quantmodel — Define private-pilot observability and rollback gates

Objective

Define private-pilot observability and rollback gates.

Notes: Defined credential-free static/evaluator/provider signals; forbidden telemetry and 7/90-day retention; absolute and percentage health, latency, reliability, auth, storage, and spend gates; 24h RPO/4h RTO restore acceptance; 24h live deletion with 7-day backup expiry; and a 15–20 minute fail-closed rollback rehearsal. Operator-only artifact; public UI explicitly inappropriate.

Approach

Reuses existing report research/findings/private-pilot-gates-t293.md — tables/metrics preserved verbatim via source_report pointer. Body below summarizes grounded evidence from that report and adjacent artifacts.

Files / code / data changed

No commit SHA confidently associated with t293 in sampled log [reconstructed — uncertain].
Source report: research/findings/private-pilot-gates-t293.md
Task-history entry: research/findings/task-history.json#t293

Results

Key table from source report (preserved):

Signal	Collection rule	Allowed fields
Static site/local fallback	Fetch the catalog and Custom Meta page every 5 minutes and assert the account bundle may be absent and the local workflow still loads.	Timestamp, deployed revision, HTTP status, duration, assertion result.
Evaluator readiness	Fetch `/healthz` every minute from outside the host. Assert HTTP 200, `status: "ok"`, and `remote_auth: true`.	Timestamp, region, status, duration, auth-mode boolean, service revision.
Evaluator outcomes	Aggregate structured server events into `success`, `invalid`, `unauthorized`, `rate_limited`, `busy`, `timeout`, or `internal`; chart count and latency by revision.	Timestamp, event kind, status, duration, revision, and a daily rotated HMAC of `sub` solely for per-invite diagnosis.
Database/auth	Use provider metrics for availability, connection/storage growth, backup age, and auth outcome counts. The isolation probe uses only two disposable accounts.	Aggregate counts, bytes, timestamps, project revision, and disposable opaque IDs.
Billing	Read provider budget/usage metrics daily and alert at the percentages below.	Provider/service, billing period, usage units, accrued and forecast spend.

Conclusions and metrics are in research/findings/private-pilot-gates-t293.md; see detail page for preserved tables/metrics.

Conclusions

[reconstructed — uncertain] Outcome inferred from status done and task note.

Problems / follow-ups

See source report or PR discussion for follow-ups. No unsupported follow-ups fabricated.