rejection cannot invoke observation providers. Observation-specific errors have fixed code/reason/remediation and preserve cursor reset reasons without echoing request strings.
SSE, context and UI cohort
Reuse the compact Admin invalidation stream, never stream ledger entries or raw stdout/stderr. Coalesce observability_changed to at most once per second using stable collector generation/sequence/loss and sampled-metric identity, not polling time, request counters or arbitrary query strings. Registered observation GET patterns are excluded from admin_request_completed events (the O2 exclusion is already present); deterministic polling tests prove no recursive ledger/SSE storm. Ordinary fixed-cardinality Admin metrics remain truthful.
Safe copy context is a bounded shared typed DTO containing boot/generation, finite status/code/coverage and opaque refs, not the existing broad cache/config snapshot. Existing Admin entity projections must expose consistent observation refs needed for #177 deep links without resolving arbitrary identifiers or adding public paths. No new screen or browser action is delivered here: #177 owns Service view, cross-view links, keyboard/narrow/theme coverage and every loading/empty/partial/stale/disconnected/cursor-expired/not-retained/unsupported state. #178 owns integrated rollout and explicit #188 disposition.
Reviewable increments and verification
- Shared validators, DTOs, bounded query filters/cursors, context copy and reader; deterministic normalization, sparse/time/compatibility/size/privacy tests.
- IPC capability/strict params/bounded cancel, older-daemon/missing-daemon tests; CLI/MCP discovery, strict inputs, shared DTO/error parity.
- Authenticated Admin endpoints and coalesced invalidation; security/query-before-read spies and no-recursion regression, documentation.
- Full local Go/vet, relevant race packages, product-docs/diff checks, applicable embedded asset/frontend semantic gates; independent exact-SHA review and required head/main CI before closure.
Risks: cursor compatibility on additive filters, reply size, partial authority under contention, old-daemon behavior and self-observation loops. Existing O1/O2 counters/retention/execution authority are not weakened. No migration, release or installed-service change. Design review precedes code; implementation and test evidence will follow as new comments.
O3 r1 correction — independent design qualification
Independent review of comment193195756 identified two P2 implementation-boundary gaps. The intent was correct but existing helpers do not enforce it; the following is required before implementation clearance.
Cache/credential-independent MCP bootstrap
The three daemon-observation tools must be discoverable and callable in normal and minimal handlers on both stdio and HTTP/SSE, including cache-parent failure, unreadable/incompatible SQLite, and provider bootstrap failure. Installing them only after normal cache/provider creation is insufficient.
MCP observation invocation and tools/list must not cause credential resolution or cache creation/migration. Move eager MCP-only initialization behind a lazy, bounded per-handler bootstrap for operations that actually need it; separate metadata/daemon-only tools from cache/provider-dependent tools. Remote operations retain explicit live intent, provider confirmation and existing credential resolution when that operation is invoked—never silently substitute fixture mode for a requested live write. Cache failures preserve their existing typed startup diagnostic for cache-dependent operations, without disabling daemon-only observation. Lazy initialization is serialized without blocking a daemon-only tool behind cache/provider initialization. Minimal and normal handler/provider setters must share the same local observation transport implementation.
Regression spies cover entrypoint startup + tools/list + calls, not only the final tool handler: valid/missing credentials; unreadable/migration-required/cache-parent fault; provider bootstrap fault; read policy; stdio and HTTP/SSE. Assert zero credential-resolution, cache creation/migration, provider/admission/install calls for observation discovery/read. Explicit later authorized live tools continue to resolve credentials and preserve audited-write behavior. Invalid effective configuration still produces its existing safe configuration diagnostic; no guessed daemon endpoint.
Cancellation and lock acquisition are part of the read budget
The two-second bound starts before capability negotiation and is shared by negotiation plus the actual query, never two independent two-second phases. Apply a bounded context to the established socket as well as dial, including read/write deadlines, cancellation close, strict response byte cap, response envelope/id/protocol checks and fixed error mapping.
Server-side snapshot acquisition also obeys the deadline. Do not wrap context-unaware Collector.Query/Coverage or Metrics.Snapshot in a detached goroutine and return on timeout. Add bounded/context-aware observation snapshots that wait only while their query context permits (or return typed authority/telemetry busy/unavailable), then do cursor/projection/serialization work from immutable copies outside locks. Existing nonblocking execution-emission semantics remain unchanged. No abandoned worker per timed-out poll, retry amplification, lock held while formatting/networking, or incomplete result claimed complete.
Tests hold actual collector/metric locks and establish a deliberately silent local socket peer; prove bounded cancellation, no surviving query workers and no mutation/admission while requests repeat. Also test canceled context before negotiation, cancellation between negotiation/query, and response-overflow/invalid-envelope faults. The server does not cancel actual jobs.
Concrete safe-copy and link bridge bound
Safe copy context is a schema-1 DTO capped at 16 KiB, selected from already returned trusted event/incident evidence and finite summary state. No broad Admin snapshot, cache/config lookup, private repository id or free-form error is an input. Existing Admin job/maintenance/cache/repository/source projections receive additive opaque observation references derived from their known authority; #177 uses those references for links and may map them back only against already listed local entities. No arbitrary lookup endpoint or fourth new write/action is introduced.
These are requirements, not implemented fixes or acceptance evidence. Original issue input is unchanged. Re-review follows before code.
O3 r1 correction — source-specific incident correlation
Independent design review found one further P2: repository-document health cohorts already distinguish private source identities, but current Incident/health refs omit the source reference. Two sources under one cache/repository/registration can therefore have separate incidents with indistinguishable public entity refs. The incident hash is not a substitute for the source selector.
O3 must carry the known, trusted source identity through HealthEvidence.Context, Incident.source_ref, shared summary and bounded safe-copy context, using the identical typed KnownRef("source", authoritative source id) derivation used by repository-document maintenance events and additive Admin source projections. Include source_ref only where source authority exists; never infer it from a cohort hash, private coordinate, request string or lookup.
Required deterministic regression: two distinct retained repository-document sources under the same registration, both with inspection failure. Each incident links to its own listed opaque source; filtering events by that source returns only that source's transitions. Restart/readback retains the bridge; missing source authority omits source_ref and explains unavailable/not-retained context instead of mapping to another source. This is diagnostic correlation scope in O3, not a claim that #188 core mutation is fixed. #177 consumes the same bridge.
Independent design review CLEAR for comments193195756 +193195952 +193195998 on baseline 64b1e31d1a57402fd47f30c517a3326b241838fd; no remaining P0–P2. Reviewer independently inspected authoritative inputs and concrete transport/collector/metrics/health/Admin owners. Three P2 design gaps were corrected and re-reviewed: MCP bootstrap independence, cancellation through socket/snapshot ownership, and source-specific incident bridge. This is design clearance only, not implementation/CI/cohort completion. Beginning shared bounded-query/health foundation first; transport and bootstrap work remains in this issue.
O3 implementation progress (uncommitted issue branch based on main 64b1e31d1a57402fd47f30c517a3326b241838fd): the shared bounded reader, strict selectors/cursors, cancellable IPC negotiation, Admin observation GETs and coalesced SSE revision, opaque listed-resource correlation, and cache/credential-free CLI observation commands are implemented. Focused offline tests and focused race runs passed; real two-source retained incident → source-filtered execution evidence → restart correlation passed. The first full go test -p 1 ./... correctly failed on two Admin compatibility assertions: absent authoritative refs must remain omitted, and the formerly-unregistered metrics URL is now a registered observation endpoint. These have been corrected without weakening the unregistered-prefix regression; focused Admin/servicectl tests now pass. Remaining: MCP observation tools and lazy cache/provider bootstrap, bounded safe-copy contract, additional transport qualification, documentation, full gates, independent exact-SHA implementation review, PR/head CI and resulting main CI. No issue completion, merge, release, or installed-service change is claimed.
O3 implementation candidate — independent review requested
Exact SHA 2e089a4c257167a831307d10ff4713eceeaf98d8, branch codex/issue-176-observation-transports, base 64b1e31d1a57402fd47f30c517a3326b241838fd.
Implemented the shared bounded summary/metrics/events reader, whole-filter cursor fencing, finite selectors and opaque entity/source bridges, safe-copy schema-1 projection, private IPC capability negotiation and established-socket cancellation, authenticated same-origin Admin GETs plus coalesced invalidation, early read-only CLI routes, and normal/minimal stdio + HTTP/SSE MCP observation tools. The dedicated UI remains #177; integrated rollout remains #178.
MCP discovery/observations no longer initialize cache or resolve credentials. A requested dependent tool lazily bootstraps its service; a lease spans the handler and shutdown joins leases. Requested live operations still resolve credentials and retain confirmed/audited/idempotent provider behavior; missing credentials/offline requests never substitute fixture writes. Lazy first-use auth diagnostics now use nonblocking admission to avoid racing/shared resolver state or amplifying platform credential calls. The existing OS credential provider context contract for explicitly requested live tools is unchanged; observation never enters that path.
Qualification on the committed tree: full go test ./... -count=1, go vet ./..., git diff --check, product documentation contracts, checked-in Admin assets, Svelte check (0 errors/warnings), Vitest (9 passed), full race gate for observability/servicectl/adminhttp/mcp/cli/entrypoint, plus auth/MCP/entrypoint race gate after the lazy first-use correction all passed before commit. An exact-commit full Go rerun is in progress. Semantic Playwright: 61 passed; 1 explicitly skipped local visual-QA launch test requiring an opt-in launch URL/output directory. Browser artifact guard passed. No visual artifacts are published.
New offline regressions use actual TCP IPC for CLI/MCP parity, strict invalid wire envelopes before retained reads, pipelined JSON framing, cancellation/join of accepted sockets, and complete sampled 60-minute metrics above 64 KiB. Stdio and HTTP/SSE entrypoint fault matrices cover absent/damaged/old/future/cache-parent state, actual provider construction failure, zero observation-triggered credential/cache bootstrap, and later one confirmed POST on idempotent write replay.
Earlier local failures were new-fixture parity mistakes (comparing internal non-wire metric bookkeeping and omitting a collector), corrected without weakening product assertions. Independent implementation review has been requested; no implementation-clear verdict, head/main CI, PR merge, or issue completion is claimed. No tag, install, service restart, cache migration, or mirror-force action.
Exact-SHA gate follow-up
On pushed SHA 2e089a4c257167a831307d10ff4713eceeaf98d8, the post-commit go test ./... -count=1 completed successfully. The intended base remains 64b1e31d1a57402fd47f30c517a3326b241838fd; no tracked changes followed the commit.
Exact-head push CI is running: run 38129882760, attempt 1, .github/workflows/ci.yml. Independent implementation review is also running. Pending checks remain pending; neither is substituted by the earlier design clearance. No merge/completion is claimed.
Head CI observed; independent review still open
Exact-head push CI run 38129882760, attempt 1, required Go test job 114441825106 succeeded for 2e089a4c257167a831307d10ff4713eceeaf98d8. No failed steps were reported.
This does not clear the merge gate. Independent review has identified a candidate P2 in whole-filter compatibility: execution codes must retain their admitted stream while genuinely legacy lifecycle evidence can occur on either stream. The reviewer is still inspecting the immutable candidate and preparing the consolidated verdict. Corrections will produce a new SHA requiring local qualification, re-review, and exact-SHA CI. No PR merge or issue completion is claimed.
Independent implementation review of exact SHA 2e089a4c257167a831307d10ff4713eceeaf98d8 found four P2 issues, plus a public documentation path mismatch. Review is not clear and merge remains blocked.
- Execution-event stream compatibility admitted impossible combinations; preserve historical lifecycle evidence in either stream, but reject conflicting execution streams before reads/connects.
- Go JSON case-folding admitted non-schema keys and conflicting aliases. Require exact trusted JSON tags, including nested IPC envelopes/results and cursor payloads; preserve valid-key controls.
- Invalid observation envelopes could reflect a structured private request ID. Omit the unvalidated ID from fixed errors; keep valid scalar correlation for envelopes that passed validation.
- A queued fixed-period SSE tick could produce invalidation bursts after delayed publication. Measure the interval after actual append completion, not ticker schedule, and retain cancellation/join.
- Document the actual
/api/admin/v1/observabilityroutes.
Root-owned corrections and regression tests are in progress, not yet committed. Focused request/filter/IPC/MCP checks passed. The first timer-reset attempt failed the delayed-publication regression and was replaced with a one-shot timer created after publication; the current full-suite Admin package passed. Concurrent heavy author/reviewer suites exposed a timing failure in the unchanged repository-document cancellation test (2.645s); this is retained as failed evidence. Full Go will be rerun serially after race suites finish, without weakening that gate. The corrected exact SHA will need independent re-review and new CI; the green CI on the old SHA is insufficient. No release or local service mutation.
Corrected immutable candidate: 20aa51ef71c2024434f9a4afb4659dc9399b3120 on codex/issue-176-observation-transports, based on merged O2 64b1e31d1a57402fd47f30c517a3326b241838fd.
The four independently reproduced P2 defects and Admin route documentation mismatch are corrected with regression/valid-control coverage. The SSE correction creates its one-shot timer only after actual append completion; the earlier timer-reset attempt was rejected by its regression test, not accepted.
Final-tree evidence: go test -p 1 ./... -count=1 PASSED (repositorydocs12.146s, servicectl35.128s); all seven affected full race packages PASSED (servicectl106.707s); go vet ./..., ./scripts/check-product-docs.sh, git diff --check, and staged diff-check PASSED. The earlier overlapping-suite timing failure remains recorded in comment193200736; the standalone complete rerun passed without changing the cancellation test or its limit. Frontend source is unchanged; the original cohort's local asset/Svelte/unit/semantic-browser gates remain recorded, and exact corrected-head CI must rerun the required gates.
Requested independent re-review of this exact SHA, including the reviewer's retained previously failing probes and legitimate controls. A separate Luna watcher is observing corrected-head CI. Neither old review nor old CI substitutes for these gates. No PR merge, issue closure, release or local service change is claimed.
Exact corrected-head CI prerequisite is not yet satisfied. Read-only GitCode branch verification reports 20aa51ef71c2024434f9a4afb4659dc9399b3120; GitHub's same branch ref still reports the prior 2e089a4c257167a831307d10ff4713eceeaf98d8. The existing sanitized mirror reports finished/zero failures, but its last successful update predates the corrected push. A bounded read-only Luna watcher found no matching run for the corrected SHA.
This is missing mirror propagation, not a failed CI run and not green CI. Existing mirror configuration has force enabled. No mirror trigger, forced push or CI rerun was performed; owner direction was requested before one configured-mirror sync. Merge remains blocked until the corrected commit reaches GitHub and its required exact-SHA CI completes successfully. Independent correction re-review is still finishing valid controls; retained defect probes already passed three times. Original task input is unchanged.
Independent correction review: exact SHA 20aa51ef71c2024434f9a4afb4659dc9399b3120 is CODE CLEAR, with no remaining P0–P2 finding. Full base-to-head patch digest 248ce9e8d668cc142c761eb3a4f4e9db1f33186e54c1f1721a91b9d67e9c5fea was established in an immutable tracked-only archive; shared checkout and external systems were not mutated by the reviewer.
All four original P2 findings and the public Admin route typo are resolved. Retained independently authored defect probes passed three times, preserving legitimate execution/legacy streams, canonical keys, actual valid scalar-ID correlation, nested DTO array/map controls, and eventual second SSE publication no sooner than one second after the first. Focused seven-package race passed three times, including source bridge, bootstrap/write safeguards, silent-peer budget, shutdown and SSE cancellation. Reviewer vet, docs and immutable diff-check passed. One added reviewer control initially asserted literal id:null; that assertion was corrected to allow absent/null under the existing omitempty contract, without weakening fixed-error or valid scalar-ID controls.
This verdict clears code review, not merge/rollout. Exact corrected-head CI is unavailable because GitHub still has the old branch SHA (comment193201082). #177 Admin UI and #178 integrated rollout remain explicit dependencies. No main or release completion is claimed.
urandonO3 handoff verification: provider-exposed refs/merge-requests/169/head is exactly 20aa51ef71c2024434f9a4afb4659dc9399b3120, matching the reviewed branch. Intended base main remains 64b1e31d1a57402fd47f30c517a3326b241838fd. PR !169 is open, its canonical live description was refreshed, and a fresh bounded PR-comment sync reports no unresolved/unknown-resolution discussions. Worktree is clean and pushed.
The independent reviewer has now returned the final exact-SHA CLEAR/no P0–P2 verdict; evidence matches comment193201098. The sole merge prerequisite still missing is corrected-head GitHub CI: fresh GET shows GitHub branch still 2e089a4c257167a831307d10ff4713eceeaf98d8 and zero matching runs for 20aa51ef.... Do not substitute old CI or this handoff for green checks.
Next safe action requires owner authorization for one synchronization of the existing force-enabled mirror, or owner-provided synchronization. After propagation: observe exact-head CI; merge only if green/base/thread/head guards still match; observe resulting-main CI; then post final evidence and close #176/update #173 before starting #177. No merge, release, installed-service change or cache migration performed.
Owner authorized synchronizing the existing configured mirror, including its existing force setting. Scope: one audited trigger of mirror3349 for repository urandon/gitcode-mcp, without changing mirror configuration or destinations. Reviewed candidate remains 20aa51ef71c2024434f9a4afb4659dc9399b3120; merge is still gated on exact-head CI and subsequent main CI.
Preflight: exactly one configured mirror, status finished/zero failures and no active synchronization, last successful update predating corrected push. Use durable idempotency key issue176-mirror3349-20aa51e-r1, followed by sanitized readback and independent GitHub branch/run verification. No arbitrary destination URL, browser credential or direct forced Git push is accepted or used. No release or installed-service change.
Authorized existing-mirror sync completed. One audited trigger with key issue176-mirror3349-20aa51e-r1 was provider-confirmed; fresh sanitized terminal readback is finished/zero failures, successful update2026-10-11T10:30:17.014Z after the trigger barrier. No configuration change or direct Git force push.
Exact corrected-head GitHub CI is now visible: run38132179053 attempt1, push on codex/issue-176-observation-transports, workflow .github/workflows/ci.yml, head 20aa51ef71c2024434f9a4afb4659dc9399b3120. https://github.com/urandon/gitcode-mcp/actions/runs/38132179053 . The Luna watcher is observing required job/steps to terminal; currently in progress, not green or merge-complete. Code review remains CLEAR; PR !169 awaits exact-head CI and refreshed merge guards.
Exact-head merge gates satisfied for 20aa51ef71c2024434f9a4afb4659dc9399b3120: independent code review CLEAR/no P0–P2 (comment193201098 and final reviewer verdict); CI run38132179053 attempt1 is completed/success on the exact branch/push/workflow. Required Go test job114448600845 and every step are success, including docs/assets/Svelte/unit/semantic browser/artifact guard/Go/release fixtures/whitespace. Root independently re-read run metadata and steps.
PR !169 canonical read preflight confirms open, head branch/SHA exactly as reviewed, target main and base 64b1e31d1a57402fd47f30c517a3326b241838fd. Provider MR head ref matches; fresh review discussion sync has no unresolved/unknown thread. A metadata-only existing-adapter read was used because MCP/CLI expose no canonical head/base inspection and the UI helper was unavailable; only matching allowlisted guards were printed, temporary diagnostic source removed. Merge dry-run passed but is not represented as CI or provider preimage proof.
Intent: audited CLI merge fallback (no MCP merge tool available), strategy merge, expected head SHA, durable key issue176-merge169-20aa51e-r1. No release or installed-service change. Resulting-main CI remains required before final #176 closure and #173 completion update; #177/#178 remain next.
PR !169 was merged through the audited expected-head CLI lifecycle: provider-confirmed merge revision eec0ab08799ae6c4b4ddf1800c754080a578e1bf, independently verified as current GitCode main. Reviewed head remains 20aa51ef71c2024434f9a4afb4659dc9399b3120; head CI and review evidence are in comment193202085.
Resulting-main CI is not yet available: GitHub main still has the previous 64b1e31d1a57402fd47f30c517a3326b241838fd. Under the owner's authorization to perform the required existing-mirror synchronizations for this workflow, intent is one audited sync of unchanged mirror3349 for merged main, key issue176-mirror3349-main-eec0ab0-r1. Preflight: exactly one mirror, finished/zero failures, no active sync, last successful update predates merge. No mirror-setting change, arbitrary destination or direct Git force push.
Wait for fresh sanitized readback and observe required exact main SHA CI to terminal before closure/O3 epic completion. No release or installed-service change.
Merged-main propagation is confirmed by fresh terminal mirror readback: finished/zero failures, successful update2026-10-11T10:37:59.785Z after the authorized trigger. Required CI run38132642538 attempt1 is in progress for exact merged eec0ab08799ae6c4b4ddf1800c754080a578e1bf, main/push .github/workflows/ci.yml: https://github.com/urandon/gitcode-mcp/actions/runs/38132642538 . Luna is watching to terminal.
Fetched merge parents are exactly intended base64b1e31 and reviewed head20aa51e; tree diff from reviewed head to merge commit is empty and diff-check passed. Fresh canonical PR sync reports merged. #176 remains open until resulting-main CI is green and final evidence is posted; O3 is not yet marked complete in #173.
Bounded dogfood note during merged-main qualification: one add_pr_comment attempt on merged !169 was rejected with provider validation HTTP405/Method Not Allowed. The call did not report success, no raw body/credentials were retained, and there was no blind retry or alternative write endpoint. The attempted status correction is already fully recorded in this issue's comments193202085/193202108/193202150, so no evidence is lost and this non-required PR comment is not a substitute for any merge/CI gate.
This observed adapter limitation is not silently treated as fixed or passed. Preserve it as input for O5/#178 dogfood/disposition alongside existing tracked follow-ups; no unrelated fix is added to completed O3 code. Required resulting-main CI is still in progress, so #176 remains open.
O3 final acceptance and safepoint
PR !169 is merged: https://gitcode.com/urandon/gitcode-mcp/pull/169 . Reviewed head 20aa51ef71c2024434f9a4afb4659dc9399b3120; merge/current main eec0ab08799ae6c4b4ddf1800c754080a578e1bf, parents intended base64b1e31 and reviewed head20aa51e. Merge tree is identical to the reviewed tree.
Exact head CI38132179053 attempt1/job114448600845 PASSED: https://github.com/urandon/gitcode-mcp/actions/runs/38132179053 . Exact resulting-main CI38132642538 attempt1/job114449965480 PASSED: https://github.com/urandon/gitcode-mcp/actions/runs/38132642538 . Root independently re-read run SHA/branch/push/workflow/attempt and all required steps, including docs/assets/Svelte/unit/semantic browser/artifact guard/Go/release fixtures/whitespace. No screenshot/video/trace CI artifact; opt-in local visual test is intentionally skipped, not falsely passed. Fresh MR discussions have no unresolved/unknown thread.
Owner-authorized existing-mirror synchronizations were audited/idempotency-gated and fresh terminal readback confirmed both pushes; no mirror configuration change or direct forced Git push. No release, install, installed-daemon change or cache migration.
O3 transport issue is complete. The feature/epic is NOT complete: O4/#177 Admin UI and O5/#178 integrated qualification remain required. Preserve #187/#188 disposition and observed merged-PR comment405 (comment193202215) as O5 input, not silently resolved. Update #173 before state-only closure; original issue title/body remain fixed.
Parent and fixed design
Parent #173; original feature input #101. Reviewed design comments193140025/193140595; completion clarification193140886.
Dependencies: O1,O2. Actual dependency issue numbers will be recorded in comments when the full set exists.
Scope
Shared summary/metrics/events service DTOs and observability.v1 IPC negotiation; authenticated Admin GET /observability, /observability/metrics, /observability/events, coalesced SSE invalidation only. CLI service observe/metrics/events and read-only MCP service_observability/service_metrics/service_events use the same selectors and errors.
Acceptance checklist
Non-goals / UX
No remote telemetry, arbitrary file/URL viewing, hidden setup/repair, source-body capture or execution-authority replacement. This is one child of a complete Admin/CLI/MCP cohort; UI dependency remains on O4 and rollout on O5. Backend slices stay capability-gated.
Delivery
One issue branch/PR from fresh intended main. Add deterministic regression/fault tests, relevant race tests, full go test ./..., docs/diff checks and applicable Admin gates. Independent exact-SHA review, all P0–P2 resolved, green required head and resulting-main CI before closure. Original input fixed; progress/corrections/evidence in comments; update #173 before considering complete.