mgmt: operator observability + messaging + instance notice (status/stats/msg/announce/instance_notice) #94

New issue

Closed

opened 2026-07-12 00:29:51 +00:00 by robocub · 1 comment

robocub commented

2026-07-12 00:29:51 +00:00

Collaborator

Operator tooling for the open beta (planned with the operator 2026-07-12):

status (operator-only) — puppet-pool guild footprint: per-bot connected state + guild count (from the pools per-slot guilds sets), distinct-guild union, and per-guild tenant counts (nvb_config::tenant_guilds). Renders a ⚠ marker as any app approaches the Discord 100-server verification gate (tripwire ~75, warn from 60). New ControlMsg::PoolFootprint→ supervisor → newPuppetPool::guild_footprint()`.
stats (operator-only, minimal tier) — per-bridge label/owner/created/uptime (RunningBridge gains spawned_at; BridgeStatus gains uptime_secs + created) + whole-process VmRSS. Honest note: per-tenant CPU attribution needs process isolation (see Future directions).
msg <mxid> <text> (operator-only) — DM a specific user as the bot (Client::create_dm, reuses an existing DM). Audit event operator_msg.
announce <text> (operator-only) — two-step mass DM to all distinct tenant owners (skip operators): preview + recipient count, then announce confirm within 2 min. Audit event announce. For rare service notices only.
[management] instance_notice — optional string appended to the DM greeting + help (docs_line pattern), for the open-beta disclaimer + help-room pointer.

Operator-side docs: docs/operations-runbook.md (shipped 6d4a6be) already describes the intended commands.

Operator tooling for the open beta (planned with the operator 2026-07-12): 1. **`status`** (operator-only) — puppet-pool guild footprint: per-bot connected state + guild count (from the pool`s per-slot `guilds` sets), distinct-guild union, and per-guild tenant counts (`nvb_config::tenant_guilds`). Renders a ⚠ marker as any app approaches the Discord 100-server verification gate (tripwire ~75, warn from 60). New `ControlMsg::PoolFootprint` → supervisor → new `PuppetPool::guild_footprint()`. 2. **`stats`** (operator-only, minimal tier) — per-bridge label/owner/created/uptime (`RunningBridge` gains `spawned_at`; `BridgeStatus` gains `uptime_secs` + `created`) + whole-process VmRSS. Honest note: per-tenant CPU attribution needs process isolation (see Future directions). 3. **`msg <mxid> <text>`** (operator-only) — DM a specific user as the bot (`Client::create_dm`, reuses an existing DM). Audit event `operator_msg`. 4. **`announce <text>`** (operator-only) — two-step mass DM to all distinct tenant owners (skip operators): preview + recipient count, then `announce confirm` within 2 min. Audit event `announce`. For rare service notices only. 5. **`[management] instance_notice`** — optional string appended to the DM greeting + help (docs_line pattern), for the open-beta disclaimer + help-room pointer. Operator-side docs: docs/operations-runbook.md (shipped `6d4a6be`) already describes the intended commands.

robocub referenced this issue from a commit

2026-07-12 00:40:24 +00:00

feat(mgmt): #94 operator tooling — status/stats/msg/announce + instance_notice

robocub referenced this issue from a commit

2026-07-12 01:03:04 +00:00

feat(mgmt): #94 operator tooling — status/stats/msg/announce + instance_notice

robocub referenced this issue

2026-07-12 01:32:06 +00:00

mgmt: detect, notify, and (with consent) self-heal room call-permission breakage; optional bot-created rooms #95

robocub commented

2026-07-12 02:05:11 +00:00

Author

Collaborator

Shipped in v0.3.0-alpha.23, deployed to prod 2026-07-12.

status (pool guild footprint vs the 100-server gate, ⚠ from 60), stats (per-bridge uptime/owner/link-age + process RSS), msg (operator DM-as-bot via create_dm), announce + announce confirm (two-step mass DM, 2-min window, audited), [management] instance_notice (open-beta disclaimer on greeting/help).
Verification: runner clippy clean + 267 tests green (+9 new: parse arms, announce_recipients, footprint tripwire render, human_secs); live mgmt_self_serve_link PASS 64.2s incl. the new operator step (status/stats asserted, self-serve refusal asserted). Rebased over the #24 merge and re-verified before ff.
Prod: deb sha-verified, config gained instance_notice (backup taken), clean restart, management bot ready, 0 ERROR, device ids reused.
Remaining manual smoke (operator): msg @dark:nether.im test + an announce dry-run from the operator DM — the slash-of-this-feature that automation can’t click.
The CI status on the release commit shows test: failure — that run was CANCELLED (superseded by a docs push minutes later, Forgejo auto-cancel); the branch CI run passed and cargo test --workspace --locked was reproduced green on the tag.

Shipped in **v0.3.0-alpha.23**, deployed to prod 2026-07-12. - `status` (pool guild footprint vs the 100-server gate, ⚠ from 60), `stats` (per-bridge uptime/owner/link-age + process RSS), `msg` (operator DM-as-bot via create_dm), `announce` + `announce confirm` (two-step mass DM, 2-min window, audited), `[management] instance_notice` (open-beta disclaimer on greeting/help). - Verification: runner clippy clean + 267 tests green (+9 new: parse arms, announce_recipients, footprint tripwire render, human_secs); live `mgmt_self_serve_link` PASS 64.2s incl. the new operator step (status/stats asserted, self-serve refusal asserted). Rebased over the #24 merge and re-verified before ff. - Prod: deb sha-verified, config gained `instance_notice` (backup taken), clean restart, `management bot ready`, 0 ERROR, device ids reused. - Remaining manual smoke (operator): `msg @dark:nether.im test` + an `announce` dry-run from the operator DM — the slash-of-this-feature that automation can’t click. - The CI status on the release commit shows `test: failure` — that run was CANCELLED (superseded by a docs push minutes later, Forgejo auto-cancel); the branch CI run passed and `cargo test --workspace --locked` was reproduced green on the tag.

robocub closed this issue

2026-07-12 02:05:12 +00:00

robocub referenced this issue

2026-07-12 04:43:34 +00:00

mgmt: restart-window invite double-processing can auto-DECLINE a legitimate DM invite (#89a cooldown misfire) #97

robocub referenced this issue

2026-07-13 16:29:56 +00:00

ops: puppet-pool guild footprint in the nvb-watch daily digest + tripwire alert #117

robocub referenced this issue

2026-07-19 23:23:25 +00:00

fix(e2e): retry a Pass-expected scenario once on transient failure (#124) #125

robocub referenced this issue