diff --git a/docs/change/change_log.md b/docs/change/change_log.md index 9287fe3..4e45bfa 100644 --- a/docs/change/change_log.md +++ b/docs/change/change_log.md @@ -5,7 +5,9 @@ This file provides a chronological, human-readable record of applied codebase an *Note: For operational task and run history, consult `.triagecore/ledger.jsonl`.* ## [Unreleased] +- Implemented CR-120 (Telemetry Lane Release Hygiene): Added a docs-only post-merge hygiene note for the completed CR-117 through CR-119 lane, marked the reviewer checkpoint/release-hygiene candidate complete, and corrected stale telemetry brief wording that could confuse the CR-114 reviewer checkpoint with the CR-119 probe validation gate. No runtime code, schemas, tests, CLI behavior, routing, ledger writes, probe execution, endpoint calls, tags, or model/backend calls were changed. - Implemented CR-119 (Local Backend Telemetry Probe Validation Gate): Added a fail-closed emission gate for local backend telemetry probe results so every `LocalBackendProbeRecord` round-trips through the CR-118 `local_backend_probe_record.v1` validator before the probe returns, renders, or writes it as an observation. The gate applies to both reachable records and fail-closed probe observations, and contract-validation failure raises `ProbeInputError` instead of producing a successful probe result. No new backend types, probe endpoints, model calls, routing integration, circuit breakers, degraded modes, ledger writes, or CLI behavior were added. +- Implemented CR-118 (Local Backend Telemetry Record Schema): Added the strict `local_backend_probe_record.v1` schema and pure mapping validator for the existing local backend probe record contract, with synthetic-fixture tests covering unknown-field rejection, privacy invariant enforcement, deterministic fixture rules, closed `source_type` values, the normalized `unsupported` sentinel, and `unsupported_backend` coupling. No probe execution, endpoint calls, routing integration, ledger writes, model calls, backend calls, or CLI behavior were added. - Implemented CR-117 (Task-Show Opt-In Signature Verification): Added an opt-in `tc task show --verify-signatures` path that verifies the signed ledger events (`route_audit`, `validation_result`, `route_decision`) belonging to the shown task via a new task-scoped `verify_task_event_signatures` helper, reusing the CR-097 fail-closed identity-registry-load categories. Fail-closed: invalid or malformed signatures — and identity-registry load failures — exit 1; unsigned signed-type events remain informational and exit 0; there is no `--strict` in this slice. Flag-off output is byte-for-byte unchanged, and the whole-ledger `tc audit --verify-signatures` behavior is untouched. Telemetry lane references shift to CR-118+ (schema candidate CR-118, probe candidate CR-119+) in active planning and handoff docs. Read-only and evidence-only: no changes to approval, signing, routing, or execution semantics, and no new egress, backends, or ledger writes. - Implemented CR-115 (Final Control-Plane Extraction Package): Added four docs-only doctrine/handoff documents — a control-plane invariant checklist mapping each invariant to its enforcement locus and reviewer verification command, a repeatable outer-loop control review recipe with risk classification and stop conditions, a final capability note recording that the assistant model's role was drafting/review/evidence collection under plan-gated human control with no runtime dependency on any model, and a future agent/maintainer handoff entry point with ordered next slices and binding conventions. Telemetry lane references renumbered from CR-115+ to CR-116+. All documents preserve the distinction that signatures, manifests, evaluator verdicts, and model recommendations are evidence, not approval. No runtime code, tests, tags, or approval/signature/identity/routing/privacy/audit semantics were changed. - Implemented CR-114 (Reviewer Checkpoint 2026-07-07 and Tag Reconciliation): Added a docs-only dated reviewer checkpoint consolidating the CR-100 through CR-113 arc at HEAD `f8bf33c` — fresh local validation evidence (803 passed / 2 skipped full regression, privacy invariant pass over 698 ledger records, route_decision signature verification, identity listing, backend-free benchmark fixture listing, doctor runtime-safety postures) — and recorded the finding that the `v0.1.0-reviewer-checkpoint-2026-07-02` tag recommended by the previous checkpoint was never created, with the `355c521` anchor preserved in-document and exact operator-run tag commands recommended but deliberately not executed. No runtime code, tests, tags, or approval/signature/identity/routing/privacy/audit semantics were changed. diff --git a/docs/change/requests/CR-120-telemetry-lane-release-hygiene.md b/docs/change/requests/CR-120-telemetry-lane-release-hygiene.md new file mode 100644 index 0000000..d6f8431 --- /dev/null +++ b/docs/change/requests/CR-120-telemetry-lane-release-hygiene.md @@ -0,0 +1,44 @@ +# CR-120: Telemetry Lane Release Hygiene + +## Status + +Implemented (docs-only) + +## Summary + +Record the post-merge state of the completed CR-117 through CR-119 telemetry +and reviewer-readiness lane, and correct stale CR numbering in the telemetry +brief so reviewers do not confuse the CR-114 checkpoint with the probe +validation work. + +This slice is release hygiene only. It adds no runtime behavior, no probe +execution, no schema changes, no routing integration, no ledger writes, and no +new model/backend calls. + +## Scope + +- Add a concise telemetry lane release-hygiene note under operations docs. +- Update the active backlog so the reviewer checkpoint/release-hygiene + candidate is marked done as CR-120. +- Correct `docs/operations/local-backend-telemetry.md` status language so the + implemented anchors are CR-118 for the record contract and CR-119 for the + probe emission validation gate. +- Update the future-agent handoff with a post-handoff note that CR-117, + CR-118, CR-119, and CR-120 are complete. +- Add a changelog entry for the docs-only hygiene slice. + +## Non-Goals + +- No probe execution changes. +- No new telemetry schema fields or validator behavior. +- No routing, route-input, circuit-breaker, degraded-mode, or daily-driver + integration. +- No CLI behavior changes. +- No ledger writes or new persisted evidence records. +- No full release certification or tag creation. + +## Validation + +- `git diff --check` + +Docs-only validation is sufficient because this slice edits documentation only. diff --git a/docs/current_backlog.md b/docs/current_backlog.md index 70df523..acb3e2a 100644 --- a/docs/current_backlog.md +++ b/docs/current_backlog.md @@ -6,6 +6,10 @@ This document summarizes the active TriageCore backlog after CR-115. ## Active GitHub Backlog +- CR-120: Telemetry Lane Release Hygiene + - Status: complete via CR-120 (docs-only) + - Purpose: Freeze the completed CR-117 through CR-119 reviewer/telemetry lane after PR #91, #92, and #93 merged; add a concise operations note with the commit/validation anchors; correct stale CR-114 probe wording in the telemetry brief; and mark the reviewer checkpoint/release-hygiene candidate complete without adding probe execution, routing integration, schemas, ledger writes, CLI behavior, tags, or model/backend calls. + - CR-115: Final Control-Plane Extraction Package - Status: complete via CR-115 (docs-only); no tag — CR-114 carried the checkpoint tags, CR-115 is doctrine/handoff material committed normally - Purpose: Bank the exit-window doctrine as four operations docs — control-plane invariant checklist (invariant → enforcement locus → reviewer verification command), outer-loop control review recipe (repeatable external review process with risk classes and stop conditions), Fable final capability note (model role was drafting/review/evidence collection under plan-gated human control; no runtime dependency on any model), and future agent/maintainer handoff (cold-start entry point, ordered next slices, binding conventions). Signatures, manifests, evaluator verdicts, and model recommendations remain evidence, not approval. Telemetry lane renumbered to CR-118+ after CR-117 claimed the task-show signature-verification slice. @@ -211,4 +215,5 @@ For operator UX, future slices should focus on reviewability, export polish, and - **[done] Signature verification on task show (CR-117, runtime-safe)**: Opt-in `tc task show --verify-signatures` verifies the shown task's signed ledger events via a task-scoped helper that reuses the CR-097 fail-closed categories; fail-closed (exits 1) on invalid or malformed signatures and registry-load failure, while unsigned signed-type events stay informational (exit 0). Whole-ledger `tc audit --verify-signatures` behavior is unchanged ([task-show-signature-verification.md](operations/task-show-signature-verification.md)). - **[done] Telemetry schema and synthetic-fixture validation (CR-118)**: Hardened the existing local backend probe's serialized record contract before any further probe work — strict schema, pure validator, synthetic fixtures only, no endpoint calls, no routing integration, no ledger writes, and no CLI behavior changes. - **[done] Local backend telemetry probe validation gate (CR-119)**: Every emitted local backend probe result now validates against the CR-118 record contract before it is treated as an observation; validation failure raises a fail-closed `ProbeInputError`, with no generation calls, routing integration, or ledger writes. -- **Reviewer checkpoint or release-hygiene slice**: Freeze the completed route-worker reviewer lane into a concise checkpoint, packaging note, or release-hygiene update instead of adding more telemetry features. +- **[done] Reviewer checkpoint or release-hygiene slice (CR-120, docs-only)**: Froze the completed CR-117 through CR-119 lane in a concise operations note, corrected stale CR-114 telemetry wording, and kept future telemetry work behind a new explicit scope pass instead of adding more features. +- **Next slice TBD by scope pass**: Do not start routing integration, ledger integration, circuit breakers, automatic discovery, background polling, daily-driver enforcement, or additional telemetry behavior without a new approved CR. diff --git a/docs/operations/future-agent-maintainer-handoff-2026-07-07.md b/docs/operations/future-agent-maintainer-handoff-2026-07-07.md index dabc8fd..e4d80d1 100644 --- a/docs/operations/future-agent-maintainer-handoff-2026-07-07.md +++ b/docs/operations/future-agent-maintainer-handoff-2026-07-07.md @@ -1,5 +1,10 @@ # Future Agent / Maintainer Handoff — 2026-07-07 +> **Post-handoff note (2026-07-10):** CR-117, CR-118, and CR-119 have merged. +> CR-120 is a docs-only release-hygiene slice that freezes that lane, corrects +> stale CR-114 telemetry wording, and does not add runtime behavior. See +> [telemetry-lane-release-hygiene-2026-07-10.md](telemetry-lane-release-hygiene-2026-07-10.md). + ## Purpose The single entry point for whoever continues TriageCore work — a human @@ -17,9 +22,9 @@ linked from here. under `74260b3`); CI green on Python 3.10/3.11/3.12 at `88c9cfb`. - **CR ledger:** CR-100 → CR-115 complete. **CR-114 = the evidence checkpoint. CR-115 = this extraction package. CR-117 = the task-show - signature-verification slice. CR-118+ = the telemetry lane** (the - numbering marks the boundary between deterministic evidence - work and the lane's first non-deterministic slice). + signature-verification slice. CR-118 = telemetry schema. CR-119 = + telemetry probe validation gate. CR-120 = telemetry lane release hygiene.** + Future telemetry behavior still requires a new explicit CR. ## Reading Order @@ -27,16 +32,18 @@ linked from here. 2. [control-plane-invariant-checklist.md](control-plane-invariant-checklist.md) — what must never break 3. [fable-exit-audit-2026-07-07.md](fable-exit-audit-2026-07-07.md) — ranked evidence, gaps, and slice plan 4. [../current_backlog.md](../current_backlog.md) — work lanes -5. [local-backend-telemetry.md](local-backend-telemetry.md) — the CR-118+ boundary brief -6. [fable-final-capability-note-2026-07-07.md](fable-final-capability-note-2026-07-07.md) — how to weigh model-authored artifacts +5. [local-backend-telemetry.md](local-backend-telemetry.md) — the CR-118/CR-119 telemetry brief +6. [telemetry-lane-release-hygiene-2026-07-10.md](telemetry-lane-release-hygiene-2026-07-10.md) — post-merge CR-117 through CR-120 hygiene +7. [fable-final-capability-note-2026-07-07.md](fable-final-capability-note-2026-07-07.md) — how to weigh model-authored artifacts ## Next Slices, In Order | Order | Slice | Risk class | |---|---|---| | 1 | ~~`tc task show --verify-signatures` opt-in, reusing CR-097 fail-closed categories~~ — done (CR-117, runtime-safe): [task-show-signature-verification.md](task-show-signature-verification.md) | runtime-safe | -| 2 | Telemetry schema + `synthetic_fixture` validation only — no probe code (CR-118 candidate) | test-only | -| 3 | Telemetry probe, exactly within the CR-113 brief: opt-in, explicit endpoint, `probe_disabled` default, closed failure vocabulary (CR-119+ candidate) | runtime-risky | +| 2 | ~~Telemetry schema + `synthetic_fixture` validation only — no probe code~~ — done (CR-118): strict record contract and pure validator | test-only | +| 3 | ~~Telemetry probe, exactly within the CR-113 brief: opt-in, explicit endpoint, `probe_disabled` default, closed failure vocabulary~~ — done (CR-119): emitted probe records validate against the CR-118 contract before success | runtime-risky | +| 4 | ~~Reviewer checkpoint or release-hygiene slice~~ — done (CR-120): post-merge docs-only hygiene and stale-numbering correction | docs-only | Deferred deliberately (do not start without a dedicated approved CR): Issue #73 key rotation; signed-event expansion to new event types; @@ -55,7 +62,7 @@ capture; any new execution surface. - **Claim CR numbers at commit time**, not draft time (parallel sessions have collided before). - **Boundary crossings get a docs-only brief first** (the CR-113 → - CR-118+ pattern), then a schema/fixture slice, then implementation. + CR-118/CR-119 pattern), then a schema/fixture slice, then implementation. - **Docs-only validation:** `git diff --check`. Code-bearing validation: `python -m pytest -q`. diff --git a/docs/operations/local-backend-telemetry.md b/docs/operations/local-backend-telemetry.md index 4b274b5..6d8c9ba 100644 --- a/docs/operations/local-backend-telemetry.md +++ b/docs/operations/local-backend-telemetry.md @@ -16,8 +16,8 @@ and privacy rules agreed before any probe code is written. ## Status -Partially implemented. **CR-114 implements the read-only metadata probe slice** -only: the `triage_core/local_backend_probe.py` module and the `tc probe` command +Partially implemented. The current read-only metadata probe surface is the +`triage_core/local_backend_probe.py` module and the `tc probe` command. They produce metadata-only records against the endpoints below, with the closed failure vocabulary, tiered evidence, and `base_url` redaction described here. **CR-118 pins the serialized record contract** with @@ -26,12 +26,17 @@ validator for synthetic fixtures and recorded metadata. **CR-119 gates probe emission through that contract**: every probe result is validated against the CR-118 mapper before the probe returns, renders, or writes it as an observation. +**CR-120 records the post-merge release hygiene** for this lane and corrects +stale numbering: CR-114 is the July 7 reviewer checkpoint, not the probe +validation anchor. Routing wiring, route-input population (`ResilienceRouteInput`), circuit breakers, degraded modes, and any daily-driver enforcement **remain future -work** and are out of scope for CR-114. This document still describes the full -telemetry design; only the read-only probe slice is built. Nothing here should -be read as implying the whole telemetry design is implemented. +work** and are out of scope for the implemented telemetry contract and +probe-validation work. This document still describes the full telemetry +design; only the read-only probe and validation-contract slices are built. +Nothing here should be read as implying the whole telemetry design is +implemented. ## Supported Future Sources @@ -52,7 +57,7 @@ side effect of any other command. ## Non-Goals -The future telemetry slice, and this brief, exclude: +The implemented telemetry lane, and this brief, exclude: - no live benchmark execution - no model generation calls (no completions, chat, or embedding requests) @@ -158,7 +163,8 @@ reviewable. ## Non-Claims -- This document adds no runtime behavior, CLI surface, schema, or fixture. +- This brief is not a routing, ledger, or enforcement switch; docs-only hygiene + updates to it add no runtime behavior, CLI surface, schema, or fixture. - A future telemetry record proves only that a metadata endpoint answered at one moment; it is not a benchmark, an availability guarantee, a quality claim, or a safety claim. diff --git a/docs/operations/telemetry-lane-release-hygiene-2026-07-10.md b/docs/operations/telemetry-lane-release-hygiene-2026-07-10.md new file mode 100644 index 0000000..950d5e3 --- /dev/null +++ b/docs/operations/telemetry-lane-release-hygiene-2026-07-10.md @@ -0,0 +1,66 @@ +# Telemetry Lane Release Hygiene - 2026-07-10 + +## Purpose + +This note freezes the reviewer-facing state after the CR-117 through CR-119 +sequence merged. It exists to make the completed lane easy to review without +opening another telemetry feature slice. + +This is not a release certification, safety certification, or production +readiness claim. It is a docs-only hygiene record tying together already +merged work and correcting stale CR numbering. + +## Baseline + +- **Base:** `origin/main` at `24894c3` (Merge PR #93) +- **CR-117:** `575ba79` (PR #91) - task-show opt-in signature verification +- **CR-118:** `909148d` (PR #92) - local backend telemetry record schema +- **CR-119:** `0aa257a` (PR #93) - probe emission validation gate + +## Completed Slice Boundaries + +- **CR-117:** Added `tc task show --verify-signatures` as an opt-in, + task-scoped verification path. Whole-ledger audit behavior was unchanged. +- **CR-118:** Pinned the local backend probe serialized record contract with a + strict schema, pure validator, synthetic-fixture coverage, closed + `source_type`, and the normalized `unsupported` sentinel. +- **CR-119:** Required every emitted local backend probe result to validate + against the CR-118 record contract before the probe returns, renders, or + writes it as an observation. + +## Verification Evidence Already Recorded + +- **CR-117 focused:** 65 passed +- **CR-117 full Windows suite:** 900 passed, 2 skipped +- **CR-118 focused:** 31 passed +- **CR-118 full Windows suite:** 906 passed, 2 skipped +- **CR-119 focused:** 34 passed +- **CR-119 full Windows suite:** 916 passed, 2 skipped + +CR-120 adds documentation only. Its validation requirement is `git diff +--check`; it does not re-run probes, contact endpoints, invoke models, or +exercise routing. + +## Corrected CR Numbering + +CR-114 is the July 7 reviewer checkpoint and tag reconciliation slice. It is +not the telemetry probe implementation anchor. Current telemetry anchors are: + +- CR-113: telemetry design brief +- CR-118: record contract and pure validation +- CR-119: emitted-record validation gate for the existing probe surface +- CR-120: this docs-only release-hygiene record + +Any future telemetry work needs a new CR and a fresh scope pass. Deferred work +still includes routing wiring, route-input population, circuit breakers, +degraded modes, automatic discovery, background polling, ledger writes, and any +daily-driver enforcement. + +## Related Docs + +- [local-backend-telemetry.md](local-backend-telemetry.md) +- [future-agent-maintainer-handoff-2026-07-07.md](future-agent-maintainer-handoff-2026-07-07.md) +- [reviewer-checkpoint-2026-07-07.md](reviewer-checkpoint-2026-07-07.md) +- [../change/requests/CR-117-task-show-verify-signatures.md](../change/requests/CR-117-task-show-verify-signatures.md) +- [../change/requests/CR-118-local-backend-telemetry-schema.md](../change/requests/CR-118-local-backend-telemetry-schema.md) +- [../change/requests/CR-119-local-backend-telemetry-probe-validation.md](../change/requests/CR-119-local-backend-telemetry-probe-validation.md)