feat: combine native Lanes collector and dashboard monitoring

[seathatflowsinourveins]

Scope

Provision the NativeStack2604 Lanes dashboard and retain the native dimensions needed to distinguish tool, hook, skill, service and token activity. Monitoring steps 6–8 include the collector route, supported file provisioning and matching install-plan acceptance. A13 makes main's rendered Prometheus unit the sole startup carrier; the old drop-in is a dated, inert, do-not-apply record. Activation and start-timestamp/new-turn qualification remain the command center's later host step.

• Landing base commit: 475127d43c1cce70dba5cd31238af4e078fa17eb (the command center's relayed Currency wave W1b: grafana 13.2.3 (security release) and agent-browser 0.38.2 #645 squash merge).
• Lane: lane:foundation.
• Owned paths: observability collector/dashboard/readers, focused checks, generated NativeStack2604 Grafana assets, monitoring install-plan mirrors and dated decisions.
• Shared install-plan changes preserve landed Repair native install-plan acceptance after the hcom relaxation #723/A27 qualification, custody and the authoritative rendered Prometheus unit. The repair was replayed once onto Currency wave W1b: grafana 13.2.3 (security release) and agent-browser 0.38.2 #645's relayed squash merge. The Grafana notes retain main's exact W1b selection/qualification statement and re-apply the reviewed dashboard/provisioning note. Main's registry is restored and owned rows are regenerated last; no shared registry lines are hand-merged.

The Lanes UID is cc-lanes, provisioned under the existing Token efficiency provider. Withdrawal is file based: restore the prior lanes.json, or remove only it, temporarily allow provider deletion, restart in a permitted slot, verify the anonymous dashboard endpoint returns 404, and restore disableDeletion: true. Keep token-layer, the provider and private registry.

Every provisioned dashboard using codex_turn_token_usage_sum carries lower-bound titles and descriptions until deployed start timestamps and a newly born single-turn reconciliation pass. The standalone template-copy publisher and maintained renderer share that policy. Latest unknown status values retain nulls; known RTK zero share requires an observed classified-shell denominator.

One clock panel retains the producer's 50 ms error-bound warning, 100 ms absolute-offset critical threshold and 1,200 s reference-age warning. Its separate three-minute UI freshness preserves missing data as No data. Collector serialization and native configuration validation pass; live clock-panel acceptance remains pending.

SOTA sources

• Codex rust-v0.160.1 / immutable source: events/session_telemetry.rs and config schema for native named tool events. Native item_completed and fork-history metadata supply the bounded readers.
• OpenTelemetry Collector Contrib v0.162.0: transformprocessor, signaltometricsconnector, spanmetricsconnector and otlpjsonfilereceiver for bounded dimensions, sanitization and supported routes.
• Grafana v13.2.3 file provisioning: provider deletion policy and JSON dashboard format. Loki v3.7.8 metric queries: range aggregation and observed-denominator zero filling.
• Prometheus v3.15.0: created-timestamp-zero-ingestion feature flag; deployed single-turn reconciliation remains required.
• OmniRoute v3.8.51: open-sse/services/routing/otel.ts optional upstream GenAI OTLP sink. Its environment application and native identity qualification remain with the command center.

Evidence-class table

Claim	Evidence class	Evidence
Named nested context-mode and RTK shell results reach Loki	native_proven	Retained one-shot per-run Codex OTel probe, 2026-10-06; no repeated model probe
Native BEFORE readers exclude inherited history	local_integration	Bounded 90-minute/246-minute receipts; method differences remain recorded
Fork/window/dedup, null-preserving status and provisioning behavior	synthetic / local_integration	Focused fixtures and 12 dashboard tests; not unchanged upstream acceptance
Both Collector configurations are valid	native_proven	Installed Collector validation, exit 0; configuration validation is not host application
Dashboard routes and file-based withdrawal follow supported formats	source_review / local_integration	Pinned provisioning sources, actual publisher coverage and passing install-plan checker; no deployed browser acceptance

Local commands run

nice -n 19 python3 -m unittest tests.test_ns2604_dashboards
exit 0; 12 tests pass, including every provisioned Codex-token dashboard and standalone portability

nice -n 19 python3 evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
exit 0; 84 rows, 186 commands and 113 acceptance entries agree

nice -n 19 otelcol-contrib validate --config=evidence/artifacts/new-wsl-install-plan-20261002/config/otel.yaml
nice -n 19 otelcol-contrib validate --config=observability/collector/collector.yaml
both exit 0

nice -n 19 python3 scripts/validate.py
exit 0; 69 components, 10,379 hashed files, 4 profiles, 214 receipts

git diff --check
exit 0

The initial plan-check failure from import-generated configuration bytecode is retained in the private check receipt. The loader now suppresses bytecode during dynamic imports, restores the prior setting and passes the rerun. Generated dashboard JSON is source evidence; it is not visual acceptance.

Decision record

• docs/decisions/2026-10-06-native-lane-invocation-observability.md.
• docs/decisions/2026-10-06-ns2604-native-dashboard-countability.md.

The README classifies all six retained 13000 references without rewriting frozen observations and requires a compatible emitter checkout while its timer is enabled. Storage COUNT/AGE read-back, unit/GPU export, client limit headroom and the GitHub snapshot feed retain named owners and explicit remaining gates.

Host evidence

No host receipt or client configuration is applied by this PR. Host apply waits for the GPT delta read, command-center ACK and the permitted post-Claude-window slot. Native Loki/Prometheus read-backs and an anonymous browser capture remain required.

Organic BEFORE/AFTER counts are not yet measured under the all-prompts, first-turn and actual steer-visibility rules. Effective role grants and referenced co-op blocks remain coverage gaps. No exclusion, readiness or token-row closure is claimed. No local A/B or trial gates today's read-back.

Earlier rebase

Commit 1 (f19626d6 → 35bfa72f) preserves main's Grafana
--show-error --output "$GRAFANA_HEALTH_FILE" flags and uses the same flags
in the NativeStack2604 port annotation. Commit 4 (ceaca5ee → a752852c)
changed only the surrounding anti-pattern-log context: both zero-context stable
patch IDs are 947dc92f4ad5ded7b6258d65eb1b290de6c294f2, so its added/deleted
content is unchanged.

Checklist

• GitHub Actions changes: not applicable.
• No secrets printed, logged or committed; no new required secret.
• No new paid hosting, subscription or billing surface.
• Peer-owned worktrees and unrelated files preserved.
• Registry commit is last; PR remains draft for cross-family review.

Landing review follow-up

The local follow-up preserves landed metric privacy and records the configured source/query for every invoke column. Validated native names remain on Loki; bounded native metric keys remain permitted where the provider supplies them, and hook identity is qualified as lifecycle rather than repository identity. It restores main's run-correlation test byte-for-byte and removes run correlation from every exported metric route, while retaining log correlation. The clock serialization note moves verbatim into a dated appended amendment, and renderer source references use named exporter sections. F6/F7 remove the unnecessary agentsview version literal from the health comment. F8 preserves render-only Grafana checking and requests installed-unit byte verification explicitly in the three acceptance calls and their plan mirrors. The next exact-head read covers all eight findings. No host activation or client change is included.

Landing validation and path

The authorized landing replay is on475127d4 (#645). It preserves main's complete Grafana W1b notes and re-applies the reviewed dashboard note. All unowned main registry entries remain byte-identical, and all53 owned non-registry files have current registry hashes. Replay checks pass:223 affected tests (7 skips),721 tests in the eleven PyYAML-gated modules (47 skips), and six focused merger controls (no skips). Main's unchanged sources from475127d4 pass150 tests (7 skips), including the unchanged host-merger, tool-name and run-correlation modules. The install-plan and generated-dashboard checks pass; scripts/validate.py exits0. Native Node6/6 is reused from the completed phase because its inputs did not change.

The earlier complete Python phase on base003804f2 ran11,561 tests in the private, activated Python3.12 environment with checksum-locked CI dependencies and an initially empty HOME. It returned12 failures,1 setup error and1,211 skips. Each of the13 failing method/class selectors reproduces on clean main003804f2 in the same environment; no test was edited. These are declared baseline failures under the co-op's instructions, not a claim that the full phase passed. The setup-error selector is the runnable LinuxPlatformDependencyTests class. CI requirements SHA256:0b37433fb0fb165c893737e8e887581a07a6469683fbdf67ada1a08288758605; original pip-freeze SHA256:efd7c60ca69afe49918441138c3f3461b9c6e513628f562d5503362f8225c105. C1 exposed that this environment lacked the workflow's second pinned requirements file, so its YAML-gated tests had skipped. The replay adds unchanged requirements-validation.txt (SHA256:458d8cb1fef26d0d0a9a6a76707c0bad04fe84558550db750d50af206fecba81) and runs all eleven gated modules, as the command center directed instead of a second full phase. The new freeze SHA256 is e7d19cac4e91ceebe0d41b55581eb7a6dd8e7ebc021ce9a8b03dfe16056789d0. Original baseline logs and runnable IDs remain unchanged in durable lane state.

Landing path: the co-op's content read of27c8a4de closes F1–F8; the next head carries C1/V1–V4 and only the authorized #645 replay delta. The command center ACKs that head;5f alone lands it with green hosted CI. The relayed queue position is after#645;#825 remains dependent on LANDED775. The public hosted validate result remains the landing gate. Shared install-plan neighbour#723 is already landed and preserved.

Contract changes

• tests.test_observability_writer_identity.NativeCollectorTests: kind5 runtime binding/eligibility adaptation, accepted by name under CC item171356Z. Maintained inputs are manifests/stack.json:1102 (Collector pin) and evidence/artifacts/new-wsl-install-plan-20261002/install-plan.json:2239 (native executable destination). The dated7October existing-native-writer-contracts amendment records the choice; it does not supply either maintained input.
• NativeCollectorTests.setUp and .post: kind2a synthetic fixture extensions for the new isolated guard/scope-attribute test; existing methods retain the prior pipeline and default payload.
• NativeCollectorTests.test_sessions_and_processes_are_separate_writers_and_collapsed_streams_add_up: kind1 assertion inventory, retained by name under CC item172216Z. All five prior main assertions remain AST-identical (Claude60/14, Codex2000/4000, phase4/4, no conversion errors, incoming session-group telemetry); exactly-two-point/no-agent-label checks add constraints. Main had no three-point assertion.

The npm setup-class failure is environment-dependent: this lane resolves npm to a mise shim invalid under empty HOME, while the co-op launcher places real node/npm directories first on PATH and all28 tests pass there. The lane's exact main-run failure remains in baseline-final-summary-failures.log and its class selector remains in the declared baseline file.

C1 and V1–V4 closures

• C1: the maintained host merger explicitly copies the reviewed export guard and permits its one insertion immediately before conversion. Other host settings/order and refusal checks remain. Main's host module is byte-identical and passes; six new controls cover acceptance, idempotence, unknown processors, misplaced/duplicate guards, missing definitions and conflicting host settings.
• V1: the four existing-member declarations above are recorded in the dated native-writer-contracts and disposition amendments. The command center accepts the maintained runtime binding as kind5 and the session assertion inventory as kind1 by name.
• V2: the environment-dependent npm setup-class failure stays declared with its same main-run log; no test contract is weakened.
• V3: the disk-headroom decision gains only an appended dated amendment naming processors.batch.timeout; every earlier byte and its observed one-second value remain unchanged.
• V4: the current NativeStack2604 README explicitly requires the21300 manual Loki push URL.

The replay's extra adaptations are the dated M1/disposition record, preserved645 Grafana notes, the C1 merger guard/order support and new controls, the appended historical documentation locator and manual Loki endpoint instructions. The original fifteen disclosed adaptations remain. No host activation, client configuration or new feature selection is included.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 4b235b377cf3798b49016667c634947158c1046e. The command center (wsl-architecture-design) gave its ACK at this exact head; under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at this exact head, with no P1 item.

Observed main 475127d43c1cce70dba5cd31238af4e078fa17eb. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 475127d43c1cce70dba5cd31238af4e078fa17eb head 4b235b377cf3798b49016667c634947158c1046e base 475127d43c1cce70dba5cd31238af4e078fa17eb merged-tree b2f5730876af649dff82fdbe9a1b26d56d1a0d1a merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 54, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 53, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10553 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree b2f5730876af649dff82fdbe9a1b26d56d1a0d1a)

Required checks at this head: 7 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as b16cb8cf7cb8e37bf0d0edb9924502beb3e6a276 (parent 475127d43c1cce70dba5cd31238af4e078fa17eb), tree b2f5730876af649dff82fdbe9a1b26d56d1a0d1a. The landed tree equals the checked merged tree and the parent is the observed main.