v1.6.0: minimum control-surface telemetry contract and OSS emitters

[jeffhuber]

Part of #1066.

Problem

Operators need transparent Slack-requested session outcomes locally and in the hosted product without uploading Slack or provider content. v1.6 needs the minimum telemetry required for owner escalation and future Operator observability, not a detailed cloud replay stream.

Scope

Produce one OSS PR that reuses the existing provider-neutral event envelope where compatible and freezes a closed, versioned control-surface session-summary contract with a Slack discriminator. Map the local Slack lifecycle into Board state and emit only compact summaries at meaningful state transitions or completion.

The summary may contain only an opaque session ID, repository alias/slug under existing policy, provider, state/outcome, timestamps, counts, coarse latency/usage when already available, owner-action category, PR metadata, privacy classification, and schema/capability version.

The paired hosted validator, storage, aggregate, retention, export, and deletion implementation remains #978. Server acceptance must precede production client emission.

Acceptance criteria

• Local Board can show current Slack-requested lifecycle state without requiring cloud access.
• Cloud emission is a compact summary, not command-by-command or message-by-message replay.
• No task, message, answer, prompt, response URL, Slack identity, source, diff, transcript, token, path, graph/context data, provider reference, or raw output is emitted.
• The closed schema rejects unknown/disallowed fields and keeps old clients compatible.
• Capability/version gating prevents emission until the hosted service advertises acceptance.
• Shared fixtures cover accepted summaries, forbidden fields, rollback, export/deletion expectations, and tenant-safe repository identity.
• No daemon, queue, webhook service, Slack interaction redesign, or new orchestration authority is introduced.

Code Mower delivery

Produce exactly one independently reviewable OSS PR. Record the builder and exact head, keep one writer, run focused and applicable full tests, obtain an independent Code Mower review, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Keep all public and cloud evidence metadata-only.

[jeffhuber]

Deferred from the owner-approved v1.5.0 release boundary to v1.5.1. This remains valuable work but no longer blocks #922 or #923. v1.5.0 still requires durable local interaction state, privacy-safe operational evidence, and provider lifecycle reconciliation; it does not require Slack-specific cloud events or Board telemetry projection.

[jeffhuber]

Roadmap decision: moved to v1.6.0. Basic Slack lifecycle is already released and remains in the v1.5.1 qualification boundary. The Slack-specific cloud schema, emitters, hosted storage/aggregation, retention/deletion, and richer cloud views will proceed contract-first after v1.5.1 reliability work completes.

[jeffhuber]

Work Order: contract-first local writer claimed

The Codex roadmap orchestrator is the single writer for #921 in isolated branch codex/921-control-surface-summary. First freeze the closed provider-neutral schema, accepted/rejected fixtures, and SHA-256 fixture manifest without touching #1083 lineage policy. Use session rather than session_id under the existing unsafe-key boundary. The existing broad benchmark envelope is not sufficient: the new event-specific validator must reject unknown and forbidden fields. Board/cloud integration will follow only after #1083 stabilizes shared observer vocabulary. Production emission remains capability-gated and disabled until #978 deploys exact-schema acceptance.