feat(operability): add privacy-safe People HTTP telemetry

[seonghobae]

People API operational telemetry

This PR adds an adapter-neutral, privacy-safe People HTTP request-duration measurement boundary. It emits only a bounded method, application-owned route template or None, status, duration, and bounded error type; telemetry failures never change HR request behavior.

Current authority — 2026-09-06

Exact head is 563a9c8e5485bc84444bca992902c2d74bad0471 on current protected develop@eb9757f8649aaad026a9865508d9aad50c1a7a4f. The branch advanced by an ordinary two-parent, non-force successor using the exact conflict-free GitHub merge tree for predecessor 3d3fd3c57b76855c8e394eb7067af30c3063c13d plus protected #161. The resulting workflow inventory keeps only canonical foundation-ci.yml and path-scoped recovery-rehearsal-quality.yml; no retired package-local workflow was resurrected.

The valid telemetry delta remains unchanged: bounded application-owned route templates, no raw URL labels, value-minimized failure logging, best-effort telemetry that cannot become HR request authority, and explicit omission of exporter/dashboard/SLO claims. All currently visible review threads are resolved. Formal reviews remain COMMENTED-only; no qualifying independent approval exists.

Historical predecessor evidence remains causal only and does not transfer to this successor.

Exact-head acceptance

Current PR-triggered exact-head runs are terminal:

• Foundation CI 34023751062 — SUCCESS. Exact checkout, explicit ubuntu-24.04 runner contract, foundation/provenance validation, reviewed toolchain, owned unit/service contracts, isolated PostgreSQL contracts, and read-only checkout proof all passed.
• Security Scan 34023751109 — SUCCESS.
• SAST Semgrep 34023751123 — SUCCESS.
• CodeQL PR 34023751107 — FAILURE at the central verdict handoff, not an Orgmetra source/SARIF finding. Language detection succeeded. Both Python job 101468106306 and Actions job 101468106331 successfully executed Request current-head CodeQL scan dispatch, then failed only at Release runner or enforce current-head CodeQL verdict.

No leaf fallback, synthetic verdict, or no-op retrigger is introduced for the central CodeQL control-plane failure. Foundation/Security/SAST GREEN does not authorize a Ready transition while the required CodeQL verdict and qualifying independent review are absent.

This PR also does not claim the follow-on #257 buyer path: actual middleware wiring, exporter/collector isolation, cancellation/connection-cleanup E2E, and measured p95 <= 20 ms remain separate acceptance work.

Keep the PR Draft. Do not self-approve, use routine administrator bypass, transfer predecessor evidence, weaken a gate, or change the privacy/cardinality boundary to make telemetry easier to ship.

[coderabbitai]

📝 Walkthrough

Walkthrough

People API에 저카디널리티 HTTP 텔레메트리 미들웨어를 추가했다. 메서드와 라우트를 제한하고, 요청 처리 시간·상태·오류 유형을 기록한다. 예외와 내보내기 실패를 요청 처리와 분리한다. 관련 요구사항과 회귀 테스트를 추가했다.

Changes

People API 운영 텔레메트리

Layer / File(s)	Summary
텔레메트리 계약과 ASGI 미들웨어 docs/traceability/people-api-operational-telemetry.md, docs/doctoring/people-api-operational-telemetry-references.md, services/people-api/src/orgmetra_people_api/telemetry.py	HTTP 메서드와 People 라우트를 정규화하고, 요청 지속 시간·상태 코드·제한된 오류 유형을 측정한다. 비HTTP 스코프는 전달하며 텔레메트리 실패는 요청 결과를 변경하지 않는다.
텔레메트리 회귀 검증 services/people-api/tests/test_operational_telemetry.py	라우트와 메서드 제한, 의존성 검증, 응답 상태 처리, 다운스트림 예외, 누락 상태, exporter 오류, 비HTTP 스코프 및 측정값 유효성 검사를 추가한다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🔵 Low · up to 8f43f

The new telemetry boundary can currently reject a People request if its injected clock fails, despite telemetry being intended as best effort. This is a bounded availability risk requiring owner awareness or a small follow-up; the reported checks otherwise pass.

Sequence Diagram(s)

sequenceDiagram
  participant ASGIClient
  participant PeopleHttpTelemetryMiddleware
  participant DownstreamASGIApp
  participant PeopleMetricSink

  ASGIClient->>PeopleHttpTelemetryMiddleware: HTTP 요청 전송
  PeopleHttpTelemetryMiddleware->>DownstreamASGIApp: 정규화된 요청 전달
  DownstreamASGIApp-->>PeopleHttpTelemetryMiddleware: 응답 상태 또는 예외 반환
  PeopleHttpTelemetryMiddleware->>PeopleMetricSink: 요청 측정값 기록
  PeopleHttpTelemetryMiddleware-->>ASGIClient: 원래 응답 또는 예외 전달

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 2 files. (2 skipped: 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 개인정보 보호형 People HTTP 텔레메트리 추가라는 주요 변경을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/people-api-operational-telemetry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent Please review the current unchanged head against protected develop. Local exact-head verification: all owned package suites pass at 100% statement/branch coverage.