Parent: #14109 (data-integrity diagnostics runner — integration). This is slice 1 (the runnable unit); the schedule-tick that makes it live is slice 2 (resolves #14109).
Problem
The data-integrity detect-producers (coverage-drift #14075 merged; monotonicity #14094 merged; dimension #14102 in-flight) are proven by the #14046 release-gate e2e but nothing runs them live or routes their diagnoses to the recovery actuator's escalate sink. The immune system stays dormant: an "up but data-gutted" Memory Core still reports green at runtime — the exact #13999 blind spot.
Slice scope (this leaf)
A pure DataIntegrityDiagnosisService (core.Base) runner unit that:
- gathers a Chroma vector-coverage audit (injected
coverageGatherer),
- runs the coverage-drift producer over it,
- routes every emitted
recovery-diagnosis to the actuator's escalateDiagnosis sink.
Detect-only / escalate-only by construction (never reaches a privileged apply/restart/re-embed/restore/mutation). Probe-unavailable (gatherer throws) escalates nothing — a failed probe is not a drift signal. Fail-closed on a missing collaborator. All deps injected → ADR-0019-clean (AiConfig leaves read at the orchestrator use-site, not re-derived here) + unit-testable in isolation.
Out of scope (→ #14109 slice 2 + sibling producer leaves)
- The Orchestrator schedule-tick + cadence config leaf that makes it run live (slice 2 → resolves #14109).
- Per-collection history-persistence + monotonicity producer wiring (needs the runner's own history).
- Dimension-consistency producer wiring (needs Ada's dimension fact-gatherer, rides #14102).
Contract Ledger (consumed surfaces — no new public surface)
| Consumed |
Source |
Use |
buildDataIntegrityCoverageDiagnosis({coverageResult, observedAt, serviceId}) |
dataIntegrityCoverageDiagnosis.mjs |
produce coverage-drift diagnosis |
auditChromaVectorCoverage() → {collections:[{name, ok, …}]} |
checkChromaIntegrity.mjs |
the gathered fact (injected, not imported here) |
RecoveryActuatorService.escalateDiagnosis(event, {now}) |
RecoveryActuatorService.mjs |
the escalate sink (injected; class/kind-agnostic, proven by #14046) |
Acceptance Criteria
Avoided traps
- No auto-repair on a detect signal — operator-gated boundary; escalate-with-diagnosis only.
- No false-escalation on probe failure — probe-unavailable is reported, never escalated.
Related: #14109 (parent integration), #14026 (detect-signal class), #14046 (release-gate e2e), #14075 (coverage producer), #14061 (escalate sink), #14039 (v13.1 epic).
Authored-by: @neo-opus-vega (Vega, Claude Opus 4.8).
Parent: #14109 (data-integrity diagnostics runner — integration). This is slice 1 (the runnable unit); the schedule-tick that makes it live is slice 2 (resolves #14109).
Problem
The data-integrity detect-producers (coverage-drift #14075 merged; monotonicity #14094 merged; dimension #14102 in-flight) are proven by the #14046 release-gate e2e but nothing runs them live or routes their diagnoses to the recovery actuator's escalate sink. The immune system stays dormant: an "up but data-gutted" Memory Core still reports green at runtime — the exact #13999 blind spot.
Slice scope (this leaf)
A pure
DataIntegrityDiagnosisService(core.Base) runner unit that:coverageGatherer),recovery-diagnosisto the actuator'sescalateDiagnosissink.Detect-only / escalate-only by construction (never reaches a privileged
apply/restart/re-embed/restore/mutation). Probe-unavailable (gatherer throws) escalates nothing — a failed probe is not a drift signal. Fail-closed on a missing collaborator. All deps injected → ADR-0019-clean (AiConfig leaves read at the orchestrator use-site, not re-derived here) + unit-testable in isolation.Out of scope (→ #14109 slice 2 + sibling producer leaves)
Contract Ledger (consumed surfaces — no new public surface)
buildDataIntegrityCoverageDiagnosis({coverageResult, observedAt, serviceId})dataIntegrityCoverageDiagnosis.mjsauditChromaVectorCoverage()→{collections:[{name, ok, …}]}checkChromaIntegrity.mjsRecoveryActuatorService.escalateDiagnosis(event, {now})RecoveryActuatorService.mjsAcceptance Criteria
DataIntegrityDiagnosisServicegathers coverage, runs the coverage-drift producer, routes diagnoses toescalateDiagnosis.healthy, nothing escalated.escalated; adata-integrity/escalatediagnosis targeting the Memory Core compose-service is routed to the sink.apply), asserted.Avoided traps
Related: #14109 (parent integration), #14026 (detect-signal class), #14046 (release-gate e2e), #14075 (coverage producer), #14061 (escalate sink), #14039 (v13.1 epic).
Authored-by: @neo-opus-vega (Vega, Claude Opus 4.8).