browser/openspec/changes/implement-durable-observability-and-remote-adapters/proposal.md

Why

The platform has typed log and artifact routes, but restart recovery is incomplete: log acknowledgements and artifact transfer state are not durable, metrics are derived on demand, and backups and restricted remote adapters have no durable ownership/audit model. This change makes those existing channels operationally durable while preserving the control/job/log/artifact priority boundaries established by earlier changes.

What Changes

• Persist log stream batches, acknowledgement cursors, retention metadata, and bounded queries across Platform restarts; keep Run local spool files retryable and recoverable.
• Persist artifact metadata, transfer sessions, chunk manifests, checksums, and content through a restart-safe bounded file-backed store; keep chunk retries idempotent and lower priority than logs/jobs/control.
• Add bounded metrics samples and backup records with retention, size limits, recovery status, and audit events; expose only safe projections.
• Add declaration-backed remote adapter requests for approved FTP/rsync/run-file/process/database/RCON operations with scoped targets, timeout/cancel/retry/fencing, and audit outcomes. No arbitrary shell, raw socket, unapproved host/credential, or bypass of Platform ownership/endpoint/session checks.
• Add Platform and Run protocol/client/runtime contracts plus platform_web safe status projections and regression coverage.

Capabilities

New Capabilities

• durable-observability: durable logs, artifacts, metrics, backups, retention, recovery, and safe query projections.
• scoped-remote-adapters: declared and authorized remote adapter execution with bounded lifecycle and audit semantics.

Modified Capabilities

• log-ingest-pipeline: durable acknowledgement and restart recovery replace the earlier in-memory service assumption.
• artifact-transfer-channel: transfer manifests and content survive restart and retain idempotent chunk/checksum behavior.

Impact

• Affects platform/, independent run/, and projection-only platform_web/ contracts/views.
• Adds dedicated domain, DTO, model, repository, service, protocol, validator, and runtime types; no Run source is copied into the main repository.
• Does not implement dependency installation, Run self-update, client-manager lifecycle, plugin lifecycle, production scaling/alerts, or real third-party AI provider integration.