feat(ooda): create redacted Analysis Snapshots from Run detail

[1012839419a-alt]

Parent: #96

Status: ready-for-agent

What to build

Add the Observe and Orient portion of the OODA Analysis Loop from a completed Run. An authorized operator selects a bounded UTC range, previews eligible Workflow Trace and acquisition execution counts, and explicitly creates an Analysis Snapshot. OpenCLI persists the authoritative export receipt while QuestDB receives only a disposable, redacted projection.

Support the two versioned V1 row families only: redacted Workflow Trace events and acquisition execution metrics. Provide curated time-window summaries for throughput, latency, failure rate, event type, and node behavior. The Run detail experience must show capability state, preview, progress, receipt, source range, analysis summaries, and isolated errors without exposing arbitrary SQL.

Acceptance criteria

• The public authenticated Run analysis API supports capability status, range preview, snapshot creation, receipt lookup, and curated summaries.
• Only completed Runs in the operator's authorized scope can be selected, and empty or invalid ranges are rejected.
• Export uses authoritative UTC source timestamps and deterministic source identities so repeating the same selection is idempotent.
• Workflow Trace export uses an explicit scalar allowlist and excludes messages, details, URLs, credentials, tokens, raw payloads, and artifacts.
• Acquisition export includes bounded status, capability, and duration metadata while excluding inputs, results, endpoints, and raw errors.
• OpenCLI persists a receipt with scope, schema version, status, row counts, timestamps, retention deadline, and a bounded redacted failure code.
• Export failure leaves Runs, trace events, acquisition executions, Records, Evidence, and prior receipts unchanged except for the new failed receipt.
• Curated analysis results cite their Analysis Snapshot and exact source range.
• The Run detail UI covers disabled, unavailable, unhealthy, ready, exporting, complete, empty, expired, and failed states.
• Contract and API tests prove mapping, redaction, idempotency, authorization, source-time selection, bounded schemas, and failure isolation.

Blocked by

#100

Verification evidence

• Red-green contract and authenticated API tests.
• Frontend component/integration tests through public user behavior.
• Disposable-runtime integration evidence for export and curated aggregation.
• Security scan showing forbidden fields absent from receipts, exported rows, API responses, logs, and rendered output.

[1012839419a-alt]

Implementation discovery has fixed these seams before coding begins:

• A selectable Run must have exact status completed; partial_success is not silently treated as completed.
• Workflow event occurrence time comes from the persisted event contract's UTC createdAt, not row persistence time.
• Acquisition executions currently lack a typed Workspace/Project/Workflow/Run relationship. feat(ooda): create redacted Analysis Snapshots from Run detail #101 must add an authoritative correlation seam and migration; legacy unlinked rows are excluded rather than inferred from arbitrary JSON.
• Preview/export requires identity, Workspace membership, explicit permission, and exact Project/Workflow/Run containment. Fleet authentication alone is insufficient.
• The frontend host is the Studio Project Operations Run Trace sheet, but analysis uses separate redacted endpoints and state. It must never derive exported data from the raw trace response.
• Preview/receipt responses must expose a stable snapshot identifier so state can be restored after the sheet closes.

Implementation remains blocked by #100. No lifecycle change has been made.

[1012839419a-alt]

Implemented on the isolated integration branch codex/questdb-ooda (not yet pushed/merged), through:

• eabb3d7a typed acquisition correlation + authoritative snapshot receipt migration
• 525c2435 governed Analysis Snapshot transport/service/API/RBAC/tests
• dbc39e7f bounded GEO correlation errors
• a7efe8f3 Studio Run Snapshot UI and Playwright coverage

Local integration evidence:

• Backend combined QuestDB-absence/status/Compose/migration/acquisition/RBAC/Snapshot suite: 67 passed
• Snapshot service retry/empty/redaction suite: 11 passed
• Ruff and mypy: passed
• Frontend contract regression: 9 passed
• Frontend typecheck + lint: passed
• Next.js production build: passed, 43 routes
• Production-server Snapshot Playwright: 12 passed

The implementation remains absent-safe and uses no listener, dual write, outbox, or background retry. Source facts stay authoritative in the primary DB; QuestDB receives only the explicit redacted projection.

This issue stays open until the integration PR passes CI/review and is merged. The real disposable QuestDB 10.0.1 authenticated Observe→Orient→Decide→Act path remains the explicit #104 release gate.