Complete CAAM controls and add a provenance-aware observability hub

[Mjones13]

Scope

CodexBar environment controls and a provenance-aware Overview, Accounts, Systems, and Work hub in
Codex preferences. This PR is the base of native GitHub stack steipete#10 (#2 → #4 → #5 → #6), against the Jones Systems fork. M Jones subsequently authorized updating and merging the complete stack after its checks pass. Release, deployment, host-service changes and live account switches remain outside this source delivery.

Implementation

Typed plans/results and validation; execute-once confirmation; revision, expiry, capability,
eligibility, and freshness gates; distinct fallback and interrupted-operation recovery; same-operation
lookup for unknown effects; private bounded restart-safe intent receipts persisted before launch;
asynchronous coordination; bounded stale-while-revalidate display state. Production mutation
qualification remains empty pending independent CAAM conformance for exact environment configurations.

The local aggregation layer separates CAAM service/account state, provider usage/API cost, and host
resources. It preserves source, time, confidence, currency, reporting window, and estimate/metered
provenance. There is no combined spend or utilization total. Work detail is lazy and capped at 100
historical session records, never described as live jobs. Inputs are existing memory publications,
not new credential reads or session scans.

No Netdata API contract or collector is evidenced in the repository. The facade reports unsupported
telemetry with absent measurements and offers validated user-entered dashboard navigation only.
Nothing is installed, modified, or collected from Netdata.

Verification

• Passed locally: catalog helper tests, 5/5; feature catalog coverage, 111 literal keys across
  23 catalogs with matching placeholders; 192 documentation links; current documentation index;
  complete-diff whitespace checks. The 73 new locale keys are labeled English fallbacks, not translations.
• Local native checks blocked: make test exited 2 because Swift is absent, before discovery;
  make check exited 2 because plutil is absent, before native parsing/formatting/linting.
  No tools were installed on the bound host.
• Swift fixtures: 29 new cases (24 Linux core, 5 macOS coordinator), not executed locally.
  Native Linux build/test outcomes are tracked in the PR checks. Existing draft policy skips macOS
  native tests; macOS compilation, rendering, and UI proof remain unverified.
• CI remediation: the first run found 40 serious lint violations in touched files.
  Commit 76616f4b8cfea3aa65fc23c60a8992e0b5af365e addresses every reported category: guard parentheses,
  mixed multiline arguments, missed line lengths, and fixture UTF-8 conversion. Portable checks passed
  again. The native CI lint rerun passed on that implementation HEAD, at
  https://github.com/Jones-Systems/CodexBar/actions/runs/34002533888/job/101403882429.
  This is Linux lint, not macOS SwiftFormat or rendered UI evidence. The first run was
  superseded/cancelled by the normal push; the remediation run is
  https://github.com/Jones-Systems/CodexBar/actions/runs/34002533888. Final-head check status is
  authoritative; no unobserved native pass is claimed.
• Fixture repair during diagnostic audit: run 34002864831 completed with lint/musl success but
  Linux test compilation failed on both architectures: a fixture omitted the required configuredPath
  argument. Commit 4885a8414396889ed799c4a35263154ceb5aa5a2 supplies configuredPath: nil, without
  changing production code. Native rerun: https://github.com/Jones-Systems/CodexBar/actions/runs/34003546574.
  Both ARM64 and x64 release build, Swift-test, and CLI smoke jobs passed on that repair HEAD.
  Each platform reported 507 tests in 71 suites plus a separate 8-test/1-suite run passing.
  Musl also passed at 01:29:29Z. The aggregate job then exited 1 with
  macOS Swift tests are required but deferred; aggregate CI remains incomplete.
  This is the repository's deliberate draft gate (C16), not a remaining Linux failure.
  macOS native tests remain skipped; the later diagnostic commit changes documentation only.

Diagnostic audit

The existing Work Note now contains C1-C16: 16 incident families, 12 resolved and 4 open. Repeated
attempts and truncated reads are preserved within their stable incident IDs. The audit distinguishes
native process exits from connector-wrapper success, stream bytes from rendered token counts, and
original effects from workaround effects. Missing timestamps/native envelopes are explicitly unavailable,
not reconstructed. No raw workspace handle, credential, protected environment value, private transcript,
or raw log is included. The report passes a bounded field/public-safety scan and complete-diff self-review.

Open items: external CAAM evidence (C2), local Swift (C5), local plutil (C8), and the intentional
aggregate gate while required macOS tests are deferred (C16). The draft state and CI policy are preserved.
C14 is resolved by native test reruns on both architectures. C2 is the highest-impact open incident
because it blocks production conformance qualification. No unreconciled possibly effective repository write prevents publication.
The audit also records and resolves its own helper rejection and completeness-check failures. Public
GitHub documentation corroborates the existing REST-update workaround for deprecated GraphQL fields;
only native readbacks establish this project's actual effects. No additional branch, worktree, PR, or merge.

Sequential self-review

One agent performed correctness, security, maintainability, and bounded-resource self-review, not
independent review. Remediations include exact-configuration qualification, same-UUID reconciliation,
persistence before dispatch, sequential receipt writes, stale-generation suppression, retained
original-target lookup, avoiding credential-adjacent display helpers, test-process no-launch defaults,
and restart-idempotent catalog maintenance. No measured performance or rendered UI proof is claimed.

Remaining gates

The pinned read-only CAAM dependency is
work/caam-codexbar-gateway@8fdf44a1c2c3af0d36b934d79725608945790f32. Its attempted external read was
platform-blocked; no external response was obtained. The accepted CodexBar v1 contract remains the
authority without a cross-repository conformance claim. CAAM activation, native platform evidence,
translation review, and a future evidence-supported Netdata collector remain separate gates.
Credentials, live accounts, host services, upstream repositories, and other worktrees were not modified.

Delivery and incident evidence

Task branch: work/caam-codexbar-observability-hub. Implementation/remediation commits:
425b0a8ea64c992ed6d2254b56f4e715260d9249,
db5e39a36be393724d6efbd85addc5085054a098,
76616f4b8cfea3aa65fc23c60a8992e0b5af365e, and fixture repair
4885a8414396889ed799c4a35263154ceb5aa5a2.
Original delivery checkpoint: 443071c8c704b1102ce27f417dcef81e0d9fe912.
The follow-up diagnostic checkpoint changes only the same Work Note, on top of the fixture repair.
Final diagnostic commit / branch HEAD: 0bdf8a262bc9342d9b62a5f12f8062db22273b50.
It was normally pushed; the worktree was clean. Final report validation passed: 67,304 bytes within
the 72 KiB bound, 16 unique incident entries, 12 resolved / 4 open, required field families present,
and prohibited-literal scan clear. This document-only HEAD does not imply new macOS test evidence.

The single Work Note
contains exact outcomes, self-review dispositions, and bounded redacted incidents C1-C16 under
Connector and runtime incidents, including native statuses, effect reconciliation, and workarounds.
The engineering specification is revision 2; the accepted wire contract is unchanged.

Canonical main was fetched again during the audit and remained d6e929cd736eccae187cd41ddb5305a670afb2c8, reachable from
the task branch. Only this branch was normally pushed. No rebase, reset, force push, main push,
upstream PR, or PR merge occurred.

Current stack delivery

On October 7, source 2f4a3f7 backported only the six-file formatting correction from ada1598 to its earliest affected layer. This addresses macOS formatter diagnostics seen on PR #4 run 37610484066. Parent updates propagate the correction upward using merge commits; no history rewrite or individual stack-layer merge is used. This thread (718b02d7-0d4b-4670-b05f-57a5db28178d) owns this bounded repair and stack delivery.

The diff whitespace check passes. Local make check is blocked by missing plutil; make test is blocked by missing Swift. Hosted CI on the current heads remains the merge gate. Native live Mac rendering and connection acceptance remain separate from source delivery.