docs(skills): close storage observability gate

This commit is contained in:
Jinwoo-H
2026-08-12 12:16:58 -04:00
parent 5d6daba7d0
commit 68f5fb06a3
2 changed files with 19 additions and 1 deletions
@@ -1202,7 +1202,7 @@ physical SSH macOS and supported Windows remain open.
- [x] Add dashboards for grant/finalize/share rates, authorization and rate limits, finalization
saturation, archive rejection, and digest mismatch.
- [x] Add Cloud Run 5xx, CPU, memory, instance, and skill-route latency panels and alerts.
- [ ] Add GCS quarantine/published bytes, object count, and lifecycle failure panels and alerts.
- [x] Add GCS quarantine/published bytes, object count, and lifecycle failure panels and alerts.
- [x] Add PostgreSQL connection, storage, query latency, migration, and transaction panels and
alerts.
- [x] Add signed-policy/URL generation and IAM Credentials failure alerts. Grant-signing failures
@@ -1225,6 +1225,14 @@ visibility, budget coverage, and reviewed alert thresholds. Cloud PR `#346` pass
checks and merged as `8199c048`; it adds privacy-bounded per-route latency distributions, sustained
80% CPU/memory and near-instance-ceiling alerts, separate five-second interactive and 30-second
finalization p99 latency alerts, and a route-template p99 dashboard without bearer identifiers.
Cloud PR `#347` passed both required checks and merged as `65320475`; it adds a six-hour
aggregate-only storage inventory job, fixed quarantine/published bytes and object-count metrics,
an overdue-quarantine metric, two storage panels, and an overdue-or-job-failure alert. The monitor
identity has only `storage.objects.list`, while the scheduler can invoke only that job. The reviewed
targeted staging apply added 18 observability resources, updated the existing dashboard, and
replaced only the inert descriptor-propagation timer. A manual run emitted only aggregate fixed-
namespace measurements with zero overdue objects; the post-apply targeted plan is zero-diff, SQL
remained `NEVER`/`STOPPED`, all Relay MIG targets remained zero, and production remained disabled.
### Logging and privacy
@@ -124,6 +124,16 @@ instance pressure. Alerts require five minutes above 80% p99 CPU/memory, more th
configured instance ceiling, five-second interactive p99, or 30-second finalization p99; no bearer
URL or identifier becomes a metric label.
Cloud PR `#347` passed both required checks and merged as `65320475`. It adds a six-hour aggregate
storage inventory job, fixed-namespace bytes and object-count metrics, overdue-quarantine and job
failure alerts, and storage dashboard panels. The monitor identity has only
`storage.objects.list`; its scheduler identity can invoke only that job. A reviewed targeted
staging apply added 18 observability resources, updated the existing dashboard, and replaced only
the inert metric-propagation timer. The post-apply targeted plan is zero-diff. A manual execution
completed successfully and emitted only aggregate published and quarantine measurements, with
zero overdue objects and no identifiers or paths. SQL remained `NEVER`/`STOPPED`, all three Relay
MIG targets remained zero, and production remained disabled and untouched.
Auth deploy run `31535179937` promoted `orca-cloud-auth-staging-00017-dug` with exact staging-only
GitHub OIDC constraints, healthy JWKS, and zero deployment-window errors. API run `31535438327`
promoted `orca-cloud-api-staging-00042-hef` with `authenticatedSmoke: true` and `skillSmoke: true`.