teleo-infrastructure/docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.md

# GCP Leo Runtime Observability — T3 Live Read-Only

Captured UTC: 2026-07-10T16:03:00Z

## Outcome

The Console-only observability canary passed at T3_live_readonly.

teleo-prod-1 is currently running. Its serial-port output is current through 2026-07-10T15:57:54Z and proves recurring successful leoclean-cloudsql-memory-sync.service cycles. The latest exact lifecycle event for leoclean-gcp-prod-parallel.service is a Hermes service start at 2026-07-09T07:00:04Z, with no later exact stop or failure in the loaded serial buffer.

That is useful runtime evidence, but it is not full Leo parity. The current gateway PID, deployed SHA, profile, model/auth, Telegram identity, selected canonical DB backend, and safe no-post handler route remain unproven.

Required tier: T3_live_readonly

Current tier: T3_live_readonly for control/runtime observability

Overall runtime parity: partial_unproven

## Current VM

| Field | Live Console readback |
| --- | --- |
| VM / instance ID | teleo-prod-1 / 6202458246232531966 |
| Status / zone | RUNNING / europe-west6-a |
| Created | 2026-07-07 03:57:37 UTC+02:00 |
| Machine | e2-standard-4, 4 vCPU, 16 GB, Intel Broadwell |
| Image | debian-12-bookworm-v20260609, X86_64 |
| Boot disk | 150 GB balanced persistent disk, read/write, daily snapshot policy |
| Network | teleo-staging-net / teleo-staging-europe-west6 |
| Addresses | 10.60.0.3 internal; 34.65.143.148 ephemeral external |
| Service account | sa-teleo-prod-vm@t***.iam.gserviceaccount.com |
| Access metadata | OS Login enabled; UI shows full Cloud API scopes, which is not IAM authorization proof |

No full service-account identity, token, cookie, password, or raw credential was retained.

## Observability And Logging

- Base CPU, network, connection, disk-throughput, and disk-IOPS metrics are present.
- Ops Agent is not installed. The page offers Install Ops Agent; memory and disk-space utilization explicitly require it. Nothing was installed.
- VM Manager is not enabled, so OS Info is unavailable. Nothing was enabled.
- Interactive serial-console access is disabled, but the existing serial-port output page is readable.

The exact VM filter returned 92 Cloud Logging records over seven days:

- severity: INFO 82, NOTICE 5, DEFAULT 4, ERROR 1;
- seven distinct log names;
- visible top sources: GCEGuestAgent 53, GCEGuestAgentManager 26, diagnostic-log 4, and shielded-VM integrity 3.

Exact runtime search:

    resource.type="gce_instance"
    resource.labels.instance_id="6202458246232531966"
    (SEARCH("leoclean") OR SEARCH("hermes") OR SEARCH("gateway") OR SEARCH("postgres") OR SEARCH("teleo-kb"))

Result: 0 entries over seven days.

Adding SEARCH("systemd") returns five INFO records, all boot-time network/login/SSH initialization. It does not surface a Leo application or gateway record.

Precise interpretation: guest/platform logs are ingested, but Leo application/systemd journal logs are absent from Cloud Logging. The missing Ops Agent is consistent with that gap. Serial output independently contains Leo unit activity.

## Sanitized Serial Evidence

The loaded serial-port-1 buffer contained 3,304 lines, from 2026-07-09T04:00:21Z through 2026-07-10T15:57:54Z. Raw lines were not retained.

Observed unit names:

- leoclean-cloudsql-memory-sync.service
- leoclean-gcp-prod-parallel.service

Current memory-sync evidence:

- latest successful finish: 2026-07-10T15:57:54.094689Z;
- next start: 2026-07-10T15:57:54.111434Z;
- safe systemd description: syncing the leoclean Hermes state database to the current Cloud SQL snapshot.

Gateway-unit evidence:

- 30 exact unit lifecycle lines;
- repeated stop/start cycles on July 9;
- latest exact event: started at 2026-07-09T07:00:04.363359Z;
- no exact failed event and no later exact stop in the loaded buffer.

This supports “last known started and not subsequently stopped in serial evidence.” It does not replace a current PID, systemctl, process, or deployed-SHA readback.

## Exact Claim Ceiling

VM/control-plane: current and live-proven.

Serial lifecycle/sync: current within the loaded 2026-07-09T04:00:21Z–2026-07-10T15:57:54Z timestamp window.

Gateway active state/PID/SHA/model/auth/DB rows: still unproven.

No-post Cory canary: not safe to run and not attempted.

## Corrected VPS Baseline

The VPS deploy checkout and stamp fast-forwarded to 771679061f0a0b6463fb7d9cf530eb9d2d4e5440 between 15:53:13–15:53:20Z.

The journal says “No Python changes — services not restarted.” The merge has no delta under the Leo bin/skill paths. Gateway remains PID 2999690, NRestarts=0, started 03:47:11Z; DB count tuple remains 1837/4145/4670/4916/17/26; the apply worker remains disabled/inactive.

This is source-checkout synchronization only—not a Leo runtime behavior change, deployment of PR #72 to GCP, or production permission migration/application.

## Cleanup

- No SSH, IAP, Cloud Shell, password, OTP, key, IAM, metadata, DB, service, deployment, or Telegram action occurred.
- Ops Agent, VM Manager, and serial-console access were not enabled.
- PR #72 source auto-synchronized to the VPS checkout, but it did not restart or change the VPS Leo runtime. Its GCP deployment status is unproven because no GCP SHA was available.
- The agent-created Console tab was finalized and closed.

## Evidence

- outputs/gcp-leo-runtime-observability-current.json
- /Users/user/Documents/Codex/2026-07-10/leo-gcp-control-plane/outputs/gcp-cloud-sql-t3-live-readonly-current.json