v0.8 — Observability, Automation & Platform APIs planning and implementation tracker

[ammarheidari]

Authority and live stage

• Gate 8 scope v0.8 — Observability, Automation & Platform APIs scope admission #208 — ACCEPTED / CLOSED.
• W61 v0.8 W61 — Governed planning package, observability/automation contracts and compatibility matrix #210 — COMPLETE / ADMITTED.
• W62 v0.8 W62 — OpenTelemetry and Prometheus observability foundation #211 — COMPLETE / protected-main verified.
• active published release remains v0.7; v0.8 publication is separately owner-gated.
• current protected-main product baseline: b2eb6b25008eb1cbbe2359a0da97ee5abd4e6f5d.

Live workstreams

• v0.8 W61 — Governed planning package, observability/automation contracts and compatibility matrix #210 — W61 governed planning package
• v0.8 W62 — OpenTelemetry and Prometheus observability foundation #211 — W62 OpenTelemetry + Prometheus foundation
• v0.8 W63 — Historical metrics provider, retention and query contracts #212 — W63 ACTIVE / Slice 1 COMPLETE, Slice 2 ACTIVE
• v0.8 W64 — Kafka operational analytics, lag trends and SLO tracking #213 — W64 ACTIVE / dependency-safe live analytics contract work admitted
• v0.8 W65 — Bounded data-quality policies and monitoring #214 — W65 ACTIVE / bounded data-quality foundation admitted
• v0.8 W66 — Alert routing adapters and activity/event webhooks #215 — W66 ACTIVE / typed notifier/delivery foundation admitted
• v0.8 W67 — REST API parity and Kafdeck CLI #216 — W67 ACTIVE / Slice 1 corrected + verified; further read/API/auth-profile slices admitted
• v0.8 W68 — Configuration-as-code and GitOps workflows #217 — W68 BLOCKED on stable affected typed APIs/declarative ownership contracts
• v0.8 W69 — Terraform provider over stable governed contracts #218 — W69 BLOCKED on W68 stable resource schemas
• v0.8 W70 — MCP server, agent tools and automation authority boundary #219 — W70 BLOCKED until stable API/authorization contracts for admitted tools
• v0.8 W71 — Safe compensation, integrated automation UX and v0.8 release readiness #220 — W71 BLOCKED on release-scope workstreams

Current canonical evidence

W62

• final protected-main baseline before downstream activation: 6987a90a2bbf77d9ecb9125cf47a85a0ba059c58;
• post-merge quality and CodeQL: SUCCESS.

W63 Slice 1

• PR feat(history): establish W63 historical metrics provider core #232 final exact head: 62c0dbeef5f36ccb985c6a39a61d09de53a7841f;
• protected-main merge: b2eb6b25008eb1cbbe2359a0da97ee5abd4e6f5d;
• exact-head quality/dependency/v0.3/v0.4/v0.5-persistence/CodeQL/supply-chain: SUCCESS;
• fresh CODEOWNER approval + Codex exact-head review: CLEAN;
• post-merge quality #1574: SUCCESS;
• post-merge CodeQL #1416: SUCCESS;
• W63 Slice 2 now owns deterministic rollup/retention worker + HA lease/fencing.

W67 Slice 1

• initial PR feat(cli): establish W67 governed read/status client #233 merged as c8edf2051e98f5721f5fdb0327a09a596e186998;
• post-merge P1 OIDC mismatch corrected fail-closed by PR fix(cli): restore OIDC-safe command boundary #234;
• corrected protected-main baseline: 362b8537ae984910e56dee39e9adcc0be9411836;
• corrective exact-head review clean and post-merge quality #1572 SUCCESS;
• mutation/approval CLI reads remain withheld until governed non-browser OIDC support exists.

Parallelism now admitted

• W63 Slice 2 continues retention/rollup/HA coordination.
• W64 may proceed on live evidence normalization/contracts; history-backed trend/SLO paths remain dependent on W63 Slice 2 semantics.
• W65 may proceed on a closed bounded policy grammar/evaluator and aggregate evidence; no arbitrary code/unbounded scan/raw payload persistence.
• W66 may proceed on typed notifier profiles, delivery state and SSRF/destination policy before any real outbound adapter.
• W67 may proceed on additional read-only parity, machine JSON/pagination and safe auth/profile handling.

Dependency maintenance

Dependabot PRs #226/#227/#228 attempted split CodeQL 4.38.2 updates and fail by construction because init/autobuild/analyze cannot mix action versions. They are closed as superseded by atomic PR #235, which updates all three pinned steps together.

Hard boundaries

• no automation client receives privileged bypass;
• no unbounded/high-cardinality telemetry or raw protected-data export;
• no arbitrary notifier/provider endpoint proxy;
• no arbitrary-code data-quality predicates;
• no generic rollback; compensation requires an explicit safe inverse;
• no OIDC-dependent CLI mutation/approval flow until a governed non-browser auth design exists;
• release/tag/OCI/GitHub Release publication remains separately owner-gated.

[ammarheidari]

W67 post-merge correction

PR #233 merged as c8edf2051e98f5721f5fdb0327a09a596e186998, then fresh exact-head review found a P1 OIDC/CLI command-surface mismatch. Corrective PR #234 is active on a7c1196fe673dacae8fbc2060574aad5305c6d9c; W67 Slice 1 remains open for protected-main corrective verification. W63 #232 remains independently gated.

[ammarheidari]

W67 corrective closeout

The post-merge P1 from PR #233 is remediated by PR #234 / protected-main 362b8537ae984910e56dee39e9adcc0be9411836. Exact-head review was clean and post-merge quality #1572 succeeded. W67 may continue from the corrected read-only CLI baseline; OIDC-dependent mutation/approval CLI commands remain out of scope until their authentication flow is governed.

[ammarheidari]

Live reconciliation: W64 Slice 1 is corrected and protected-main verified through PR #238 / 4beeab13ab9d251024d95aa28bcf4c6b8f3e9f8a. W63 Slice 2 #236 and W65 Slice 1 #239 are independently active on fresh canonical heads 8f62a84f... and 8ad70afe... respectively.

[ammarheidari]

Live v0.8 reconciliation: W63 corrective #241 exact head 16aca4d85c68c2f85c6f7b89ff52cea7e8ff62c4; W65 Slice 1 #239 exact head fd7c8f43ae3d9c14dc0ecd9a10c3181b10d588f3; W66 Slice 1 #240 exact head 6e78003cbd996f6f7f3a476089be15580d5c657a. All are independently gated; no stale-head approval is being reused.

[ammarheidari]

Live reconciliation:

• W65 Slice 1 is COMPLETE/protected-main verified at 6ea6dfc6ea441b1917cce4a4beb54320a297aabf.
• W65 Slice 2 bounded evaluator/progress contracts are ACTIVE in PR feat(data-quality): define bounded W65 evaluator contracts #243; branch contains post-review immutable snapshot/completion fixes and will be recanonicalized after W66 main stabilizes.
• W66 Slice 1 remains post-merge corrective-gated by PR fix(notifications): scope credentials and NAT64 resolution #242; latest exact head f2c240b70736ec933405edad79cb69132a183076 checks all applicable standard/configured NAT64 decodings and rejects configured overlaps.
• W63 Slice 2 remains corrective-gated; branch contains valid PostgreSQL writer-fence SQL, exact v3 accumulator, legacy non-finite/oversized-count recovery and nearest-even rounding. It will be resynchronized once W66 corrective main is stable.
• W67 Slice 2 scope is admitted as read-only API/CLI parity + bounded machine output; mutation/OIDC commands remain excluded.

[ammarheidari]

Live reconciliation: W66 Slice 1 is corrected and protected-main verified at 4a4ec6302b4209f25b7456f95d3687d32ff6b134. W65 Slice 2 #243 is in fresh exact-head gates; W63 corrective #241 will be resynchronized once W65 stabilizes main.

[ammarheidari]

Current live heads: W66 Slice 1 corrected/protected-main verified at 4a4ec6302b4209f25b7456f95d3687d32ff6b134; W65 Slice 2 #243 final exact head a0154b8ff3d2421728d63488ee239c1d7233ba01 is in final CodeQL + Codex exact-head gates; W63 corrective source is frozen and will be rebased once onto the post-W65 protected main.

[ammarheidari]

W65 Slice 2 is now protected-main verified at e1abda30d3d8ae57b4ddbf983f4bb12e145eed26 (quality #1698 + CodeQL #1540 SUCCESS). W63 corrective #241 exact head 5389d0a44e8675916df34589faf9f00793ae3b86 is the only active corrective gate before advancing the next implementation slices.