Freegle / Iznik / 27741

76%

push

circleci

feat(monitor-fsm): ground diagnoses in prod DB + Loki before theorising

Wrong-diagnosis post-mortems (#1103 language-detect, #1104 blank admin
mail, earlier #581/582/585) shared one structural cause: DIAGNOSE_BUG's
entire evidence base was search_code plus a test written FROM its own
hypothesis - confirmatory, not falsifying - so when the real cause lived
in production data or runtime behaviour the FSM shipped the most
plausible code-visible story and argued it well.

New read-only grounding actions (src/grounding.ts, unit-tested):
- query_live_db: single SELECT/SHOW over the live tunnel using a
  dedicated iznik_ro grant (SELECT, SHOW VIEW on iznik.* only); guarded
  in code too (statement allowlist, single statement, LIMIT cap), creds
  from .env, graceful {available:false} when the tunnel is down.
- query_loki: LogQL against PROD Loki via the tunnel (WSL gateway:3102 /
  LOKI_PROD_URL), documented with the real prod label scheme; local dev
  Loki fallback is labelled local-dev and never counts as prod evidence.

Workflow changes:
- DIAGNOSE_BUG gather phase may add grounding queries; the diagnose
  phase gets GROUND & FALSIFY: grounded data outranks source inference,
  a falsification check is recorded in the brief (groundingStatus +
  falsificationCheck fields), and an ungrounded data-dependent diagnosis
  must defer to a human rather than become a PR.
- FIX_SENTRY_ISSUE: a stack trace says WHERE it crashed; the DB/logs say
  WHY - ground before delegating, quote the evidence in the task, and
  say so in the PR body when tunnels were down.

Also folds in the pending Discourse auth switch (Api-Key header alone,
replacing User-Api-Key + Api-Username) across loop.md, postDiscourseReply
and the scan scripts.

Verified live: query_live_db returned hertford_freegle via the tunnel
with the new grant; query_loki returned prod api_headers streams; write
statements rejected; 275/275 monitor-fsm tests pass; tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M co... (continued)

13214 of 17411 branches covered (75.89%)

Branch coverage included in aggregate %.

138101 of 191572 relevant lines covered (72.09%)

37.79 hits per line