Step 2.6.3: Add observability metrics for ACP runtime denylist enforcement

[coderabbitai]

Background

This issue tracks the metrics specification and implementation work deferred from Step 2.6.2 (PR #90) to Step 2.6.3.

The ACP runtime denylist enforcement introduced in Step 2.6.2 provides only tracing::warn! denial lines on podbot::acp::policy. This was flagged as an observability warning during the PR review and explicitly deferred in the exec plan's Outcomes and retrospective:

"Step 2.6.3: enrich denial diagnostics, e.g. structured stderr with a per-session counter or an OpenTelemetry-style metric so operators can dashboard denial rates without grepping logs."

Missing observability

The following metrics are absent from both the implementation and the exec plan specification:

• Blocked method attempt counters — per-session and aggregate counts of ACP method calls rejected by the runtime denylist.
• Enforcement policy state gauge — indicates which CapabilityPolicy variant (Disabled, MaskOnly, MaskAndDeny) is active for a given session.
• WriteCmd channel queue depth and send-failure metrics — bounded mpsc channel saturation and dropped-send events.
• Frame buffer overflow counters — counts of frames that exceeded MAX_RUNTIME_FRAME_BYTES and triggered the raw-fallback path.
• Distributed tracing spans — spans covering the deny decision, JSON-RPC error synthesis, and sink-task write operations.

Acceptance criteria

• Metrics are specified in the Step 2.6.3 exec plan before implementation begins.
• All five metric categories above are covered.
• Metrics are emitted via an OpenTelemetry-compatible interface (or a clearly justified alternative).
• Operator documentation is updated to describe available metrics and recommended alert thresholds.
• The observability custom check passes on the implementation PR.

References

• PR Plan ACP runtime method denylist enforcement (2.6.2) #90 (Step 2.6.2 planning artefact)
• Exec plan: docs/execplans/2-6-2-runtime-denylist.md, section Outcomes and retrospective

Raised by @leynos.

[coderabbitai]

🔗 Related PRs

leynos/netsuke#302 - Overhaul Netsuke CLI documentation contract [merged]
leynos/rstest-bdd#493 - Implement first-party harness-led attribute defaults (9.7.2) [closed]
leynos/beatcue#9 - Record object-tracking boundary (1.1.2) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!