feat(metrics): Prometheus exporter + pipeline instrumentation

.gitignore

@@ -36,3 +36,10 @@ node_modules/
 .claude/
 docs/context.md
 NOTES.md
+
+# Markdown policy: only README.md is ever pushed; everything else is local-only.
+*.md
+!README.md
+
+# Reference docs copied from backups — local-only, not pushed.
+docs/*.html

Cargo.toml

@@ -4,6 +4,7 @@ members = [
     "crates/charon-core",
     "crates/charon-executor",
     "crates/charon-flashloan",
+    "crates/charon-metrics",
     "crates/charon-protocols",
     "crates/charon-scanner",
     "crates/charon-cli",
@@ -61,6 +62,12 @@ rand = "0.8"
 # Prometheus-style metrics recorder facade
 metrics = "0.24"
 
+# Prometheus HTTP exporter — feat/22 #222 wires this into charon-metrics
+# and the supervised CLI task. `default-features = false` drops the
+# built-in tokio runtime hint so the workspace stays on our chosen
+# tokio version; `http-listener` is the only feature we need.
+metrics-exporter-prometheus = { version = "0.16", default-features = false, features = ["http-listener"] }
+
 # CLI
 clap = { version = "4", features = ["derive", "env"] }
 
@@ -71,6 +78,7 @@ dotenvy = "0.15"
 charon-core = { path = "crates/charon-core" }
 charon-executor = { path = "crates/charon-executor" }
 charon-flashloan = { path = "crates/charon-flashloan" }
+charon-metrics = { path = "crates/charon-metrics" }
 charon-protocols = { path = "crates/charon-protocols" }
 charon-scanner = { path = "crates/charon-scanner" }
 

config/default.toml

@@ -66,6 +66,27 @@ data_provider = "0x41393e5e337606dc3821075Af65AeE84D7688CBD"
 # Populated once CharonLiquidator.sol is deployed on BSC mainnet. Do not
 # add a zero-address placeholder — config validation rejects it.
 
+# ── Prometheus metrics exporter ───────────────────────────────────────────
+# Exposes `/metrics` in Prometheus text format for Grafana / Grafana
+# Cloud scraping. Port 9091 avoids the Prometheus-server default (9090).
+#
+# Binds to loopback by default so the endpoint is unreachable from the
+# public internet on a bare VPS (Hetzner CX22 firewall is permissive on
+# inbound). Remote scraping must go through a reverse proxy (nginx,
+# caddy, Traefik) that terminates bearer-token or mTLS auth — or a
+# compose-internal network, a WireGuard tunnel, etc.
+#
+# If you must bind to a non-loopback address (e.g. 0.0.0.0), set
+# `auth_token` to a non-empty shared secret; config validation rejects
+# a public bind without a token configured. The token is compared
+# byte-for-byte against the `Authorization: Bearer <token>` header by
+# the reverse proxy — the exporter itself does not yet terminate auth.
+[metrics]
+enabled    = true
+bind       = "127.0.0.1:9091"
+# Uncomment and export CHARON_METRICS_AUTH_TOKEN only if bind is non-loopback:
+# auth_token = "${CHARON_METRICS_AUTH_TOKEN}"
+
 # ── Chainlink price feeds (per chain, per asset symbol) ───────────────────
 # Only feeds listed here are polled by the PriceCache. Add more as new
 # Venus markets become relevant. Feed addresses from docs.chain.link.

crates/charon-cli/Cargo.toml

@@ -13,6 +13,7 @@ path = "src/main.rs"
 charon-core = { workspace = true }
 charon-executor = { workspace = true }
 charon-flashloan = { workspace = true }
+charon-metrics = { workspace = true }
 charon-protocols = { workspace = true }
 charon-scanner = { workspace = true }
 alloy = { workspace = true }