Token report: quiet-window-safe refresh timer templates; Loki query_source and effort-split panels

[seathatflowsinourveins]

Scope

• What this changes:
  • A05: drafts systemd user templates for a scheduled, quiet-window-safe token_manifest.py refresh. These are templates only; nothing is installed.
  • A07: adds Loki api_request panels split by query_source, and a Prometheus panel split by effort, to the native-data dashboard render.
• Base commit: 5d8bd611.
• Lane: lane:foundation.
• Owned paths touched:
  • adoption/templates/systemd/token-report-refresh.{service,timer}
  • observability/native-data/render.py
  • tests/test_native_dashboard_data.py
  • tests/test_token_report_refresh_units.py
  • tools/token-report/README.md
  • manifests/evidence.json

SOTA sources

• This repository:
  • adoption/templates/systemd/codex-broker-reaper.{service,timer} and observability/native-data/native-data.{service,timer}.example: the oneshot, timer and template convention followed here.
  • observability/collector/collector.yaml:87,104: query_source and effort are kept as datapoint attributes.
• systemd 255 manuals (systemd.exec Environment= specifier expansion, systemd.timer Persistent=, systemd.unit specifiers), checked with systemd-analyze calendar and --user verify.
• Headroom 0.37.0 source: update_check.py:57-70 (HEADROOM_UPDATE_CHECK / HEADROOM_OFFLINE) and telemetry/beacon.py:11,84 (DO_NOT_TRACK).
• Anthropic Claude Code monitoring docs: the api_request event attributes. Grafana Loki metric-query docs: unwrapped range aggregations.

Evidence-class table

Claim	Class
The timer never fires inside the Sat/Sun 05:00-09:00 local quiet windows, and ExecCondition skips a manual start in them	local_integration: systemd-analyze calendar iterations and unit tests
The dashboard renders the new panels with unique ids and no grid overlap	local_integration: render.py and tests/test_native_dashboard_data.py
The installed timer runs refresh on this host	Not established. Installation is a post-merge coordinator step.

Review. An independent Opus evidence-reviewer ran three rounds and found:

• round 1: 12 findings;
• round 2: 6 findings;
• round 3: only coordinator-owned items remained, the manifests/evidence.json hash re-registration and the live installation.

The hashes are re-registered in this commit.

Checks at the pushed head:

• validate.py and evidence_manifest --check: passed.
• tests.test_native_dashboard_data and tests.test_token_report_refresh_units: OK.
• Full python3 -m unittest before the final rebase: 5796 OK.
• Guarded gitleaks: no leaks.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.