[Task][RFC]: Qualify observer-first reliability diagnostics and governed delivery

[huangruiteng]

Outcome / 目标

验收先观测后治理的长程可靠性诊断。One task tracks this RFC's delivery; keep implementation PRs and milestone evidence here instead of creating a parallel task tree.

Canonical design: RFC. Roadmap: S10/S11/S13, under #4574. Design acceptance is distinct from implementation, live qualification and promotion.

Current boundary

Source audit: main at ce3862e33 (2026-09-28). This is source/PR inspection, not a new test or live-qualification claim.

The default-off reliability-diagnostics prototype and dsh-session-events adapter ship. The capability README explicitly withholds P0 exit pending C0/C1 and measured overhead; the RFC also requires retention/deletion policy.

Work remaining

• Close P0’s integrity, non-interference, retention and real-observer evidence, then assess the P1 diagnostic pilot against a declared outcome.
• Progress to a governed seam or repeatable deployment only through the RFC’s own evidence and authority gates; retain an explicit stop/no-uplift option.

Ownership and ongoing work

Coordinate with the DSH/Pi evidence tracker and #3243 to run each experiment once. Public/synthetic adapter work is available; live cases, provider promotion and external deployment need their existing scoped authorization.

Contribution route: available for a bounded proposal/PR within this RFC. Name the intended milestone and exact files in a claim comment so simultaneous contributors do not duplicate work.

Acceptance

• Observer schema and actual wiring expose no control route; failures invalidate/quarantine evidence instead of changing worker behavior.
• Report event loss, timing uncertainty, CPU/RSS/bytes/latency and baseline comparison with full denominators.
• Installed readback plus export/retention/deletion recovery is reproducible; no prototype test count is called production qualification.
• Reconcile the RFC's current delivery checkpoint and this issue with the integrated revision, commands, passed/failed/untested evidence and remaining gates. Close the accepted scope only; no claim that a merged PR alone completes the RFC.

Starting points and delivery boundary

• loopx/capabilities/reliability_diagnostics/README.md
• loopx/capabilities/reliability_diagnostics
• packages/dsh-loopx-plugin

Base: latest main. Reuse the existing typed owner and provider boundaries. Include affected CLI/frontend/Lark companions; verify real entrypoints and backend where changed. Preserve existing first-screen review and maintainer merge gates. Public artifacts contain only synthetic/public-safe evidence, no private operational state. This task does not authorize provider promotion, benchmark launches, release/deployment or unrelated protected effects.

[LIHUA919]

Claiming a bounded P0 operations proposal: a bilingual local/offline ledger retention, byte-preserving export/delete/restore runbook and a synthetic CLI lifecycle smoke.

Intended files: loopx/capabilities/reliability_diagnostics/docs/local-retention-v0.md, capability README.md/README.zh-CN.md, examples/reliability_diagnostics/ledger-retention-smoke.py, and the English/Chinese owning RFC P0 checkpoint.

This uses the existing diagnostic ledger and CLI contracts; no new retention scheduler, provider promotion, benchmark launch or live-case run. Validation covers export identity/readback, deletion followed by invalid missing-ledger evidence, and exact restoration of degraded/invalid evidence in a disposable runtime, including an installed-package entrypoint. C0/C1, measured observer overhead, owner-selected live/BYOC policy and P1 pilot remain open. This slice does not claim P0 exit.

[LIHUA919]

P0 operations-preparation proposal: #5247, head 694ee014d677f833c8f4ee39ca9b6bdb9de35788, based on main at 6643f367064b9921c864db75a042979fddc4b8c3.

Delivered in the proposal: bilingual manual/offline retention and whole-byte export/delete/restore reference; private-export and frozen-writer boundary; finite owner-selected retention deadline and all-copy deletion accounting; synthetic CLI lifecycle regression; English/Chinese P0 checkpoint links. No new runtime command, scheduler, opt-in or authority owner. Awaiting independent review and maintainer integration.

Passed:

• uv run --extra test python -m pytest tests/capabilities/test_reliability_diagnostics.py tests/capabilities/test_reliability_diagnostics_dsh_provider.py -q: 94 passed.
• Existing DSH fixture smoke and new examples/reliability_diagnostics/ledger-retention-smoke.py in the checkout: passed.
• The new smoke with --installed in a disposable non-editable wheel environment: passed; guide present in the wheel.
• Documented POSIX commands: passed on synthetic degraded/invalid ledgers; also passed through the wheel-installed console entrypoint. Receipt/projection are compared semantically; ledger bytes/hash match exactly. Missing source remains invalid, with no_observations; restore refuses an existing destination.
• Ruff, docs-governance, diff checks and six-file public-boundary scan: passed.
• Required Chat bundle build and wheel build: passed after preparing the frontend assets; existing Vite chunk-size warning remains, frontend sources unchanged.

Open/untested: live DSH observer detachment/flush and C0/C1, CPU/RSS/bytes/latency measurements with matched denominators, deployment-owner acceptance of the retention/deletion profile, automatic TTL, secure erasure, filename/tenant isolation and the P1 pilot. The reference documents current filename aliases (: to _, filesystem case folding) and holds deletion on ambiguous ownership; it does not repair or qualify that isolation boundary. No live case, benchmark, provider promotion, release or deployment was run.

The RFC checkpoint changes are proposed in #5247; this issue and the P0 milestone remain open. Next acceptance owner: maintainer review/integration, then the existing DSH/Pi and #3243 evidence lane for separately authorized live qualification. No duplicate experiment or parallel task tree was created.

[LIHUA919]

Exact-head CI readback for #5247: 422b30005b48aa723f3ca240cd16fb081000f5f0.

The inherited census-line mismatch is corrected (1014 → 1027), preserving all 250 sites, classifications and source-policy fields. The local architecture modules pass (9 tests). The new Python Tests run completed successfully: all four pytest shards, the aggregate pytest/coverage gate, kernel/Dashboard checks, TypeScript core/coverage, Stage 2C, Windows and merge-gate passed. DCO, dependency review, release-artifact build and Frontstage build also completed successfully on the same head.

Skipped lanes remain skips: forward-compatibility/presentation selection, publication/deployment steps, and actual Sonar analysis when its token is unavailable. A GitHub API EOF interrupted the CLI waiter; the final conclusions above were independently read back through the GitHub connector.

This resolves the two failing CI shards. Independent maintainer review/integration remains required. The original #5211 acceptance and P0 milestone remain open: actual observer wiring/C0, eligible live C1, measured observer overhead and deployment-owner retention/deletion acceptance are not established by this CI result.

The existing next qualification Todo now names the concrete public-safe gap: use real Cordis and native DSH synthetic session/event publication instead of the current fake Context/Session registration test. No model, benchmark, provider promotion, release or deployment was launched.

[LIHUA919]

Current proposal head: f3ab983ef0b3c283f6043bc138c789f3afe812d8, base main at cf759d323b755e2040200f976eac1eeb89383b4d.

After exact-head CI passed at 422b30005, main advanced. The branch merged that main revision with DCO sign-off, preserving all existing commits. Its registry call moved again; the manifest now records the actual line 1063. All 258 sites, classifications and source-policy fields are preserved.

On the refreshed source: 103 tests passed across both architecture modules and the reliability/provider suites; the recovery and docs-governance smokes passed. The PR diff remains seven scoped files. Current-head CI has started and is pending; the prior head's green result is not current-head qualification. Independent maintainer review/integration is also pending.

The original #5211/P0 acceptance stays open. The existing qualification Todo identifies real Cordis/native DSH synthetic publication as the next public-safe validation, followed by separately authorized eligible live C1, overhead and deployment-policy evidence. No model or benchmark was launched.