Repository navigation
Conversation
Read-only Resolver DNS and Network Flow Monitor observation collectors and supporting-evidence collection for the default-off diagnosis evidence loop. Presentation and pillar-prompt integration tests land with the pillar agents. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ost skips DNS binding no longer raises on inventory resources without facts, and supporting collection records supporting_host_unknown when the host account identity is absent or mismatched instead of skipping silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ery-observations-20261106
…61106' into feat/discovery-observations-20261106
…ies after them The stage deadline is recorded as incomplete only and ends collection instead of becoming dns_logs_unavailable/nfm_unavailable; provider errors stay gaps and projection defects become degraded. Started queries are still cancelled after the stage deadline while the job budget allows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…61106' into feat/discovery-observations-20261106
…61106' into feat/discovery-observations-20261106
…61106' into feat/discovery-observations-20261106
…61106' into feat/discovery-observations-20261106
Atom-oh
added a commit
that referenced
this pull request
Nov 7, 2026
* feat: bound trace observation caches and tighten agent tool contracts Bounded TTL cache for the web DNS/NFM query layers, trace instance observations in the graph, and read-only tool-contract and prompt rules for the network, cost, CloudWatch, Flow Monitor and Tempo agent tools. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: add default-off diagnosis discovery and evidence core Bounded scoped discovery, evidence admission index, workload identities, measured EC2 memory metrics, scoped member clients and report budget for the diagnosis worker, plus redaction updates, the RDS read-replica source column in the inventory sync and default-off worker IAM/env flags (diagnosis_evidence_loop_enabled, diagnosis_network_evidence_enabled). Nothing in the report path consumes these modules yet. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: harden discovery evidence before review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: disclose unconfirmed empty inventory and keep proxy bounds out of source gaps - zero inventory rows are recorded as inventory_empty_not_confirmed instead of verified emptiness - proxy discovery records its call cap/deadline as incomplete only, stops the shared budget across regions, maps provider errors to a gap and projection defects to degraded - follow_up refuses live reads once the evidence loop flag is off; both scopes require an applied DIAGNOSIS_HOST_ACCOUNT_ID - correct the unrouted-module docstring and document the flags, IAM grants and gap vocabulary in the workers reference Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require ReplicaLag for replicas and mask host-valued names in model context - an empty ReplicaLag series on a known replica is coverage loss, not an unpublished metric, so replica evidence cannot qualify as complete - redact_context masks resolver query names and hostname-shaped trace/X-Ray node names, and any AWS service DNS name inside source strings - the clock-sharing test compares the native and CWAgent query windows Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: canonicalize observed DB hosts and stop copying graph sources into each row - instance-to-DB pair validation compares trace, pair and inventory hosts through one exactEndpoint-equivalent normalization (trim, lowercase, no root dot) - stored-graph evidence rows reference coverage.graph.<class> instead of embedding the class source list, so busy graphs no longer exhaust the context byte cap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit allowlisted member roles in the dev plan guard and harden review holdback and host masking - ci_runtime_policy accepts diagnosis_member_role_arns only in the exact member AssumeRole statement and worker task env value that the variable configures - the final-review holdback reserves the heaviest review allocation, including Opus thinking headroom, regardless of the specialist's model - model context masks any whole dotted hostname (two labels or more) in values and mapping keys, keeping code-owned type/version vocabularies Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: pin the member-role plan exemption and keep discovery identities exact - the dev plan guard exemption also pins the policy role, the full ExternalId and RequestedRegion condition and the worker task family, and accepts a task definition without the member env entry - diagnosis_member_role_arns must be distinct and requires the evidence loop - db_instance_identifier and endpoint_address stay exact for CloudWatch dimensions and pair joins; _text redacts before truncating - host trace nodes without an account (or 'self') bind under host scope, and edges whose endpoints cannot be bound are disclosed as unresolved_graph_edge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: collect bounded DNS and network observations for diagnosis (#244) * feat: add bounded DNS/NFM observation and supporting collectors Read-only Resolver DNS and Network Flow Monitor observation collectors and supporting-evidence collection for the default-off diagnosis evidence loop. Presentation and pillar-prompt integration tests land with the pillar agents. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(diagnosis): tolerate facts-less inventory rows and mark unknown host skips DNS binding no longer raises on inventory resources without facts, and supporting collection records supporting_host_unknown when the host account identity is absent or mismatched instead of skipping silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep network evidence deadlines out of source gaps and stop queries after them The stage deadline is recorded as incomplete only and ends collection instead of becoming dns_logs_unavailable/nfm_unavailable; provider errors stay gaps and projection defects become degraded. Started queries are still cancelled after the stage deadline while the job budget allows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> * fix: move diagnosis IAM to managed policies and close evidence disclosure gaps - worker_diagnosis_evidence/network become customer-managed policies attached to the worker task role, keeping the role under the inline-policy quota; monitor query ARNs use one account-scoped pattern bounded by the region condition - the dev plan guard exemption now requires that policy to be attached only to the worker task role - the member path refuses a registration without an ExternalId before any STS call - stored-graph row freshness uses the configured class window; dropped non-ENI attachments are disclosed; an in-scope proxy that is not available is a gap and an unattempted cluster lookup is a bound, not an unresolved target - tests cover an absent loop flag, a None socket timeout and the CloudWatch 500-query request bound Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: fence the member-role plan exemption and keep service endpoints visible - the dev plan guard honors member ARNs only on full dev plans with the evidence loop applied, scans child-module configuration and rejects any other attachment that names the policy or has an unknown policy ARN; replacement is accepted - redaction keeps regional service endpoints (sts/bedrock-runtime/s3) and masks resource endpoints; model context keeps RDS classes and masks resolver answer IPs - X-Ray caps are disclosed before slicing, unsized resources are marked, malformed memory results degrade instead of failing collection - DNS/NFM observation windows end one publication lag before now - README flag rows, a CHANGELOG entry and corrected budget comments Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: admit the network policy attachment in the plan guard and keep lagged DNS bindable - an attachment whose policy ARN is unknown until apply is accepted only when the configuration shows it comes straight from another managed policy resource, so enabling network evidence with member roles no longer fails the dev plan - DNS binding and inventory qualification tolerate the publication lag plus the window, so a lagged window still binds to fresh inventory - DNS rows already read are kept when the stage deadline stops later log groups - the model boundary masks embedded AWS resource endpoints and IPv6 literals itself, and applies redaction to mapping keys Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require an exact reference allowlist for unknown-ARN attachments in the plan guard An attachment whose policy ARN is unknown until apply is accepted only when it is a root-module aws_iam_role_policy_attachment whose for_each references exactly one other aws_iam_policy and whose policy_arn references only each.value/each.value.arn; data sources, locals, variables, extra references and module-nested attachments fail closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: narrow confirmed observations and bound evidence eviction cost - a single-resource observation needs the full measured pressure set, so a complete CPU-only series cannot confirm a claim about memory or I/O - EvidenceIndex.model_context() is redacted by default; raw_context() is explicit - mistyped graph-state flags disqualify like metadata loss (graph-state.ts parity) - X-Ray nodes beyond their resource share mark coverage incomplete - byte-cap eviction plans removals from per-row sizes instead of re-serializing the bundle for every evicted row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: follow ADR-011 ExternalId optionality and keep self-imposed bounds out of degraded - member reads send the registered ExternalId and, per ADR-011, assume without one for first-party registrations; the member AssumeRole statement keeps only the region condition (no sts:ExternalId presence check that would block them) - supporting collectors use a private deadline sentinel: budget exhaustion is incomplete, and a provider/socket TimeoutError is a read failure - an unreadable cluster target leaves only that target unresolved instead of blanking the proxy's region Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: keep coverage completeness honest and say the evidence gates are not yet used - provider sizing rows are complete only when the provider measured memory and I/O over a full lookback and the recommendation is fresh - read-side graph caps demote the affected class coverage and its rows - the X-Ray resource share is checked against what earlier regions already used - README and CHANGELOG state that reports do not use the evidence gates until the six-pillar diagnosis that consumes them ships Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: require read-only gates beside member roles and demote every truncated graph class - the dev plan guard rejects diagnosis member roles unless remediation, integration writes, RCA write-back and diagnosis notifications are all off - a truncated graph read demotes every class present in the interleaved rows - proxies are filtered to the diagnosis scope before the four-proxy cap applies - the workers reference states the ADR-011 ExternalId contract consistently Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix: bound IPv6 redaction scanning to linear work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add bounded diagnosis collectors for existing Resolver query logs, Network Flow Monitor observations and supporting configuration sources. Admit host-network evidence only when account, region, VPC, source association and resource identities match. Preserve collection limits and incomplete coverage; DNS plus aggregated network observations remain hypotheses rather than proof of successful application or database calls.
Depends on #243; the base branch is
feat/discovery-evidence-core-20261106. This PR adds only the observation and supporting collectors plus their tests. Their configuration and permission gates are introduced by the preceding foundation PR.Validation at HEAD
99e929cee3026790a3d30d57aa1257db8df863c1:git diff --checkpassed for this stacked scope.main/dev; this feature-base PR needs a fresh review and required CI on its finaldevscope before integration.