GCP observability handoff

Precondition: GATE A = PASS

Next packet: OBS-G1 — GCP foundation

This document defines the contract for projecting governed producer-run evidence into Google Cloud. It is intentionally narrower than the estate itself.

Canonical authority surfaces

The producer control plane remains repository-owned:

• canonical producer declarations:
  • estate/producers.yaml
  • estate/producers.d/*.yaml
• observability policy:
  • estate/producer-observability.yaml
• compiled deterministic projection:
  • generated/producer-observability.compiled.json
• receipt schema:
  • estate/schemas/producer-run-receipt.schema.json
• receipt contract:
  • evidence:producer-run-receipt@1

projects owns the common producer identity, authority declarations, scheduler-neutral observability semantics and receipt contract.

Participating repositories continue to own their own runtime behavior, artifact semantics, scientific/business logic and producer-local evidence.

Current estate projection

The accepted Gate A census is:

46 producers

github_workflow       9
translated_manifest   5
semantic_receipt      7
local_receipt         19
deferred_external     6

Local wrapper policy:

command:none               4
command:required          13
systemd_command:required   2

The compiled projection is the source for producer owner, scheduler kind, freshness policy, authority state, declared outputs and observability mode.

It is not live health.

Four production observation mechanisms

1. GitHub zero-touch observer

Implementation:

scripts/producer_github_observer.py

Purpose:

• inspect bounded GitHub Actions sentinel producers without changing their repos;
• reconstruct producer-run-receipt@1 from GitHub workflow metadata;
• preserve HOLD/unknown semantics rather than manufacturing successful output.

Current local spool convention:

artifacts/producer-receipts/github/<producer-id>/<scheduler-run-id>.json

2. Existing-manifest translator

Implementation:

scripts/producer_manifest_translate.py

Purpose:

• translate existing producer-local manifests/run records into the common receipt;
• reconstruct a fresh allowlisted receipt rather than copying source manifests;
• preserve privacy and existing lifecycle authority.

Current local spool convention:

artifacts/producer-receipts/manifests/<producer-id>/<run-id>.json

3. Local/manual/systemd command wrapper

Implementation:

scripts/producer_local_receipt.py

Purpose:

• wrap one explicit existing command;
• record execution lifecycle;
• assert artifact health only from explicitly supplied evidence checks;
• reject stale fixed-path evidence through current-run causality checks;
• preserve command exit behavior unless evidence enforcement is explicitly requested.

Current local spool convention:

artifacts/producer-receipts/local/<producer-id>/<run-id>.json

For systemd producers, successful execution does not prove scheduler health. scheduler_state=unknown is valid and must remain distinguishable.

4. Producer-local semantic emitters

Pilot implementation:

media_monitor/scripts/emit_media_publication_receipt.py

Purpose:

• emit the common receipt where workflow/scheduler success is weaker than producer semantic truth;
• derive artifact and terminal state from producer-owned evidence.

Media Publication current immutable receipt convention:

storage/runs/producer_receipts/media-publication-<github-run-id>-<attempt>.json

A mutable producer-local latest pointer may coexist for diagnostics. It is not canonical historical evidence.

Other semantic_receipt producers may implement their own small producer-aware emitters while preserving the same common receipt contract.

Receipt transport contract

GCP receives metadata-only producer-run receipts.

The receipt itself remains the portable unit of observed producer state.

A future exporter may add a separate projection envelope containing safe derived fields such as:

• producer owner;
• scheduler kind;
• observability mode;
• run duration derived from receipt timestamps;
• receipt ingestion timestamp;
• compiled freshness threshold;
• receipt SHA-256;
• source substrate.

These projection fields must not mutate the canonical receipt.

Privacy boundary

Allowed in GCP:

• stable producer ID;
• run/scheduler identity;
• timestamps;
• stage state;
• output type/state/durability;
• scheduler/execution/artifact/terminal/authority states;
• warnings that are already bounded metadata;
• semantic evidence refs;
• hashes;
• safe control-plane owner/scheduler/freshness metadata;
• bounded numeric durations/counts derived from the receipt.

Not allowed merely for observability:

• raw documents;
• transcript or media content;
• prompts;
• chat/message/email bodies;
• accounting values or records;
• row-level datasets;
• research/source payloads;
• source evidence bodies;
• command arguments;
• cwd or absolute local paths;
• environment contents;
• API keys, tokens, passwords or credentials.

If richer domain evidence is ever required in GCP, it must be governed by a separate domain-specific contract rather than silently expanding this receipt channel.

Authority boundary

GCP is an observability projection and query surface.

GCP receives metadata-only producer-run receipts.

GCP does not become:

• producer identity authority;
• artifact authority;
• scientific authority;
• business-rule authority;
• lifecycle authority;
• scheduler authority;
• repository authority.

Cloud Logging/Analytics may answer what was observed, when, and with what receipt state. They must not rewrite producer declarations, infer canonical artifact ownership, or silently promote candidates/HOLD outputs.

A receipt preserves the authority state supplied by the governed estate semantics.

Deferred external producers

The following six ChatGPT automation producers remain deferred_external at this handoff:

• producer.gpt.agent-governance-sweep
• producer.gpt.event-institution-scout
• producer.gpt.github-steward
• producer.gpt.opportunity-scout
• producer.gpt.portfolio-pulse
• producer.gpt.relationship-scout

OBS-G1/OBS-G2 must not fabricate observations for them.

They may be integrated later through a stable external receipt/export boundary.

HOLD / deliberately unobserved producer

producer.github.min-economia-dataset-updater remains:

authority.state  = hold
authority.status = unresolved

The accepted GitHub observation run returned no completed workflow run for this producer.

That absence is explicitly governed. No synthetic receipt should be created to make dashboards look complete.

Known non-blocking rollout debt

Gate A proves mechanism convergence, not complete rollout.

At handoff:

• the Media Publication semantic emitter is the accepted semantic pilot;
• six other semantic_receipt producers still need their eventual small producer-aware emitters;
• the three gpt_knowledge_factory wrappers are operationally local-only;
• systemd timer health is not yet a separate scheduler observer.

These may continue in parallel with GCP foundation work.

What OBS-G1 may create

OBS-G1 may establish the minimum isolated GCP observability foundation needed to receive future receipts, including:

• a dedicated GCP project or explicitly isolated equivalent boundary;
• a dedicated Cloud Logging bucket for producer-run observability;
• retention appropriate to small metadata-only run evidence;
• least-privilege service identities;
• analytics enabled for the dedicated logging surface when appropriate;
• an explicit naming/labeling convention for this observability plane.

OBS-G1 must not migrate producer runtimes merely to make them visible.

What OBS-G1 must not do

Do not:

• move GitHub/systemd/manual jobs to GCP;
• create a second producer registry in GCP;
• replace producer-run-receipt@1;
• flatten the multi-axis receipt into a single authoritative red/green state;
• assign stale-by-age semantics to manual/event-driven producers without an explicit policy;
• distribute long-lived service-account JSON keys across producer repos;
• send private/domain payloads to Cloud Logging;
• make App Hub or Cloud Run the estate authority;
• build a custom observability web application before validating Logging Analytics/dashboard value.

Planned GCP packets

OBS-G1 — GCP foundation

Create the isolated logging/analytics foundation, retention boundary and least-privilege identities.

No producer runtime migration.

OBS-G2 — receipt exporter

Implement the metadata-only exporter from canonical receipts to structured Cloud Logging.

Prefer central collection/transport so GCP credentials are not distributed to all participating repositories.

The exporter must be idempotent and preserve receipt identity/hash.

OBS-G3 — Analytics views / Control Room

Build useful observability projections over ingested receipts.

Expected first views:

• latest producer state;
• recent runs;
• recent failures;
• degraded runs;
• artifact failures;
• terminal failures;
• never observed;
• stale scheduled producers;
• latest outputs.

Primary operator question:

What ran, what failed, when, and which artifact/terminal state was affected?

Do not create a custom application until these managed surfaces have been tested for actual operator value.

OBS-G4 — auth / WIF only if needed

Use Workload Identity Federation for direct GitHub-to-GCP export only if the chosen OBS-G2 transport actually requires producer-side GitHub authentication.

Prefer avoiding long-lived keys.

If a central collector is sufficient, OBS-G4 may remain unnecessary.

OBS-G5 — freshness + alerting

Project governed freshness policy over latest receipts.

Alert first on:

1. explicit failed runs;
2. stale scheduled producers.

Candidate/degraded/unknown states should initially remain visible in the control room without generating alert floods.

Manual/event-driven producers with no declared wall-clock stale threshold must not become stale solely because they are old.

Gate A proof references

The accepted pre-GCP proof set is recorded in docs/observability/gate-a-readiness.md.

Gate A is closed.

GATE A = PASS
READY FOR OBS-G1