teleo-infrastructure/docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.json

{
  "schema": "teleo.gcpLeoRuntimeObservability.v1",
  "captured_at_utc": "2026-07-10T16:03:00Z",
  "source_thread_id": "019f47af-f2cc-7c10-b928-a9283afa2621",
  "current_canary": "Open GCP VM observability and Logs Explorer for teleo-prod-1 with authuser=5 and retain current read-only Leo runtime evidence or a precise no-log result.",
  "required_tier": "T3_live_readonly",
  "current_tier": "T3_live_readonly",
  "status": "done_verified",
  "overall_runtime_parity_status": "partial_unproven",
  "strongest_claim_allowed": "teleo-prod-1 is currently RUNNING and its read-only serial-port output is current through 2026-07-10T15:57:54Z. Serial evidence proves recurring successful leoclean Cloud SQL memory-sync unit activity and shows the latest exact leoclean GCP gateway unit lifecycle event was a Hermes service start on 2026-07-09T07:00:04Z with no later exact stop or failure in the retained serial buffer. Cloud Logging has guest-agent/platform logs but zero seven-day entries matching leoclean, hermes, gateway, postgres, or teleo-kb. This does not prove a current gateway PID, deployed repo SHA, profile, model/auth capability, Telegram bot identity, selected canonical DB backend, or safe no-post handler execution.",
  "capture": {
    "surface": "authenticated Google Cloud Console through Chrome",
    "account": "b***@livingip.xyz",
    "project_id": "teleo-501523",
    "authuser": 5,
    "cli_used": false,
    "ssh_or_iap_used": false,
    "cloud_shell_used": false,
    "secret_values_captured": false,
    "raw_serial_or_log_payload_retained": false
  },
  "instance": {
    "name": "teleo-prod-1",
    "instance_id": "6202458246232531966",
    "status": "RUNNING",
    "creation_time_ui": "2026-07-07 03:57:37 UTC+02:00",
    "zone": "europe-west6-a",
    "machine_type": "e2-standard-4",
    "vcpus": 4,
    "memory_gb": 16,
    "cpu_platform": "Intel Broadwell",
    "labels": [],
    "deletion_protection": false,
    "confidential_vm": false,
    "shielded_vm": {
      "secure_boot": false,
      "vtpm": true,
      "integrity_monitoring": true
    },
    "boot": {
      "source_image": "debian-12-bookworm-v20260609",
      "architecture": "X86_64",
      "disk_name": "teleo-prod-1",
      "disk_size_gb": 150,
      "disk_type": "Balanced persistent disk",
      "mode": "read_write",
      "delete_with_instance": true,
      "snapshot_policy": "teleo-daily-7d-snapshots",
      "snapshot_schedule_ui": "daily between 03:00 and 04:00"
    },
    "network": {
      "interface": "nic0",
      "vpc": "teleo-staging-net",
      "subnetwork": "teleo-staging-europe-west6",
      "internal_ip": "10.60.0.3",
      "external_ip": "34.65.143.148",
      "external_ip_allocation": "ephemeral",
      "network_tier": "Premium",
      "ip_forwarding": false
    },
    "identity_and_access": {
      "service_account_redacted": "sa-teleo-prod-vm@t***.iam.gserviceaccount.com",
      "service_account_full_identity_retained": false,
      "cloud_api_access_scope_ui": "Allow full access to all Cloud APIs",
      "scope_is_not_iam_authorization_proof": true,
      "os_login_metadata": true
    }
  },
  "observability": {
    "platform_metrics_present": [
      "CPU utilization",
      "network traffic",
      "new connections",
      "disk throughput",
      "disk IOPS"
    ],
    "ops_agent": {
      "installed": false,
      "evidence": "The VM Observability page displayed Install Ops Agent and marked memory and disk-space utilization as requiring the Ops Agent.",
      "installation_attempted": false
    },
    "vm_manager": {
      "enabled": false,
      "os_info_available": false,
      "evidence": "OS Info displayed Enable VM Manager to view OS info.",
      "enablement_attempted": false
    },
    "interactive_serial_console": {
      "enabled": false,
      "evidence": "Connect to serial console was disabled on the VM details page."
    },
    "serial_output_readable_without_enablement": true
  },
  "cloud_logging": {
    "time_window": "P7D",
    "timezone_ui": "CEST",
    "base_query": "resource.type=\"gce_instance\"\nresource.labels.instance_id=\"6202458246232531966\"",
    "base_result_count": 92,
    "severity_counts": {
      "INFO": 82,
      "NOTICE": 5,
      "DEFAULT": 4,
      "ERROR": 1
    },
    "distinct_log_name_count": 7,
    "visible_top_log_names": [
      {
        "name": "GCEGuestAgent",
        "count": 53
      },
      {
        "name": "GCEGuestAgentManager",
        "count": 26
      },
      {
        "name": "diagnostic-log",
        "count": 4
      },
      {
        "name": "compute.googleapis.com/shielded_vm_integrity",
        "count": 3
      }
    ],
    "combined_runtime_query_with_systemd": "resource.type=\"gce_instance\"\nresource.labels.instance_id=\"6202458246232531966\"\n(SEARCH(\"leoclean\") OR SEARCH(\"hermes\") OR SEARCH(\"gateway\") OR SEARCH(\"systemd\") OR SEARCH(\"postgres\") OR SEARCH(\"teleo-kb\"))",
    "combined_runtime_query_result_count": 5,
    "combined_result_summary": "Five INFO records, all boot-time systemd network/login/SSH initialization. No Leo application or agent record was present.",
    "runtime_query_without_systemd": "resource.type=\"gce_instance\"\nresource.labels.instance_id=\"6202458246232531966\"\n(SEARCH(\"leoclean\") OR SEARCH(\"hermes\") OR SEARCH(\"gateway\") OR SEARCH(\"postgres\") OR SEARCH(\"teleo-kb\"))",
    "runtime_query_without_systemd_result_count": 0,
    "precise_no_log_result": "Over the full seven-day window, Cloud Logging contains zero entries for this exact VM matching leoclean, hermes, gateway, postgres, or teleo-kb.",
    "interpretation": "Guest/platform logs are ingested, but Leo application/systemd journal logs are not present in Cloud Logging. The missing Ops Agent is consistent with the absent application log stream, while read-only serial output independently contains Leo service events."
  },
  "serial_port_1_sanitized": {
    "interactive_console_enabled": false,
    "output_page_readable": true,
    "text_bytes_observed": 1046328,
    "line_count_observed": 3304,
    "earliest_timestamp_in_loaded_output": "2026-07-09T04:00:21.793108Z",
    "latest_timestamp_in_loaded_output": "2026-07-10T15:57:54.111434Z",
    "relevant_unit_names": [
      "leoclean-cloudsql-memory-sync.service",
      "leoclean-gcp-prod-parallel.service"
    ],
    "term_facts": {
      "leoclean": {
        "matching_line_count": 3042,
        "latest_timestamp": "2026-07-10T15:57:54.111434Z"
      },
      "hermes": {
        "matching_line_count": 1881,
        "latest_timestamp": "2026-07-10T15:57:54.111434Z"
      },
      "gateway": {
        "matching_line_count": 38,
        "latest_timestamp": "2026-07-10T12:14:52.972390Z"
      },
      "teleo-kb": {
        "matching_line_count": 4,
        "latest_timestamp": "2026-07-09T06:49:14.505121Z"
      },
      "postgres": {
        "matching_line_count": 0,
        "latest_timestamp": null
      }
    },
    "cloudsql_memory_sync": {
      "latest_finished_timestamp": "2026-07-10T15:57:54.094689Z",
      "latest_started_timestamp": "2026-07-10T15:57:54.111434Z",
      "latest_cycle_finished_successfully": true,
      "description_from_safe_systemd_text": "Sync leoclean Hermes state database to the current Cloud SQL snapshot",
      "claim": "The VM is currently executing a recurring leoclean memory-sync unit that completes successfully and starts its next cycle. This proves an existing host-to-Cloud-SQL sync path, not canonical teleo-kb DB selection or schema/count parity."
    },
    "gateway_unit": {
      "exact_unit_matching_line_count": 30,
      "latest_exact_unit_event": "started",
      "latest_exact_unit_event_timestamp": "2026-07-09T07:00:04.363359Z",
      "latest_exact_event_mentions_hermes": true,
      "failed_events_in_exact_unit_sequence": 0,
      "later_exact_stop_or_failure_present": false,
      "claim": "The latest exact gateway-unit lifecycle record in the loaded serial buffer is a Hermes service start, with no later exact stop or failure. This is indirect liveness evidence only; it is not a current PID/systemctl/process readback."
    },
    "raw_lines_retained": false,
    "secret_values_retained": false
  },
  "no_post_cory_handler_decision": {
    "safe_to_run_from_this_evidence": false,
    "handler_run_attempted": false,
    "reason": "The Console proves VM and serial-service activity but does not prove the current gateway PID, deployed SHA, leoclean profile, model/auth booleans, Telegram token/identity state, selected canonical DB backend, or a no-write harness route.",
    "missing_preconditions": [
      "current process or systemd PID and restart readback",
      "deployed repo SHA and deploy stamp on GCP",
      "profile and model/provider names with auth-presence booleans",
      "Telegram enabled/token-presence and local non-secret bot identity",
      "selected DB backend plus before/after counts",
      "verified no-post, no-profile-write, no-DB-write handler invocation and cleanup path"
    ]
  },
  "vps_comparison_corrected": {
    "deploy_checkout_and_stamp": "771679061f0a0b6463fb7d9cf530eb9d2d4e5440",
    "fast_forward_observed_utc": "2026-07-10T15:53:13Z_to_2026-07-10T15:53:20Z",
    "journal_readback": "No Python changes — services not restarted",
    "leo_code_delta_in_merge": false,
    "gateway": {
      "main_pid": 2999690,
      "nrestarts": 0,
      "started_at_utc": "2026-07-10T03:47:11Z"
    },
    "db_count_tuple_as_supplied": "1837/4145/4670/4916/17/26",
    "apply_worker": "disabled/inactive",
    "interpretation": "This is source-checkout synchronization only, not a Leo runtime behavior change and not production permission migration/application."
  },
  "delivery_context": {
    "repo_work": "merged_pr",
    "pull_request": 72,
    "gcp_deployment_status": "unproven",
    "vps_source_checkout_synced": true,
    "vps_live_leo_runtime_changed_by_pr": false,
    "gcp_deployed_sha_proven": false,
    "note": "PR #72 source synchronized to the VPS deploy checkout, but it did not restart or change the VPS Leo runtime. GCP deployment status is unproven because no GCP SHA was available."
  },
  "not_proven": [
    "current leoclean gateway PID or NRestarts on GCP",
    "current deployed repo SHA or deploy stamp on GCP",
    "current leoclean profile path",
    "current model/provider/auth capability booleans",
    "current Telegram bot identity or token presence",
    "selected canonical database/backend and row counts",
    "safe no-post Cory handler execution",
    "runtime parity with the corrected VPS baseline"
  ],
  "actions": [
    "Opened the authenticated Compute Engine VM inventory and exact teleo-prod-1 details page.",
    "Read current instance, machine, boot disk, networking, service-account, and metadata fields without entering edit mode.",
    "Opened VM Observability and verified platform metrics plus absent Ops Agent.",
    "Opened OS Info and verified VM Manager is not enabled without enabling it.",
    "Opened Logs Explorer for the exact instance ID and ran seven-day read-only searches for leoclean, hermes, gateway, systemd, postgres, and teleo-kb.",
    "Opened the already-readable serial-port-1 output without enabling interactive serial access and extracted only allowlisted unit/timestamp/count facts."
  ],
  "cleanup_readback": {
    "browser_tab_finalized": true,
    "browser_tab_disposition": "agent-created Console tab closed; no handoff tab kept",
    "gcp_writes": 0,
    "database_writes": 0,
    "service_restarts": 0,
    "deploys": 0,
    "iam_changes": 0,
    "credential_or_key_creation": 0,
    "ssh_or_iap_sessions": 0,
    "cloud_shell_sessions": 0,
    "telegram_sends": 0,
    "ops_agent_installations": 0,
    "vm_manager_enablements": 0,
    "serial_console_enablements": 0
  },
  "evidence_paths": [
    "/Users/user/Documents/Codex/2026-07-10/leo-gcp-runtime-parity/outputs/gcp-leo-runtime-observability-current.json",
    "/Users/user/Documents/Codex/2026-07-10/leo-gcp-runtime-parity/outputs/gcp-leo-runtime-observability-current.md",
    "/Users/user/Documents/Codex/2026-07-10/leo-gcp-control-plane/outputs/gcp-cloud-sql-t3-live-readonly-current.json"
  ]
}