v1.6.0: minimal CodeMower.com Slack telemetry ingestion and aggregates

[jeffhuber]

Part of #1066.

Problem

CodeMower.com must safely accept and summarize the minimum v1.6 Slack control-surface session contract before OSS clients emit it. The release does not need a dedicated Slack analytics product.

Scope

Produce one PR in the authorized CodeMower.com repository implementing the exact #921 fixtures: backward-compatible validation and ingest, tenant isolation, retention/export/deletion coverage, aggregate counts by repository alias/provider/state/outcome, and a freshness timestamp on an existing authenticated surface.

Do not add message-level replay, Slack identities, a new dashboard information architecture, rich drill-down pages, historical backfill, or detailed cost allocation.

Acceptance criteria

• Hosted validators pass the approved v1.6.0: minimum control-surface telemetry contract and OSS emitters #921 fixtures and reject unknown/disallowed fields without logging private input.
• Existing clients remain compatible and rollback preserves accepted metadata without widening the schema.
• A canary proves storage separately from a freshly observed authenticated aggregate view.
• Export, deletion, retention, revocation, and tenant isolation cover the new metadata.
• Aggregate totals reconcile with the same canary's local Board lifecycle projection.
• Production capability/version acceptance is deployed before OSS emission is enabled.
• No task, answer, source, diff, prompt, message, response URL, Slack identity, provider reference, token, personal path, graph/context data, or raw output is accepted.

Code Mower delivery

Produce exactly one independently reviewable hosted PR with one writer. Record the builder, exact head, eligible independent review, focused and regression tests, deployment revision, and sanitized canary evidence. Resolve every P0/P1/P2 finding before merge. Public tracking contains only sanitized status; private repository and operational bindings stay in the authorized record.

[jeffhuber]

Deferred with #921 to v1.5.1. It no longer blocks minimal #922 or v1.5.0 publication through #923. Keep the existing contract-first dependency on #921 when this work resumes.

[jeffhuber]

Roadmap decision: moved to v1.6.0. Basic Slack lifecycle is already released and remains in the v1.5.1 qualification boundary. The Slack-specific cloud schema, emitters, hosted storage/aggregation, retention/deletion, and richer cloud views will proceed contract-first after v1.5.1 reliability work completes.

[jeffhuber]

Cross-repository ownership reservation

The active CodeMower.com roadmap orchestrator has reconciled its current work. Active documentation PR #514 and queued setup-doc work #520 do not touch #978 ingest, telemetry schema, dashboard aggregates, retention, export/deletion, or tenant-isolation files. That lane will not assign a #978 writer or edit those surfaces before the OSS contract freeze.

#978 is therefore reserved, not dispatched. Its implementation starts only after #921 publishes the exact closed schema, canonical accepted/rejected fixture bytes, OSS source commit, and SHA-256 fixture-manifest digest. The hosted PR must vendor those bytes unchanged and assert parity. Hosted validation, storage, export/deletion/retention, tenant isolation, aggregates, freshness, and deployed capability advertisement must pass before OSS production emission is enabled.

[jeffhuber]

Frozen OSS contract for hosted #978

The contract-first checkpoint is now public on draft PR #1098:

• commit: d50254b7b6dc19c9354e564c21f7b694fae7d379
• summary schema: code_mower.controlSurfaceSessionSummary.v1
• capability version: 1
• fixture-manifest SHA-256: ddf46b4904ad7dcebe23daf76760270e05c626ffa635d30c6a32ce98468893fc

Vendor these five resources byte-for-byte from that commit:

1. control_surface_session_summary.schema.json
2. control_surface_session_summary.accepted.json
3. control_surface_session_summary.rejected.json
4. control_surface_session_summary.expectations.json
5. control_surface_session_summary.fixture-manifest.json

Hosted acceptance must bind repository identity to the authenticated tenant, reject unknown/disallowed fields with bounded diagnostics, and advertise the exact schema, capability version, and manifest digest before OSS production emission is enabled. Retention, export, deletion, rollback, tenant-isolation, and aggregate-reconciliation expectations are frozen in the expectations resource.

[jeffhuber]

Superseding frozen OSS contract for hosted #978

PR #1098 has been cleanly rebased onto current OSS main. The five contract resources are byte-for-byte unchanged, but the immutable source checkpoint is now:

• OSS PR: v1.6.0: add minimum control-surface session summaries #1098
• source commit: 99b657ae9822a689b46d21c41695a4cfb28a177d
• summary schema: code_mower.controlSurfaceSessionSummary.v1
• capability version: 1
• fixture-manifest SHA-256: 9e87c52812a49a1c72d0e0d2448661a3ef17cb8539ca8e029c6669ea9738d62e

Vendor these five files byte-for-byte from that commit:

1. src/code_mower/control_surface_session_summary.schema.json — 22,845 bytes — 2215ce1f085525de3320377f0e26e970a7db811afc6129fc5529a5cd67760c4e
2. src/code_mower/control_surface_session_summary.accepted.json — 36,946 bytes — 17b64ce2ae10baae2f3cf84a4a39f580ef912ce436387dcebfa98724477ec486
3. src/code_mower/control_surface_session_summary.rejected.json — 33,146 bytes — 418180e76d3c90aebb108ec9caa38258a0f28c380d85e898e419313756dece5c
4. src/code_mower/control_surface_session_summary.expectations.json — 1,869 bytes — 01c8e9bb26f60fb8163a69801070ab6eabeadf20c271a41455634063966c7a21
5. src/code_mower/control_surface_session_summary.fixture-manifest.json — manifest digest above

The 21 accepted fixtures, 19 rejected fixtures, closed lifecycle matrix, privacy exclusions, tenant binding, export/deletion/retention, rollback, revocation, aggregate reconciliation, and capability-advertisement expectations are unchanged. Production must continue advertising no acceptance until the hosted implementation vendors these exact bytes and passes its acceptance suite. This checkpoint supersedes the earlier d50254b7... comment and every pre-rebase checkpoint.

Rebased local evidence: 141 focused tests plus 566 subtests passed; the 13 contract tests, docs lifecycle, package-manifest checks, Ruff, privacy scan, and diff hygiene passed. Full GitHub CI is running on this exact head.

[jeffhuber]

OSS producer merged; hosted capability remains disabled

OSS PR #1098 merged after full green CI and an eligible independent Claude exact-head PASS:

• audited producer head: 99b657ae9822a689b46d21c41695a4cfb28a177d
• merge commit: 9f6a89dd717e70946fd6445ecb8c87ebf4244137
• exact-head audit: v1.6.0: add minimum control-surface session summaries #1098 (comment)
• fixture-manifest SHA-256: 9e87c52812a49a1c72d0e0d2448661a3ef17cb8539ca8e029c6669ea9738d62e

This merge does not enable production telemetry. The OSS client emits no control-surface summary unless GET /api/health advertises the exact closed capability with this digest and accepting: true. CodeMower.com must still vendor and validate the five exact resources, pass storage/tenant/export/deletion/retention/aggregate acceptance, deploy, and advertise the exact identity before the canary or v1.6 release can proceed.

[jeffhuber]

Hosted consumer merged and production capability enabled

The paired hosted implementation is now deployed from independently reviewed CodeMower.com PR #542:

• hosted merge commit: bcddaa25c633f2dcf8fa2077d6ecb8004c1d8f88
• hosted exact-head Claude audit: PASS
• hosted Code Mower gate and full CI: PASS, including the rerun database integration job
• production deployment: GitHub deployment 6581697672; Vercel production status succeeded
• two-step rollout: production first advertised the exact capability with accepting: false, then redeployed after verification with accepting: true

Current https://codemower.com/api/health advertises the exact frozen identity:

• capability schema: code_mower.controlSurfaceSessionSummaryCapability.v1
• summary schema: code_mower.controlSurfaceSessionSummary.v1
• capability version: 1
• fixture-manifest SHA-256: 9e87c52812a49a1c72d0e0d2448661a3ef17cb8539ca8e029c6669ea9738d62e
• accepting: true

The hosted implementation entry gate is satisfied. Keep #978 open until the retained v1.6.0 candidate sends the bounded sanitized Slack telemetry canary and local Board versus hosted aggregate reconciliation is recorded.

[jeffhuber]

Hosted consumer receipt is complete for the frozen producer contract.

• CodeMower.com PR jeffhuber/codemower.com#542 auto-merged at bcddaa25c633f2dcf8fa2077d6ecb8004c1d8f88 after exact-head Claude PASS, Code Mower gate PASS, and full CI PASS.
• The hosted migration ledger is aligned at 79 canonical / 79 remote with digest dec1a7338629e50e9edc5a927295736e4d74563775dd9af29bd38f8d3a234cdd.
• Production deployment dpl_HxhK4CHrYPkCCzjxS9rGjSuBG8C8 is Ready.
• Production health advertises the exact contract identity: capability schema code_mower.controlSurfaceSessionSummaryCapability.v1, summary schema code_mower.controlSurfaceSessionSummary.v1, capability version 1, fixture manifest SHA-256 9e87c52812a49a1c72d0e0d2448661a3ef17cb8539ca8e029c6669ea9738d62e, and accepting: true.
• Closed-first behavior was verified with accepting: false before enablement.
• A single sanitized metadata-only canary was accepted exactly once and is visible only in its jeff-internal tenant projection. Upload ID: 650c9bb7-2d51-4b1e-877a-7f2bdf54c174.
• Desktop and mobile production UI proof show the projected repository, provider, state, outcome, count, and freshness without widening the privacy boundary.

The hosted side is ready for normal producer emission from the immutable OSS release candidate. No source, diffs, transcripts, issue/comment bodies, prompts, raw output, local paths, auth output, or secrets were uploaded.