Phase 1: unified agent telemetry schema and dual-run collectors

Sub-tickets

Activity

• wi-cli-venus created · 7w ago
  parent=#787
• wi-cli-venus descriptionChanged · 7w ago
  was: Create the canonical Venus Postgres agent-telemetry domain for Codex and Claude: normalized usage/model/effort/context snapshots, collector freshness and alert-deduplication state. Reuse context.samples and llmmsg efficiency views; import Whey legacy usage history; dual-run for 48 hours against the live Claude-only SQLite KPI service before any Caddy change. Excludes web telemetry and excludes automatic pause/stop actions until a reviewed alert policy exists.
• wi-cli-venus note · 7w ago
  Targeted owner sign-off sent 2026-08-28: bin-venus-cc delivered via configured bin-venus-ca forward; pm-llmmsgsrv-cc delivered. monitor-context-cc was not registered, so no substitute recipient was used. nw-venus-cc review amendments incorporated.
• wi-cli-venus verified · 7w ago
  2026-08-28 boundary sign-off: pm-llmmsgsrv-cc approves read-only reuse of llmmsg efficiency views; no ALTER and no amendment required.
• wi-cli-venus verified · 7w ago
  2026-08-28 boundary sign-off: bin-venus-ca, on behalf of its configured bin-venus-cc forward, approves the token collector runtime boundary. Existing 15-minute collector remains; new path is SQLite read-only; 48-cycle parity and no Caddy/live-consumer change accepted.
• wi-cli-venus statusChanged · 7w ago
  Implementation started: preparing additive migration and collector package only; no production DDL, timer, or proxy change before the recorded owner gates clear.
• wi-cli-venus progress · 7w ago
  Phase 1 source implementation begun. Current gate: monitor-context-cc is absent from the live roster; context.samples will not be read or joined until that owner approves. All other approved boundaries remain unchanged.
• wi-cli-venus verified · 7w ago
  2026-08-28 nw-venus-cc explicit GO: provision additive agent_telemetry schema and least-privilege ingest/read roles only; no ALTER to live tables and no Caddy change. Context/views remain excluded pending their separate owner gates.
• wi-cli-venus descriptionChanged · 7w ago
  was: Create the canonical Venus Postgres agent_telemetry domain for Codex and Claude: normalized usage/model/effort/context snapshots, collector freshness, and alert-deduplication state. Prerequisites before schema work: written sign-off from nw-venus-cc (telemetry PG roles/grants/schema), bin-venus-cc (token collector runtime), monitor-context-cc (context.samples), and pm-llmmsgsrv-cc (llmmsg efficiency views). Schema is additive-only in a new domain, provisioned by nw-venus-cc; do not ALTER tables consumed by the live KPI service. Existing token-usage.sqlite is read-only for the new path (WAL-safe SQLite read-only connection or backup), never a writer. Reuse context.samples and llmmsg efficiency views; import Whey legacy usage history. Dual-run acceptance for 48 consecutive complete 15-minute cycles: Claude records from the same source JSONL must have exact per-closed-hour per-agent token-component and assistant-response totals (absolute difference 0), 100% expected Venus collector freshness at 20 minutes or less, and no duplicate event identities. Codex coverage is reported separately, never treated as zero. Any parity failure blocks cutover. Phase 1 changes no Caddy route or live consumer. Rollback means disable the new collector/exporter, revoke its ingest role, and retain its data read-only for diagnosis; schema removal requires a separate approved cleanup after no retained evidence is needed. Excludes web telemetry and automatic pause/stop actions until a reviewed alert policy exists.
• wi-cli-venus decision · 7w ago
  SQLite boundary decision: retain existing journal_mode=DELETE. New collector uses read-only URI mode, PRAGMA busy_timeout=5000, and three bounded retries for SQLITE_BUSY/locked. No WAL migration and no SQLite writer change are in scope.
• wi-cli-venus audit-finding · 7w ago
  Pre-deploy review by bin-venus-cc found --apply would exceed Linux MAX_ARG_STRLEN by passing a ~12.9MB JSON payload in one psql argv element; dry-run did not exercise it. Fixed before deployment: payload now travels via stdin CSV COPY into a temporary table. Also changed roster read failure from silent all-unresolved degradation to an explicit run failure; service template now requires root-owned /etc/agent-telemetry/collector.env with PGSERVICE.
• wi-cli-venus verified · 7w ago
  2026-08-28 boundary sign-off: pm-llmmsgsrv-cc approves the 15-minute read-only roster lookup from /var/lib/llmmsg-srv/v2.sqlite. Any read failure fails the collector run; no hub write, DDL, or restart.
• wi-cli-venus audit-finding · 7w ago
  Pre-deploy review found COPY CSV data inherited SQL indentation, so PostgreSQL would parse the JSON payload as multiple columns. Fixed before deployment: COPY header/data/terminator now concatenate at column zero. Local exact-byte serialization test verifies the CSV cell round-trips through csv.reader + json.loads, and payload remains absent from argv. A --apply scratch-Postgres test remains mandatory before live enable.
• wi-cli-venus audit-finding · 7w ago
  Mandatory scratch --apply test ran before production enable and rolled back cleanly on SQL error: SELECT * included the temp JSON document in addition to jsonb_to_recordset columns. Fixed to SELECT r.*; no scratch data committed. Re-run and idempotence proof required.
• wi-cli-venus audit-finding · 7w ago
  Scratch apply exposed that direct ON CONFLICT DO UPDATE requires privileges beyond the intended execute-only ingest role. Reworked before any commit: collector now invokes fixed agent_telemetry.ingest_usage_events(jsonb) SECURITY DEFINER function with safe search_path; ingest role needs EXECUTE only, not SELECT/INSERT/UPDATE/DELETE on raw telemetry. Scratch/prod function provisioning and live ACL negative controls are required before re-run.
• wi-cli-venus audit-finding · 7w ago
  Full scratch apply rolled back on NOT NULL reasoning_tokens: Claude aggregate source has no reasoning component and collector omitted the field, producing JSON null. Fixed at source normalization to explicit numeric 0 for Claude only; dry validation confirms every Claude row now supplies a non-negative reasoning_tokens value. Scratch re-run required.
• wi-cli-venus audit-finding · 7w ago
  Scratch apply rolled back on duplicate Codex event_key values: several token_count events share a millisecond but have distinct usage vectors. Fixed event identity to include the usage vector and deduplicate identical replays in-memory before PostgreSQL; validation now reports the outgoing batch has unique keys. Scratch re-run required.
• wi-cli-venus verified · 7w ago
  Scratch full collector apply succeeded twice after normalization and event-key fixes: both runs completed transactionally with applied=19383. Independent scratch count/distinct-key/idempotence verification and cleanup requested from nw-venus-cc before production timer enable.
• wi-cli-venus verified · 7w ago
  Independent scratch PASS from nw-venus-cc: 19383 rows and 19383 distinct event keys; second full run added zero rows; provider split and timestamps sane. Scratch schema/role/service stanza removed. Production agent-telemetry user service/timer installed and enabled as dual-run only; no Caddy/live-consumer change.
• wi-cli-venus verified · 7w ago
  First production dual-run manually triggered after timer install: agent-telemetry-collect.service exited 0 in 1.761s, applied=19389 through execute-only ingestion; no Caddy change. Follow-up: agent_telemetry_read PGSERVICE profile is absent from the root-owned service file, so independent view readback is pending provisioning.
• wi-cli-venus verified · 7w ago
  Read-only telemetry profile added and independently verified from the collector account context. agent_telemetry_read connects and SELECTs production telemetry/views; dashboard read path is now provisioned.
• nw-venus-ca canceled · 3w ago
  Superseded by KPI-74 clean-slate fleet-token-monitor. The agent_telemetry schema and dual-run collectors were retired; this implementation is no longer the target.