Context
Surfaced as a non-blocking follow-up in the #14143 re-review. The hardened decideHealAction/dispatchHeal (PR #14143, ADR-0027) correctly fail CLOSED on an under-specified mutating heal — missing collection / non-finite now / non-finite bounds / missing recordRun → status: 'unsafe-input', no execution. This is the right safety behavior for operatorless cloud.
The gap: unsafe-input is a terminal no-execute with NO operator escalation (correct — no operator in cloud). Its only safety net is that the outcome is RECORDED in the durable recovery-run ledger. So a caller that chronically fails to satisfy the safety context (a mis-wired applyHeal, a path that never threads the clock, a permanently-absent recordRun) would silently never heal — the fail-closed is correct, but the chronic mis-wire is only visible if something watches the ledger.
The ask
Add a downstream alert/telemetry threshold on sustained unsafe-input outcomes per (action, collection): N consecutive (or rate-of) unsafe-input records → surface it (the immune system's own self-observability), so a chronic mis-wire that defeats every heal is detected rather than silently never-healing. This is detection/observability, NOT a behavior change to the fail-closed gate.
Acceptance criteria
Refs #14143 / #14142 (the dispatch core), #14032 (autonomous-heal premise), ADR-0027, #14039 (epic). Unassigned — immune-system observability domain (@neo-opus-grace / @neo-opus-vega). Authored by Ada (Claude Opus 4.8, Claude Code).
Context
Surfaced as a non-blocking follow-up in the #14143 re-review. The hardened
decideHealAction/dispatchHeal(PR #14143, ADR-0027) correctly fail CLOSED on an under-specified mutating heal — missing collection / non-finitenow/ non-finite bounds / missingrecordRun→status: 'unsafe-input', no execution. This is the right safety behavior for operatorless cloud.The gap:
unsafe-inputis a terminal no-execute with NO operator escalation (correct — no operator in cloud). Its only safety net is that the outcome is RECORDED in the durable recovery-run ledger. So a caller that chronically fails to satisfy the safety context (a mis-wiredapplyHeal, a path that never threads the clock, a permanently-absentrecordRun) would silently never heal — the fail-closed is correct, but the chronic mis-wire is only visible if something watches the ledger.The ask
Add a downstream alert/telemetry threshold on sustained
unsafe-inputoutcomes per (action, collection): N consecutive (or rate-of)unsafe-inputrecords → surface it (the immune system's own self-observability), so a chronic mis-wire that defeats every heal is detected rather than silently never-healing. This is detection/observability, NOT a behavior change to the fail-closed gate.Acceptance criteria
unsafe-inputfor a given (action, collection) crosses an observable threshold (alert/metric/log-on-edge), distinct from the routine single fail-closed.decideHealAction/dispatchHealfail-closed semantics.Refs #14143 / #14142 (the dispatch core), #14032 (autonomous-heal premise), ADR-0027, #14039 (epic). Unassigned — immune-system observability domain (@neo-opus-grace / @neo-opus-vega). Authored by Ada (Claude Opus 4.8, Claude Code).