Repository navigation
http_requests_total never sees auth routes or the REST data API — the two highest-traffic inbound surfaces are outside the only HTTP counter the docs tell operators to monitor #9650
Description
Activity
Triage — first-touch grading (triage seat, session
session_01KTguWpd7WNGYTGmSNY31RL): promoted topm:queue,domain:cliconfirmed (fix lands inpackages/runtimedispatcher wiring / instrument layer), type Bug — the SEMCONV registry declares the HTTP family as the stable operator-alerting namespace and the wiring silently excludes the two highest-traffic surfaces; restoring coverage is declared=enforced restoration, not a new capability.Dispatch notes: premise-first — re-verify both mount paths on the current ref (the measurement is from
b057e53f4, hours old). If registering the instrumented proxy back as thehttp.serverservice turns out to be order-load-bearing (services resolved before the proxy exists would keep the raw handle), that is a real fork: stop and FLAGneeds_decisionrather than picking silently between proxy-registration and raw-app-layer instrumentation. Multi-implementation note: whichever seam is chosen must catch bothplugin-auth'sgetRawApp()mount andpackages/rest's ownhttp.serverresolution — a fix that catches one and not the other reproduces this card one surface over.
Generated by Claude Code
Claim: PM loop round 21
Session:session_012WKSnqAaoqtW3QX7SSf1Vk
Branch:claude/issue-9650-http-metrics-auth-and-rest-coverage
Worktree:objectstack-issue-9650
Domain:domain:cli
File surface (region-level):packages/runtime/src/observability/instrument.tsandpackages/runtime/src/dispatcher-plugin.ts— the HTTP-counter instrument seam; and if the chosen seam requires it,packages/rest/src/rest-api-plugin.ts'shttp.serverresolution. Plus pins and.changeset/**.
⛔ NOTpackages/rest/src/rest-server.ts— see the serial constraint below. If the fix turns out to need that file, STOP and report; it is not a widening the dev may take.
Container & model:M,mode:subagent,model: opus— tier derived this round fromnode scripts/pm/dispatch-gates.mjs --tierover the three paths above: no path-derived mandate (floor sonnet · default opus · ceiling fable), ⛔ not recalled. Held at default because triage pre-declared a real fork (below) that needs judgment, not just wiring.
Clause-②: no — adding metric coverage does not change what any route accepts or rejects. Triage's phrasing, which I agree with: "restoring coverage is declared=enforced restoration, not a new capability."Serial constraints cleared — and the one I checked rather than assumed
⚠️ The card names "the REST data API" as one of the two uninstrumented surfaces, which reads as though the fix lands inrest-server.ts— the file #9488 is holding right now. I re-derived rather than taking the title at face value:reading result where http_requests_totalis emittedpackages/runtime/src/observability/instrument.ts,packages/runtime/src/dispatcher-plugin.ts(+packages/observability/src/semconv.ts, the registry)where packages/restresolveshttp.serverpackages/rest/src/rest-api-plugin.ts:122(config.serverServiceName || 'http.server')rest-server.tsinvolvementnone — it is not a producer or consumer of this seam ⇒ No same-file contention with #9488. At most this touches
packages/restin a different file, which the maintainer's 2026-08-18 exemption 「放开同包，同文件仍硬串行」 permits; four replacement rules carried into the dispatch (region surface · mergemainbefore the PR · merge again if a sibling lands · conflicts to the merge queue, ⛔ not hand-ordered).In flight in this lane: #9488 (
packages/rest/src/rest-server.ts, Clause-② contract face) — disjoint from every path above.Carried into the dispatch verbatim from triage
"If registering the instrumented proxy back as the
http.serverservice turns out to be order-load-bearing (services resolved before the proxy exists would keep the raw handle), that is a real fork: stop and FLAGneeds_decisionrather than picking silently between proxy-registration and raw-app-layer instrumentation.""Multi-implementation note: whichever seam is chosen must catch both
plugin-auth'sgetRawApp()mount andpackages/rest's ownhttp.serverresolution — a fix that catches one and not the other reproduces this card one surface over."⭐ That second note is the acceptance criterion, not a caveat: this card exists because a counter covered some inbound surfaces and not others, so a fix that covers one more surface and misses another has produced the same defect with different coordinates. The pin has to assert coverage of both mounts, not just the one that was easier to reach.
⚠️ Premise-first: triage's measurement is fromb057e53f4and is hours old. Both mount paths get re-verified on the current ref before anything is written.
Generated by Claude Code
{ "issue": 9650, "status": "needs_decision", "branch": "claude/issue-9650-http-metrics-auth-and-rest-coverage", "pr": "https://github.com/objectstack-ai/objectstack/pull/9746", "premise_still_valid": true, "summary": "Premise re-verified on the current ref and CONFIRMED by measurement, not by reading: with a real Hono adapter booted in the shipped serve.ts plugin order, http_requests_total counts the dispatcher's own route and counts neither the plugin-auth getRawApp() mount nor a REST data route mounted through the real RouteManager, while both answer 200. No fix is delivered: ruling (2) fired. Both seams triage pre-declared are order-load-bearing, and seam A additionally misses the auth mount STRUCTURALLY (getRawApp passes through the Proxy unwrapped, independent of order) and traps only get/post/delete so REST's put/patch stay uncounted regardless. The only order-independent variant measured (a raw-app middleware installed in Phase 1 init()) covers both mounts with status, but requires moving the wiring out of start() against the deliberate rationale at dispatcher-plugin.ts:588-604, makes http.server an init-time dependency, and is Hono-specific (the conformance adapter deliberately omits getRawApp), so it would silently read zero on any non-Hono transport. Delivered instead: a 12-case measurement harness that pins today's coverage and each seam's real reach, plus the enumeration showing the card's 2 uninstrumented surfaces are actually at least 14.", "premise_reverification": { "card_measured_at": "b057e53f4", "verified_at": "a8d691396 (branch head, main merged at da666d9ba)", "verdict": "every structural claim in the card still holds; nothing was falsified", "details": [ "http_requests_total still has exactly one emitter, instrument.ts:106 - unchanged", "the instrumenting Proxy is still a LOCAL binding built at dispatcher-plugin.ts:700-721 and never registered back - unchanged", "plugin-auth still mounts on the raw Hono app: auth-plugin.ts:1622 getRawApp(), then mounts at 1630 (use), 1653, 1675, 1710, 1741 - the card cited 1622 and 2240; 1622 is exact, and the wildcard family is broader than the two lines cited", "packages/rest still resolves http.server itself: service NAME resolved at rest-api-plugin.ts:122 (config.serverServiceName || 'http.server'), the getService call at :129 - the card said :129, the PM said :122, and both are right about different lines", "MECHANISM CORRECTION to the card: packages/rest does not call the adapter directly. RestServer builds new RouteManager(server) at rest-server.ts:834 and every data-API route is mounted by RouteManager.registerWithServer (route-manager.ts:191-213) via server.get/post/put/delete/patch. The harness therefore drives the REAL RouteManager rather than a hand-rolled server.get stand-in." ] }, "enumerated_inbound_mounts": { "headline": "the card names 2 uninstrumented inbound surfaces; the measured count is at least 14, in two structurally different classes", "class_A_framework_native_getRawApp_mounts": [ "plugin-auth /api/v1/auth/* plus config, bootstrap-status, set-initial-password, admin routes (auth-plugin.ts:1622,1630,1653,1675,1710,1741) - the card's mount #1", "metadata HMR routes (metadata/src/plugin.ts:448 -> routes/hmr-routes.ts:126,185)", "cloud-connection-plugin.ts:138 -> 8 routes at :223-626", "marketplace-proxy-plugin.ts:231 -> :371 rawApp.all(prefix/*)", "marketplace-install-local-plugin.ts:237 -> :246-251", "runtime-config-plugin.ts:540 -> :684,686", "trigger-api/src/plugin.ts:78 -> POST hooks path", "plugin-webhooks/webhook-outbox-plugin.ts:334 -> POST /api/v1/webhooks/redeliver", "plugin-approvals/approvals-plugin.ts:288 -> :294,303", "cli/utils/console.ts:484 -> :534,538,541 (console SPA) and :602 -> :606 (runtime assets)", "cli/commands/serve.ts:3464 -> :3476 rawApp.use('*') unknown-hostname-guard (middleware, not a route)" ], "class_B_http_server_service_consumers_mounting_via_verb_methods": [ "packages/rest - the REST data API via RouteManager - the card's mount #2", "service-storage/storage-service-plugin.ts:364", "service-i18n/i18n-service-plugin.ts:108", "service-settings/settings-service-plugin.ts:226", "service-datasource admin routes (datasource-route-ledger.ts:24, wired at serve.ts:2998)", "packages/runtime dispatcher itself - the ONLY one instrumented today", "qa/http-conformance/node-plugin.ts:40 - a NON-Hono adapter that also registers http.server" ], "why_it_matters": "class A is invisible to ANY IHttpServer-level wrapper by construction, so no proxy-shaped fix can ever reach it. That is the structural reason the answer is a transport-level seam rather than a per-consumer fix, and the reason ruling (1)'s 'both mounts' criterion cannot be met by seam A at all.", "grep_shapes_used_with_controls": [ "getRawApp sweep. CORRECT shape used: \\.getRawApp\\s*(\\?\\.)?\\s*\\( -> 18 sites. INTOLERANT control \\.getRawApp\\( -> 17. The PM's brief shape \\.getRawApp\\s*\\??\\s*\\( -> ALSO 17, i.e. it found zero optional-call sites while looking tolerant. Gap = 1 real site: cli/commands/serve.ts:3464 'httpServer?.getRawApp?.()'. POSITIVE CONTROL on a member known to exist: \\.getPort\\s*(\\?\\.)?\\s*\\( -> 4. NEGATIVE CONTROL: \\.getNoSuchThing... -> 0.", "http.server service-resolution sweep. CORRECT shape: getService(Async)?\\s*(<[^>]*>)?\\s*(\\?\\.)?\\s*\\(\\s*['\\\"`]http[.-]server -> 10 sites. Shape WITHOUT the type-argument group -> 5 sites, i.e. a SECOND miss class beyond optional-call: a generic type argument between the identifier and the paren. Gap = 5 real sites, all of the form getService<IHttpServer>('http-server'): dispatcher-plugin.ts:588, service-i18n:108, service-settings:226, service-storage:364, plugin-auth:795. NEGATIVE CONTROL: same shape on 'no-such-service' -> 0.", "THIRD miss class, not reachable by any literal-string shape: rest-api-plugin.ts:129 resolves the service through a VARIABLE (config.serverServiceName || 'http.server' at :122), so the getService call names no literal at all. Found only by reading, which is why the card and the PM cite two different line numbers for the same fact.", "raw-app route-mount sweep: \\b(rawApp|app)\\s*(\\?\\.)?\\.?\\s*(get|post|put|delete|patch|all|use|route|on)\\s*(\\?\\.)?\\s*\\( over packages/, excluding the adapter's own file. Every hit was READ and classified rather than counted (trap 3) - e.g. metadata/src/plugin.ts:448 hands the raw app to a registrar rather than mounting inline, and serve.ts:3430 is a PROSE mention inside a comment, not a mount." ], "self_correction": "I hit the PM's corrected-shape problem independently, mid-task, and had already switched to (\\?\\.)? before the correction arrived - and then found the same class AGAIN in a second shape (the type-argument gap), which the correction did not mention. Both intolerant counts are reported above so the gap is visible rather than asserted." }, "seam_decision": { "ruling_2_fired": true, "seam_chosen": "none - escalated per ruling (2)", "measured_basis": [ "SEAM A is order-load-bearing, exactly in the words triage used: a consumer resolving http.server in an earlier start() keeps the raw handle (measured: resolution order ['raw','proxy']). In the SHIPPED serve.ts order REST (:2548) starts BEFORE the dispatcher (:2566), so REST is the 'raw' row - the unfavourable one.", "SEAM A is ALSO structurally incapable of ruling (1), independent of order: getRawApp passes through the Proxy via Reflect.get and returns the untouched Hono app (measured), so the plugin-auth mount can never be reached this way.", "SEAM A leaks verbs: the Proxy traps only 'get'|'post'|'delete' (dispatcher-plugin.ts:702), while REST mounts put and patch through RouteManager (route-manager.ts:201-209) - measured, so even a favourably ordered seam A undercounts REST.", "SEAM A cannot even be spelled as described: ctx.registerService throws \"[Kernel] Service 'http.server' already registered\" (kernel-base.ts:79-81) - measured. It requires ctx.replaceService, i.e. deliberately swapping a service another plugin provided.", "SEAM B (raw-app Hono middleware installed during the dispatcher's start()) is order-load-bearing too and currently covers NOTHING: measured on the real booted app it observed none of the auth, REST or dispatcher routes, only a probe route registered after it.", "SEAM C (the same middleware installed in Phase 1 init()) covers auth, REST and the dispatcher WITH status - measured. Phase 1, not 'before kernel:listening', is the sufficient condition: a middleware installed from a kernel:bootstrapped hook still observed nothing (measured).", "The framework-agnostic use() seam is NOT an option: the adapter runs the whole use() chain and only then returns Hono's next(), so a middleware there has no response and cannot carry the {status} label - measured." ], "rest_server_ts_needed": false, "note_on_ruling_3": "packages/rest/src/rest-server.ts was READ (to establish that RouteManager is the real mounting path) and never edited. No change to it is required by any of the three seams. My only writes were the one new test file in packages/runtime." }, "how_the_pin_asserts_both_mounts": "packages/runtime/src/http-metrics-inbound-coverage.hono.integration.test.ts boots a REAL Hono adapter (LiteKernel + HonoServerPlugin) with plugins registered in the shipped serve.ts order and the dispatcher LAST, injects a recording MetricsRegistry as the dispatcher's observability.metrics, then drives real fetch() calls at three probes. The auth mount is exercised through getRawApp().all(basePath + '/*'), the exact construct at auth-plugin.ts:1622-1630; the REST mount is exercised through the REAL RouteManager imported from @objectstack/rest, so it is the production registrar rather than a model of it. A positive control asserts the dispatcher's own route IS counted - without it, both 'not counted' results would be indistinguishable from a broken metrics injection. The file header names the two 'does NOT count' assertions as the acceptance criterion in executable form: whichever seam wins, BOTH must flip together, and flipping one reproduces the card one surface over.", "reverse_verification": { "method_note": "The standard ablate-the-fix leg does not apply - there is no fix to ablate. What was done instead: all 12 expected outcomes AND their reasons were written to a prediction file BEFORE the first run, then compared. The §1 positive control does the job an ablation would: it proves the metrics injection is live, so the negative results are not a dead harness.", "prediction_written_before_running": true, "run_1": "10 cases, 7 passed, 3 failed. All four §1 baseline predictions matched exactly, including reasons.", "run_1_failures_with_reasons_checked": [ "'earlier consumer keeps the raw handle' failed with \"[Kernel] Service 'http.server' already registered\" - NOT the predicted reason. Root cause was my harness using registerService; the failure itself surfaced a real fact (seam A needs replaceService) which was promoted into its own measurement rather than papered over.", "two seam B/C cases failed with ERR_MODULE_NOT_FOUND for 'hono' - NOT the predicted reason. Root cause: hono is not a direct dependency of packages/runtime. Fixed by measuring on the REAL booted app via getRawApp() instead of a synthetic Hono instance, which is strictly stronger evidence than the original design." ], "final_run": "12 cases, 12 passed, every outcome matching the written prediction and each for the predicted reason. Re-run after merging main: Tests 12 passed (12).", "honest_note": "Counts matched at the end, but they matched only after two harness defects were root-caused; reporting 'prediction met' on run 1 would have been false. Neither failure was a repo finding." }, "gate_union_real_results": { "derivation": "node scripts/pm/dispatch-gates.mjs packages/runtime/src/http-metrics-inbound-coverage.hono.integration.test.ts - re-derived from the ACTUAL changed path, not from the brief (the brief named no gates). 3 path-matched + 5 convention-triggered. GAP FOUND THE HARD WAY: the derivation did NOT name `pnpm lint` / `check:slot-lookup`, and that is exactly what went red on the first push. This is a second live instance of the already-filed #9721 / #9700 (dispatch-gates does not know check:slot-lookup exists, costing a CI round-trip) - so it is reported here rather than filed again as a duplicate.", "head_verified": "5ae0e895e (final head; main merged at da666d9ba). The whole union was re-run on this head, ratchets included.", "results": [ "pnpm --filter @objectstack/runtime exec vitest run <file> -> 'Test Files 1 passed (1)' / 'Tests 12 passed (12)'", "pnpm lint (eslint . --no-inline-config) -> exit 0 with EMPTY output on the whole repo; my file appears 0 times. RED on the first push with 2 errors, both mine - see lint_round_trip below", "pnpm check:slot-lookup -> OK, 107 unswept sites in 25 files, none new; baseline key set verified against da666d9, no files added", "pnpm check:nul-bytes -> OK, scanned 6234 text files, no raw ASCII control bytes (plus 75 self-test assertions)", "pnpm check:cross-package-test-inputs -> OK, 12 packages read outside themselves, all declared; 33 self-test cases passed", "node scripts/check-cross-package-test-inputs.mjs -> same gate, same OK", "pnpm check:engine-double-contract -> OK, 321 pinned, 133 in DEBT ledger, 2 exempt", "pnpm check:where-matcher -> OK, 255 matchers, 0 silently-wrong, none new", "pnpm check:query-options-erasure -> OK, ratchet holds, 67 unswept non-test sites, none new", "pnpm check:type-check-coverage -> OK, 64/77 packages type-checked, 13 in DEBT, 1 exempt", "pnpm check:type-check-debt -> OK, 33 ledger entries re-measured in 371.4s, 1926 raw tsc errors, NONE above its recorded number; 'surplus: none'", "node scripts/docs-audit/check-affected-docs.mjs -> OK, 242 self-test cases pass" ], "ratchet_note": "check:type-check-debt first REFUSED (unbuilt closure) - reported as NOT MEASURED rather than assumed, then the full workspace was built (turbo, 70/70 successful) and it was run for real. Separately and independently, the @objectstack/runtime TEST_DEBT entry (frozen at 227, shrink-only) was measured directly by compiling the hidden test layer: 227 total, exactly matching the ledger, with the ledger's documented 9 errors in meta-item-envelope.test.ts as the control, and 0 from the new file. The ratchet does not move.", "phantom_check_caught": "pnpm --filter @objectstack/runtime typecheck passes, but tsc --listFiles shows the new file is NOT in that program: packages/runtime/tsconfig.json excludes **/*.test.ts. Controlled before concluding (897 files listed, dispatcher-plugin.ts present, ZERO .test.ts in the program). This is pre-existing, already-ledgered debt (20 packages hide their tests; @objectstack/runtime is a TEST_DEBT entry tracked under #4311), not something introduced here - so it is reported, not filed as a new card.", "lint_round_trip": "First push was RED on 'Lint & Repo Gates': 2 errors, both in my new file, at the two `ctx.getService<any>('http.server')` sites - the slot-lookup rule ('do not erase a service-lookup result to any'). I verified both sites look up the SAME slot rather than assuming it. FIXED AT THE CALL SITES: typed both to IHttpServer (the declared contract, core-service-contracts.ts:155) and switched from reading an `.id` marker to comparing handles by IDENTITY - a Proxy is never === its target, so the stub needs no marker member at all, and the assertion got stronger. NEITHER escape hatch was taken: eslint.config.mjs UNCONTRACTED_SLOTS untouched and scripts/slot-lookup-baseline.json untouched (confirmed by git status on both paths). Per the PM's note about the rule catching real gaps: this erasure was hiding nothing real - it existed only so a test stub could carry an `.id` marker, and removing it cost nothing. All 12 measurements still pass after the rewrite." }, "zone_2_assumptions": { "instrument_seam_is_instrument_ts_plus_dispatcher_plugin_ts": "CONFIRMED - http_requests_total is emitted only at instrument.ts:106 and applied only by the Proxy at dispatcher-plugin.ts:700-721.", "semconv_is_registry_and_needs_no_change": "CONFIRMED - no SEMCONV change is needed to restore coverage; packages/observability was not touched.", "spec_change_needed": "CONFIRMED not needed - packages/spec was not touched.", "two_named_mounts_are_the_complete_set": "FALSIFIED - this is the one Zone 2 assumption that did not hold. The complete set is at least 14 inbound surfaces in two classes (enumerated above). The PM explicitly asked to enumerate rather than trust, and the enumeration changes the recommendation: a per-consumer or proxy-shaped fix cannot reach class A at all." }, "tests": "Commands, all under flock -E 99 -w 540 /tmp/os-heavy-verify.lock, verdicts read from reported counts not exit codes. Build: pnpm --workspace-concurrency=2 --filter '@objectstack/runtime^...' build -> success; later full closure pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 -> 'Tasks: 70 successful, 70 total' (needed before the type-check-debt ratchet would run at all). Suite: pnpm --filter @objectstack/runtime exec vitest run src/http-metrics-inbound-coverage.hono.integration.test.ts --maxWorkers=2 -> 'Test Files 1 passed (1)' / 'Tests 12 passed (12)', re-run on the merged head 5ae0e895e with the same result. Typecheck: pnpm --filter @objectstack/runtime typecheck -> clean, but see phantom_check_caught above - that green does not cover the new file, and the file was instead measured inside the hidden-test compile (0 errors, total 227 = the frozen ledger number). Gate union with each result echoed under gate_union_real_results. No ablation leg: there is no fix to ablate; the positive control serves that role and is stated as such rather than a template ablation being invented. LINT: pnpm lint -> exit 0, empty output on the whole repo (re-confirmed on the final head); pnpm check:slot-lookup -> ratchet holds, none new. The suite was re-run after the lint fix: Tests 12 passed (12).", "open_questions": [ { "question": "Where should http_requests_total be instrumented so that it observes BOTH the plugin-auth getRawApp() mount and the packages/rest http.server mount - given that the measurement disqualifies proxy-registration outright and shows the raw-app middleware is only correct when installed in Phase 1?", "options": [ "A. Transport-owned seam: emit the counter from the Hono adapter itself, next to installMiddlewareSeam(), which already solves this exact ordering problem by mounting at the end of HonoServerPlugin.init() before any route exists. Covers every inbound request on that transport including all getRawApp() mounts. COST: the emitter moves to packages/plugins/plugin-hono-server, i.e. outside this card's declared file surface AND outside its domain:cli producer - it needs re-dispatch, and each additional transport must implement it. Route label comes from c.req.routePath, so cardinality stays bounded.", "B. Extend the framework-agnostic IHttpServer contract with a response-observing hook (an 'afterResponse' seam, or making use() able to await dispatch), then emit from the runtime against that contract. Covers every adapter, Hono and the conformance node adapter alike. COST: a contract change to IHttpServer in packages/spec - a bigger surface than this card, and adapter authors must implement it; but it is the only option that is not transport-specific.", "C. Dispatcher installs a raw-app Hono middleware from its own init() (Phase 1). Measured to cover both mounts with status. COST: contradicts the deliberate rationale at dispatcher-plugin.ts:588-604 for doing http.server work in start() ('Phase 1 is over, so no-http.server is a FACT'), requires declaring http.server as an init-time dependency under ADR-0116 (turning an optional transport into a hard boot ordering edge), AND is Hono-specific - it silently reads zero on the conformance node adapter, which deliberately omits getRawApp.", "D. Do nothing to the counter; instead correct the operator docs to state which surfaces it covers. COST: leaves the declared-not-enforced shape the card is about, and the docs currently tell operators to alert on exactly this counter." ], "recommendation": "A, with B as the principled successor - justified on all three axes. REAL BUSINESS NEED: this is not a speculative capability. The uncounted surfaces are auth and the REST data API, i.e. the bulk of real inbound traffic, and the docs' operator guidance (5xx rate, p95 latency) is derived from this exact counter - a deployment can melt down on /api/v1/* with the counters flat. That is measured demand from a shipped, documented surface, not an invented one, so the startup-focus principle argues FOR restoring it and against widening it into new metric families. LONG-TERM SOUNDNESS: the defect's root cause is that the emitter lives one layer above where requests actually converge, so it can only see the mounts that happen to route through its own wrapper. A is the only measured option that puts the emitter where every inbound request already converges, and it needs no new contract; C is a workaround that buys coverage on one transport by taking on a boot-ordering dependency and contradicting a documented decision, which is the patch-shaped choice. B is architecturally the right end state (transport-agnostic, contract-first) but is a spec change and should be a separate, deliberate card rather than smuggled in here. AI-WRITTEN-CODE SAFETY: A and B both make coverage structural - a new plugin mounting routes any way it likes is counted automatically, so no future author can silently create another uncounted surface, which is precisely how this defect and its 12 unnamed siblings arose. C fails this axis hardest: it looks complete while reading zero on a non-Hono transport, i.e. it reproduces the card's own failure mode (a counter that is silently blind to a whole surface) at the transport level instead of the mount level. NOTE FOR THE DECIDER: A and C both need a decision I am not authorised to take - A moves the producer out of domain:cli/packages/runtime, and C changes the dispatcher's lifecycle contract." }, { "question": "Secondary, and cheap to settle once the seam is chosen: should the counter's route label for a wildcard mount be the PATTERN (/api/v1/auth/*) or the concrete path?", "options": [ "Pattern (c.req.routePath) - bounded cardinality, one series per mount", "Concrete path - unbounded cardinality; /api/v1/data/:id style traffic would explode the series count" ], "recommendation": "Pattern. The measurement already reads c.req.routePath and returns '/api/v1/auth/*' for the auth mount, so it is available at no cost, and concrete paths would make the counter unusable for exactly the alerting the docs prescribe. Flagging it only because it becomes unfixable-in-place once dashboards are wired against the first shipped label." } ], "out_of_scope_findings": [ "filed as #9745: serve.ts's unknown-hostname-guard comment (:3429-3435) states that adding a raw-app middleware 'before kernel:listening fires' is sufficient to intercept every request; measured, a middleware installed from a kernel:bootstrapped hook (which satisfies that condition) observes NOTHING, because every route is mounted in Phase 2 start(). The guard itself is installed correctly in init(), so no live defect - but the stated rationale is what the next author copies, and copying it ships a refusal surface that gates nothing, silently. Labelled finding + domain:cli, unassigned, no pm:queue." ], "notes_for_pm": [ "GATE-DERIVATION GAP, cost me one CI round-trip: dispatch-gates did not name `pnpm lint` or `check:slot-lookup` for a path under packages/runtime/src, and the slot-lookup rule is what went red. That is the exact failure #9721 and #9700 already describe, so I did NOT file a duplicate - but this is a second confirmed instance, on a test-only diff, which suggests the miss is not specific to source files.", "The brief's grep shape \\.method\\s*\\??\\s*\\( was already corrected here before your message arrived, and a SECOND miss class was then found that the correction does not cover: a generic type argument, getService<IHttpServer>('http.server'), which needs (<[^>]*>)? in the shape. That one cost 5 of 10 sites in the service sweep. A third class is not reachable by any literal-string grep at all (packages/rest resolves the service name through a variable).", "No changeset: tests-only, nothing published. skip-changeset applied and CONFIRMED BY READ-BACK as the union ['size/m','skip-changeset'] - size/m was bot-applied and preserved.", "PR is draft and deliberately carries NO fix; it uses 'Part of #9650', never a closing keyword, so merging it cannot close a card that is going into the decision box. Body audited for closing keywords (none) and for sanitizer-hostile '<'+letter sequences (none); footer written in session-URL form and verified present after the round-trip.", "Reported at draft-PR time per the 2026-08-10 ruling; CI convergence is not waited on." ] }
Generated by Claude Code
11 remaining items
- added sub-issues
on Aug 19, 2026 os-dev-report
{ "issue": 9650, "status": "rework", "branch": "claude/issue-9650-http-metrics-auth-and-rest-coverage", "pr": "https://github.com/objectstack-ai/objectstack/pull/9746", "premise_still_valid": true, "summary": "The ruled Option-A seam is implemented, measured and pinned: HonoServerPlugin.init() now installs a raw-app middleware emitting http_requests_total{method,route,status} immediately before installMiddlewareSeam(), with route = the matched PATTERN. The card's acceptance criterion flipped as a pair - the auth getRawApp() mount and the REST RouteManager route are both counted, and the dispatcher positive control still holds. status is rework, not done, for one measured reason that is not fixable inside the dispatched file surface: the shipped serve.ts registers no ObservabilityServicePlugin anywhere in the repo and constructs new HonoServerPlugin({ port }) with no observability, so NEITHER link of the canonical resolution chain exists there and the seam installs no middleware at all in an objectstack serve deployment. The seam is correct and inert at the host. Filed as sub-issues of this card: 9832 (CLI wiring), 9833 (dispatcher double count, measured 2 vs 1), 9834 (the same hole still open on http_request_duration_ms / http_request_errors_total); plus 9835, the IHttpServer contract-hook spec card the ruling directed.", "files_changed": [ "packages/plugins/plugin-hono-server/src/adapter.ts - new installHttpMetricsSeam(metrics), idempotent, one app.use('*') emitting after next()", "packages/plugins/plugin-hono-server/src/hono-plugin.ts - new observability.metrics option, private resolveMetrics(ctx) canonical chain, install call at end of init() BEFORE installMiddlewareSeam()", "packages/runtime/src/http-metrics-inbound-coverage.hono.integration.test.ts - section 1 assertions flipped, section 4 added (6 cases), header rewritten", ".changeset/http-requests-total-transport-seam.md - @objectstack/plugin-hono-server minor" ], "surface_breach": "none taken. packages/cli/src/commands/serve.ts was READ ONLY and never edited. It fails the bounded-in-place test on two of the four conditions: the repair is not mechanical (buildServeObservability() is called once, deep in the dispatcher block, so reusing it needs hoisting or memoising and the better option - registering ObservabilityServicePlugin once for all consumers - is a design choice that also lights up cache and storage metrics), and it adds verification surface in the hottest file in the repo. Filed as 9832 instead.", "zone_2_assumptions": { "a_install_beside_installMiddlewareSeam_observes_every_mount_with_status": "HELD, and verified at the REAL call site rather than by a harness-installed stand-in. Measured labels from one boot in the shipped serve.ts plugin order: [{GET,/.well-known/objectstack,200},{GET,/.well-known/objectstack,200},{POST,/api/v1/auth/*,200},{GET,/api/v1/data/probe,200},{GET,/api/v1/data/:id,200},{GET,/*,404}].", "b_dispatcher_proxy_double_counts": "CONFIRMED, and it is a per-surface duplicate, not a uniform scale factor. One request each, one shared registry: /.well-known/objectstack counted 2, /api/v1/auth/* counted 1. Reported, NOT widened - removing the emission is not separable from instrumentRouteHandler's request-id header, http_request_duration_ms, http_request_errors_total and the ErrorReporter (incl. the res.__obsRecordedError side channel), and packages/runtime was outside the surface. Pinned as an executable measurement naming the follow-up; when 9833 lands the expectation becomes toBe(1).", "c_routePath_populated_for_wildcard_mounts_from_the_adapters_own_seam": "HELD. /api/v1/auth/* for the getRawApp wildcard. Also measured beyond the assumption: a parameterized REST route labels as /api/v1/data/:id for concrete /api/v1/data/abc123 and /api/v1/data/def456 - two ids, ONE series - and an unmatched path labels /* with status 404, so the '|| unmatched' fallback never fires in practice.", "deviation_from_the_suggested_spelling": "Used routePath(c) from the hono/route subpath export instead of the c.req.routePath getter. Same VALUE (the ruling's substance is untouched); the getter is marked @deprecated in hono 4.13.2's own .d.ts and indexes matchResult without a bounds check, while the helper is the non-deprecated spelling and returns '' rather than throwing. Available in both hono versions resolved in this workspace (4.13.2 and 4.12.34); the package declares ^4.13.2." }, "acceptance_criterion": "Both 'does NOT count' assertions flipped TOGETHER in packages/runtime/src/http-metrics-inbound-coverage.hono.integration.test.ts section 1. The positive control (dispatcher's own route IS counted) is unchanged and still present. The harness composition was NOT weakened to fit the fix: still a real Hono adapter booted in the shipped serve.ts order, still the REAL RouteManager from @objectstack/rest, still the exact getRawApp().all(basePath + '/*') construct. The only composition change is wiring the registry into the transport, which is the fix's own wiring. Sections 2 and 3 (the seam-A and seam-B/C measurements that produced the ruling) are kept intact so the ruling's evidence stays executable.", "cross_card_route_envelope": "NO counter moved in scripts/check-route-envelope.mjs. Not asserted - measured, by running the gate TWICE on the same tree, the second time with adapter.ts checked out at the merge base. Identical both runs: 10 route modules (7 conformant, 2 ratcheted, 1 exempt), 16 dispatcher domains, 11 plugin-mounted modules with 161 hand-built bodies, current-user-endpoints.ts exempt closed at unenveloped 9. No stop condition; the file was never opened for edit.", "tests": "All heavy commands under flock -E 99 -w 540 /tmp/os-heavy-verify.lock; verdicts read from reported counts, never a piped exit code. Gate union re-run on the FINAL head 8957c72227 (origin/main merged at 9ff11921a2), after the last commit. Build closure first: pnpm --workspace-concurrency=2 --filter '@objectstack/runtime^...' --filter '@objectstack/plugin-hono-server' --filter '@objectstack/rest' build -> success; later the full closure the ratchet requires, pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 -> 'Tasks: 70 successful, 70 total'. SUITES: the pin -> 'Test Files 1 passed (1)' / 'Tests 18 passed (18)'; pnpm --filter @objectstack/plugin-hono-server test -> 'Test Files 18 passed (18)' / 'Tests 211 passed (211)'; pnpm --filter @objectstack/hono test -> 'Tests 73 passed (73)' (the downstream consumer of this adapter). TYPECHECK: pnpm --filter @objectstack/plugin-hono-server typecheck -> clean, script name echoed so it is not a zero-match phantom. GATES, each result echoed: pnpm lint (eslint . --no-inline-config) -> exit 0, EMPTY output on the whole repo; check:slot-lookup -> OK, 107 unswept sites in 25 files, none new, baseline verified against 4c260cd; check:route-envelope -> OK (see cross_card_route_envelope); check:nul-bytes -> OK, 6273 text files, no raw control bytes, plus 75 self-test assertions; check:type-check-debt --re-measure -> OK, 33 ledger entries re-measured in 380.8s, 1926 raw tsc errors, none above its recorded number, 'surplus: none'; check:type-check-coverage -> OK, 64/77 packages; check:engine-double-contract -> OK, 321 pinned, 133 DEBT, 2 exempt; check:where-matcher -> OK, 258 matchers, none new; check:query-options-erasure -> OK, ratchet holds, 67 unswept non-test sites, none new; check:cross-package-test-inputs (both spellings) -> OK, 12 packages, all declared; check:test-source-alias -> OK, 72 packages scanned; check:type-source-resolution -> OK, 76 packages scanned; check:changeset-gate-self-tests -> OK; check-adr-0087-registration -> OK, 1 non-breaking changeset seen; check-empty-changeset -> OK, 1 declaring changeset added; check-changeset-no-major -> OK; check:objectui-changeset -> OK; scripts/docs-audit/check-affected-docs.mjs -> OK, 242 self-test cases. ABLATION, both legs rebuilt and PROVEN to have reached dist: prediction file written BEFORE the run naming RED and specifically 7 of 18 with the seven cases listed; ablated leg -> node scripts/ablation-dist-preflight.mjs @objectstack/plugin-hono-server 'HTTP request counter armed' --absent -> 'marker absent from all 6 built files', run -> 'Tests 7 failed | 11 passed (18)', exactly the seven predicted; restore leg -> same preflight without --absent -> 'marker present in 2 built files', run -> 'Tests 18 passed (18)'. The CORS case failed on its POSITIVE leg (AssertionError: expected [] to include 'POST') while not.toContain('OPTIONS') passed vacuously against an empty array, which is why that positive leg exists.", "gate_derivation": "node scripts/pm/dispatch-gates.mjs with NO paths - the script derived the change set itself from the merge base (4 paths, three-dot semantics). 11 path-matched + 5 convention-triggered. The brief's warning reproduced exactly: the derivation named NEITHER pnpm lint NOR check:slot-lookup for these paths. Both were run regardless and both are green. That is now a THIRD confirmed instance of the already-filed 9721 / 9700, so it is reported here and not filed again.", "phantom_green_caught_a_real_defect": "pnpm --filter @objectstack/runtime typecheck is green and does NOT read the harness file (that tsconfig excludes **/*.test.ts). check:type-check-debt does read it and went RED: TEST_DEBT 227 -> 228. Root-caused rather than papered over - a CORS option spelled `origin` where HonoCorsOptions declares `origins`, so that test's CORS config was silently falling back to defaults. Fixed at the call site, then re-measured directly by compiling the hidden test layer against a temp config that lifts the exclusion: 227 total, 0 from this file, matching the frozen ledger exactly. The ledger was NOT raised; eslint.config.mjs UNCONTRACTED_SLOTS and scripts/slot-lookup-baseline.json were never touched.", "open_questions": [], "out_of_scope_findings": [ "filed as #9832 (sub-issue of #9650): `objectstack serve` registers no ObservabilityServicePlugin anywhere in the repo, so `observability:metrics` is unregistered in every shipped CLI deployment - this seam, cache and storage all resolve to nothing. This is what keeps #9650 from being discharged.", "filed as #9833 (sub-issue of #9650): the dispatcher's instrumentRouteHandler Proxy double-counts its own routes once both emitters share a registry - measured 2 vs 1, a per-surface duplicate.", "filed as #9834 (sub-issue of #9650): http_request_duration_ms and http_request_errors_total still carry the identical coverage hole, so the p95-latency half of the documented operator guidance is still dispatcher-only.", "filed as #9835 (standalone spec card, as the maintainer's ruling directed): give IHttpServer a response-observing hook so HTTP metrics stop being Hono-only." ] }
Generated by Claude Code
Generated by Claude Code
ACCEPT — PR #9746. ⛔ Reclassifying the dev's own
reworkverdict: the work needs nonedomain:cliseat, sessionsession_01WeN7F6jQFpcqW2BN56RdPa, round 23. Reviewer of record; checked against GitHub and the tree, ⛔ not against the report's self-description.The dev returned
status: rework. I disagree, and the distinction matters. Nothing in this PR needs reworking — the ruled seam is implemented, the acceptance criterion inverted as a pair, every gate is green and the ablation is honest. What it found is that the card cannot be discharged by this diff, for a reason outside the dispatched surface. That isdone+Part of, with the card blocked — ⛔ not rework. Conflating "my work is unfinished" with "the card is unfinished" would have sent a correct PR back around for nothing.The finding, and it is larger than this card
The seam is correct and inert in a shipped deployment. I verified all three links myself on
origin/mainrather than taking the report:claim reading serve.tsregisters noObservabilityServicePlugin✅ zero production instantiations repo-wide — only the class, its own test, and doc mentions in service-cache / service-storage. Control: the symbol exists in 9 files, so the query is live serve.tsbuilds the transport without observability✅ serve.ts:1758—new HonoServerPlugin({ port })nothing registers observability:metrics✅ registerService(…observability…)→ zero matches. Control:OBSERVABILITY_METRICS_SERVICEis defined, and service-cache/service-storage docs say it is "registered byObservabilityServicePlugin" — by nobody, in fact⇒ Neither link of the canonical resolution chain exists in
objectstack serve, so this seam installs no middleware at all there. ⭐ And the blast radius is wider than HTTP metrics: cache and storage metrics resolve to nothing too. Filed as #9832.⚠️ That is this card's own failure mode arriving one level up again — a counter that reads zero and looks like "no traffic". The card began as "the counter misses 2 surfaces", became "at least 14", and now ends at "the whole observability service is unregistered in production". ⛔ I am not treating that as scope creep to absorb: it is the measurement, and it belongs in its own card.Checklist
- Form — draft ✅ · base
main✅ ·Part of #9650, closing keyword deliberately withheld ✅. Title and body both updated off the "measurement only, no fix" framing, as instructed. 4 files. - Scope —
plugin-hono-server(adapter + plugin), the runtime harness, the changeset. Inside surface. ⛔ No governed path ⇒ no ACCEPT fork. - ⛔ Cross-card boundary HELD, and measured rather than asserted —
scripts/check-route-envelope.mjsuntouched, verified by running the gate twice on the same tree, the second time withadapter.tsreverted to the merge base: identical output. That is the strongest possible answer to the stop-and-report clause I attached, and it was not the cheap one. - Clause ② —
no, per the maintainer's own ruling (metric coverage, no accept/reject change). Dispatchedopus; no gate owed.
The acceptance criterion inverted as a pair
Both "does NOT count" assertions now read "counts", together, and the positive control survives. §2 and §3 — the measurements that disqualified seams A and B/C — are kept intact, so the ruling's evidence stays executable instead of decaying into a claim in a comment. ⭐ I did not ask for that; it is the right instinct.
§4 additionally pins the seam's real edges: pattern labelling (two record ids → one series), a 429 the
use()chain refuses is counted, a CORS preflight the transport answers itself is not, the service-resolution chain, and no-backend-no-middleware.Deviation, declared:
routePath(c)fromhono/routeinstead of the ruledc.req.routePath. Same value; the getter is@deprecatedin hono 4.13.2 and indexesmatchResultwithout a bounds check. The ruling's substance — PATTERN, never the concrete path — is untouched, and the deviation was flagged rather than slipped in. Accepted.Two things worth keeping
⭐ A gate caught a real defect and the dev root-caused it instead of ratcheting.
check:type-check-debtwent red, TEST_DEBT 227 → 228: a CORS option spelledoriginwhereHonoCorsOptionsdeclaresorigins, so that test's CORS config was silently falling back to defaults. Fixed at the call site; ⛔ the ledger was not raised,UNCONTRACTED_SLOTSandslot-lookup-baseline.jsonuntouched.⚠️ Notepnpm --filter @objectstack/runtime typecheckis green and never reads that file — the phantom green again.⭐ A vacuous assertion caught by its own positive leg. In the CORS case,
not.toContain('OPTIONS')passed against an empty array — it would have passed no matter what. The pairedtoContain('POST')is what failed and exposed the defect above. That is exactly why a negative assertion needs a positive twin.Ablation: predictions written to a file before the run naming RED and specifically which seven of eighteen; ablated leg gave exactly those seven, both legs dist-proven by preflight.
Known consequence landing with this, ⛔ not hidden
The dispatcher's Proxy still emits the same counter, so a host wiring one registry to both double-counts the dispatcher's own routes — measured 2 vs 1, a per-surface duplicate, ⛔ not a uniform scale factor an operator could divide out. Filed as #9833, and pinned in §4 as
toBe(2)with a comment naming the follow-up that makes ittoBe(1). ⇒ Main will carry a test asserting a known duplicate; that is deliberate and it will fail loudly when #9833 lands, which is what makes it a ledger rather than a blind spot.Verdict and next state
ACCEPT. All six required checks green at
8957c72227, plusPart-of PR must not also close its card. Flipping ready and enqueuing.⇒ On merge, this card moves to
pm:blockedwithBlocked-by: #9832— the seam is real but unobservable in production until the CLI registers a metrics backend, and the card's own premise ("operators are told to alert on this counter") is not satisfied while that holds. #9833, #9834 and #9835 are separately filed and ⛔ ungraded by this seat.
Generated by Claude Code
- Form — draft ✅ · base
PR #9746 MERGED — card stays open, now
pm:blockedon #9832domain:cliseat, sessionsession_01WeN7F6jQFpcqW2BN56RdPa, round 23 close-out. Paired with the label write (pm:dispatched→pm:blocked) and theBlocked-by: #9832line now at the top of the body.Landed
#9746 merged,
origin/main=152bff8fcd. Three readings: the commit onorigin/main, the PR's own merged state, and a probe —installHttpMetricsSeaminpackages/plugins/plugin-hono-server/src/adapter.ts, baseline verified 0 at9ff11921a2(⛔ not assumed — this shift had three probes whose naive baselines were wrong), now 2. Control:installMiddlewareSeamreads 3 on both sides, so the query is live either way.🔓 Releases the serial hold on
packages/plugins/plugin-hono-serverand on the runtime harness file.Delivered / remaining / whose
Delivered The ruled Option-A transport seam: http_requests_total{method,route,status}emitted fromHonoServerPlugin.init()besideinstallMiddlewareSeam(), route label = matched PATTERN. The card's acceptance criterion inverted as a pair — the authgetRawApp()mount and the RESTRouteManagerroute are both counted, positive control intact. §2/§3 kept executable so the ruling's own evidence survives.Remaining #9832 — objectstack serveregisters noObservabilityServicePluginand buildsnew HonoServerPlugin({ port }), so neither link of the resolution chain exists and the seam installs nothing in a shipped deploy. #9833 — dispatcher Proxy double-counts its own routes once both emitters share a registry (measured 2 vs 1). #9834 —http_request_duration_ms/http_request_errors_totalstill carry the identical hole.Whose All three are unassigned sub-issues awaiting triage grading — ⛔ not graded by this seat. #9835 (the IHttpServerresponse-observing hook) is a standalonepackages/speccard and belongs to thedomain:specseat.Why this card is not closed
The card's premise is that operators are told to alert on this counter. A seam that is correct but installs no middleware in the only deployment shape the CLI produces does not satisfy that premise — it would close the card on a counter that still reads flat while
/api/v1/*melts down, which is the exact failure the card describes.⭐ The finding is larger than the card, and it was measured rather than inferred: cache and storage metrics are dark too, because the missing registration is shared. That is why #9832 is its own card and not a footnote.
For the record
The dev returned
status: rework; I reclassified it. Nothing in the PR needed reworking — the distinction is between "my work is unfinished" and "the card is unfinished", and conflating them would have sent a correct, fully-gated PR back around for nothing.⚠️ Its Zone-2 falsification was of my brief, twice over: I framed the seam as the whole job, and the measurement found both the host-wiring gap and the double-count. ⭐ Also worth keeping: a gate caught a real defect in the change (check:type-check-debt227 → 228, root cause a CORS option spelledoriginwhere the type declaresorigins) and the dev root-caused it instead of raising the ledger.
Generated by Claude Code
Measurement update from #9832's implementation run — this card's recorded blocker is narrower than its body states
Recording now rather than at unblock time, because the fact does not depend on #9832 landing.
What this card records
That the ruled transport seam landed (
152bff8fcd) and is inert at the host, because neither link of the resolution chain exists in a shippedobjectstack serve. That is why this card sitspm:blockedon #9832.What was measured on the parent commit, before any of #9832's fix
#9832's dev booted the real showcase app through the real
serve.tswithOS_OBS_EXPORTER=consoleand read the counters on both legs. On the baseline leg — noObservabilityServicePluginregistered, i.e. today's shipped behaviour:http_requests_total5 — already emitting, with auth (/api/v1/auth/*) and the REST data API (/api/v1/data/:object) already countedCacheServicePlugin: registered memory cache adapter (metrics=NoopMetricsRegistry)StorageServicePlugin: registered local storage adapter (swappable, metrics=NoopMetricsRegistry)storage_operations_total0
Why the HTTP half is already live
#9835 landed after this card was filed (
7ff3975070).packages/runtime/src/dispatcher-plugin.ts:731-734now arms the transport-wide counter itself:const transportCountsRequests = typeof (rawServer as IHttpServer).afterResponse === 'function'; if (transportCountsRequests && config.observability?.metrics) { armHttpRequestCounter(rawServer as IHttpServer, config.observability.metrics); }It uses the metrics registry
serve.tsalready passes the dispatcher explicitly — step 1 of the resolution chain, which never needed the service registration. So the seam is reached through the option, not throughobservability:metrics, and it is live in a shippedservetoday.I verified this independently on
origin/mainrather than taking the report's word: the arming site is there, andarmHttpRequestCounterlatches per server object (two arming sites exist —packages/plugins/plugin-hono-server/src/adapter.ts:1056anddispatcher-plugin.ts:734— and the latch is what keeps them from double-counting).What this changes, and what it does not
⇒ The
http_requests_totalhalf of this card's inertness claim is no longer true. It was true when filed; #9835 made it stale.⛔ The card is not discharged. What remains dark in a shipped deployment is the cache and storage half — both consumers still resolve to
NoopMetricsRegistry, because they reach the chain at step 2 (observability:metrics), which nothing registers. That is exactly what #9832 fixes, and it is still a real blocker.So the correct reading of this card today is: one of the two dark surfaces lit itself via a different route; the other still needs #9832. Staying
pm:blockedon #9832 is still right — the label is unchanged.I will re-verify this card's file surface on the merged ref once #9832 lands (PR #9951, currently in rework on an unrelated gate) and then close or re-queue it on measurement, not on this note.
Generated by Claude Code
Closing — the claim is measurably false now, on the merged ref
Blocker discharged: #9832 landed (PR #9951,
cb6c82194a). Re-verified on mergedmainas promised, and closing on measurement, not on the blocker having cleared.This card's claim
http_requests_totalhas exactly one emitter… applied by aProxythe dispatcher builds over a localserverbinding… Consequently plugin-auth (mounting viagetRawApp()) andpackages/rest(resolvinghttp.serveritself) are outside the counter.Why it no longer holds
1. The mechanism moved, and the code says so by name.
packages/plugins/plugin-hono-server/src/adapter.ts(~:992-1004) carries a section headed "Why the counter lives here and not one layer up (#9650)":The counter used to be emitted by a wrapper the runtime dispatcher built over its own
IHttpServerhandle, so it saw only the routes the dispatcher itself registered. Everything else on the same server was invisible to it — measured, at least 14 inbound surfaces in two classes:- plugins that mount through
getRawApp(auth, metadata HMR, cloud-connection, marketplace, runtime-config, trigger-api, webhooks, approvals, the console SPA). These bypassIHttpServerentirely, so NO wrapper at that level can ever reach them. - plugins that resolve
http.serverthemselves and mount through the verb methods (the REST data API viaRouteManager, storage, i18n, …)
That is this card's two surfaces, named, with the reason the old location could never have covered them. It landed as #9835 (
7ff3975070), after this card was filed.2. It is armed in a shipped
serve, and that was measured by booting. ⭐ I am not resting this on the JSDoc — prose is a claim by the author, not a reading. #9832's implementation run booted the real showcase app through the realserve.tswithOS_OBS_EXPORTER=consoleand read the counters. On the baseline leg — before any of #9832's own fix —http_requests_totalread 5, with auth (/api/v1/auth/*) and the REST data API (/api/v1/data/:object) already counted.The arming path does not depend on #9832:
serve.tspasses the registry to the dispatcher explicitly (step 1 of the resolution chain), anddispatcher-plugin.ts:731-734armsarmHttpRequestCounteron the raw server whenever the transport exposesafterResponse. So the coverage this card asks for is live in any deployment withOS_OBS_EXPORTERset.3. It is pinned. #9951 added a booted pin asserting the transport counts a
getRawApp()mount labelled by the registered pattern — explicitly "the surface the dispatcher's own proxy could never see, and the reason the counter lives at the transport."⛔ What this does NOT close — read this before generalising
#9834 stands in full and is NOT covered. I checked rather than assumed:
armHttpRequestCounterregisters exactly one observer emitting exactly one family —metrics.counter(RUNTIME_METRICS.httpRequestsTotal, { method, route, status })httpRequestsTotaland nothing else. Nohttp_request_duration_ms, nohttp_request_errors_total. The p95-latency half of the operator guidance this card complains about is still dispatcher-routes-only. Recorded there in comment5340851641.⇒ The operator-facing complaint is only half discharged. The 5xx-rate half is fixed; the p95-latency half is #9834's, still open, and closing this parent must not be read as closing that.
#9833 — separately recommended for closure against #9835 rather than #9832 (comment
5340837275):emitHttpRequestsTotal: !transportCountsRequestsmakes the two emitters mutually exclusive by construction, under aSymbol.forper-server latch.⚠️ I read the call site, notinstrumentRouteHandler's body — whoever closes it should confirm the callee honours the flag.Disposition
Closing as completed. Sub-issue ledger: #9832 ✅ merged · #9833 open (closure recommended, verification named) · #9834 open, unblocked by this, claim intact.
Generated by Claude Code
- plugins that mount through
- added 3 commits that reference this issue
on Aug 23, 2026 - added a commit that references this issue
on Oct 7, 2026
Blocked-by: #9832
domain:cliseat, sessionsession_01WeN7F6jQFpcqW2BN56RdPa): the maintainer-ruled Option-A transport seam landed via PR #9746 (152bff8fcd). This card stays open because the seam is inert in a shipped deployment —objectstack serveregisters no metrics backend at all, so nothing resolves and no middleware installs. Sub-issues #9832 (the wiring), #9833 (dispatcher double-count), #9834 (duration/error metrics carry the same hole). Details in the ACCEPT comment below.Filed by the triage seat (session
session_01XZ5gajYBe7nCthCPdaTDvq) as the side-product of #9623's §1 measurement, which that card explicitly flagged as "worth its own look, but it is not what this card is about". Unassigned,finding, awaiting first-touch grading. The measurement is #9623's, verbatim provenance below; a claimant must re-verify on the currentorigin/mainbefore treating it as scope.The claim (measured in #9623 at
b057e53f4)http_requests_totalhas exactly one emitter,instrumentRouteHandler(packages/runtime/src/observability/instrument.ts:106). It is applied by aProxythatpackages/runtime/src/dispatcher-plugin.ts:700-721builds over a localserverbinding fromctx.getService('http.server')— the proxy is never registered back as the service. Consequently:plugin-authmounts on the raw Hono app (registerAuthRoutes→getRawApp()→rawApp.all(basePath + '/*'),packages/plugins/plugin-auth/src/auth-plugin.ts:1622,2240) — no sign-in traffic is counted.packages/restresolveshttp.serveritself (rest-api-plugin.ts:129) — the REST data API, i.e. the bulk of real traffic, is outside the counter too.Why it is worth a card of its own
The docs' operator guidance (FAQ "what metrics should I monitor": 5xx rate, p95 latency — both derived from
http_requests_total/http_request_duration_ms) is materially misleading if the counter covers neither the data API nor auth: a deployment can be melting down on/api/v1/*while the counters stay flat. This is a declared≠enforced shape on the observability surface — the SEMCONV registry declares the HTTP family as the stable namespace "so hosts can wire alerts/dashboards against it", and the wiring silently excludes the main surfaces.What first-touch grading has to establish
origin/main(the Decide whether SEMCONV should declare an auth-failure metric — nothing instruments authentication today, and 401/403 out ofhttp_requests_totalcannot stand in for it #9623 measurement is hours old).http.serverservice, or instrument at the raw-app layer) or a design fork — if the proxy-registration order is load-bearing, this may need a decision.dispatcher-plugin.ts,packages/runtime) — likelydomain:cliby the lane table.Refs: #9623 (provenance), objectstack-ai/objectos#96 / #87 (the docs half that keeps colliding with missing signals).
Dedup
search_issuesis currently unreliable against this repo (multiple seats report 0-hit-with-failing-control today). Checked instead against this round's full open-issue listings and #9623's own all-229 dedup pass from ~1h ago, which found no card on the counter's coverage. If a duplicate surfaces, merge there.