Validate structured observability contracts (codex)

[numnx]

🧩 Task: Validate structured observability contracts

Automated task PR opened by Code UX for T10.

📋 Summary

Sprint: Sprint 143 · QS: Coverage Observability and CI Reliability Audit · Task: T10

Strengthen Code UX coverage observability and CI reliability through enforceable tests, workflow hardening, structured observability guarantees, security validation, and aligned operational documentation without lowering coverage thresholds.

📝 Full Task Prompt

## Objective
Strengthen observability guarantees across shared logging, dashboard realtime events, request correlation, and provider invocation records.

## Scope
- `src/shared/logging/logger.ts`
- `src/shared/logging/correlation-id.ts`
- `src/server/dashboard-realtime-websocket-server.ts`
- `src/repositories/dashboard-realtime-event-repository.ts`
- `src/server/dashboard-server.ts`
- `tests/backend/shared/logging/logger.test.ts`
- `tests/backend/shared/logging/correlation-id.test.ts`
- `tests/backend/server/dashboard-realtime-websocket-server.test.ts`
- `tests/backend/repositories/dashboard-realtime-event-repository.test.ts`
- `tests/backend/server/dashboard-server.test.ts`
- `tests/dashboard/lib/dashboard-realtime-client.test.ts`
- `docs/operations/logging-and-correlation.md`
- Current verification gap: logging/correlation tests exist, but the audit needs explicit contracts for purpose labels, debug file levels, realtime event logs, request correlation, and sanitized metadata.
- Desired guarantee: every structured log has a stable purpose label, correlation IDs propagate through HTTP/realtime paths, debug file thresholds are independent from console thresholds, realtime event records are bounded, and sensitive metadata is redacted.

## Implementation Requirements
1. Extend logger tests to cover all `LogPurpose` labels, explicit `logPurpose` precedence, inferred purpose fallbacks, redaction of nested sensitive metadata, and independent console versus debug file level filtering.
2. Extend correlation ID tests to cover `x-correlation-id`, `x-request-id`, array headers, blank headers, response headers, and async context propagation into nested logger calls.
3. Add dashboard server or websocket tests proving request completion logs and realtime event handling include active correlation IDs where available and do not log large payload bodies.
4. Extend dashboard realtime event repository/client tests to assert replayable versus live-only event behavior, bounded replay requirements, and meaningful failure output for missed snapshots.
5. Update `docs/operations/logging-and-correlation.md` with purpose label contracts, debug log file level behavior, realtime event logging expectations, and focused validation commands.

## Constraints
- Do not include raw provider transcripts, request bodies with secrets, API keys, authorization headers, or full realtime payloads in logs.
- Preserve existing log purpose names unless a migration is explicitly implemented and covered.
- Keep realtime event tests bounded and deterministic; avoid all-history scans.
- Do not weaken existing redaction behavior to satisfy formatting assertions.

## Verification
- `pnpm run test:backend -- tests/backend/shared/logging/logger.test.ts tests/backend/shared/logging/correlation-id.test.ts tests/backend/server/dashboard-realtime-websocket-server.test.ts tests/backend/repositories/dashboard-realtime-event-repository.test.ts tests/backend/server/dashboard-server.test.ts`
- `pnpm run test:dashboard -- tests/dashboard/lib/dashboard-realtime-client.test.ts`
- `pnpm run test:backend:coverage`
- `pnpm run lint`
- Success means structured logs, correlation propagation, debug file thresholds, and realtime event observability are enforceable and sanitized.

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.5

⏱️ Timing

Started	2026-07-06 19:03:05 UTC
Finished	2026-07-06 19:16:15 UTC
Duration	13m 9s

📊 Token Usage

Metric	Value
Input tokens	271,638
Cached input tokens	4,118,912
Output tokens	21,352
Total tokens	4,411,902
Invocations	1
Tool calls	77
Active time	11m 3s

Included usage estimate (subscription/local login): $4.06

🌿 Branch Info

Base: feature/CODUX-143-qs-coverage-observability-and-ci-reliability-audit-3
Head: task/feature-codux-143-qs-coverage-observability-and--t10-codex-mr9l89nh

---

🤖 Generated by Code UX