posture

func CountersProvider ¶

func CountersProvider(taskReg tasks.TaskRegistry, lister sessions.SessionLister, mcpReg *mcpdrv.Registry) func(context.Context, identity.Identity) types.RuntimeCounters

CountersProvider returns a `protocol.PostureDeps.Counters` seam that reads live runtime state. taskReg supplies the running / background task counts for the caller's session; lister supplies the active-session count scoped to the requested identity's tenant; mcpReg supplies the healthy-MCP-connection count (server-wide, not per-identity — MCP servers are a runtime-shared resource).

The returned func never panics: a registry read error degrades that one counter to its zero value while the others still report — a posture read is a best-effort observability snapshot, never a load-bearing control path. A genuinely missing dependency (a nil taskReg / lister / mcpReg) is a wiring bug the caller must catch at boot, so CountersProvider returns a func that simply reports zeros for the missing subsystem rather than nil-panicking on first request.

a walkthrough fix: pre-fix the MCP counter was hard-coded zero (An earlier phase shipped previously F6 wired the MCP registry into the Console-facing surface). With the registry now reachable from the dev boot path, threading it into CountersProvider makes the Overview page's MCP CONNECTIONS pillar honest — it reports the actual count of `state == Online` servers, not a placeholder zero.

func DriversFromConfig ¶

func DriversFromConfig(cfg *config.Config) []types.SubsystemDriver

DriversFromConfig builds the `runtime.drivers` seam — the configured driver name per persistence-shaped subsystem. Never the DSN (CLAUDE.md §7) — the driver name only.

Like HealthFromConfig, this is the single shared implementation both the production boot path and the devstack fixture assembler consume.

func HealthFromConfig ¶

func HealthFromConfig(cfg *config.Config) []types.SubsystemHealth

HealthFromConfig builds the `runtime.health` seam from the resolved config. The in-process dev / devstack assembly is fully wired by the time the posture surface is constructed, so every persistence-shaped subsystem reports `ready`.

This is the single shared implementation consumed by BOTH the `harbor dev` / `harbor console` boot path and the `harbortest/devstack` fixture assembler — neither hand-rolls its own copy, so the fixture cannot drift from production (CLAUDE.md §17.6; a checkpoint cleanup).

func MetricsProvider ¶

func MetricsProvider(reg *telemetry.MetricsRegistry, log *slog.Logger) func(context.Context) types.MetricsSnapshot

MetricsProvider returns a `protocol.PostureDeps.Metrics` seam that projects the telemetry.MetricsRegistry's live counter snapshot onto the Protocol-shaped `types.MetricsSnapshot`.

A registry Snapshot failure is logged at Warn and degrades to an empty (but non-nil) snapshot — a metrics read failure must not fail the whole posture request, but it is never silent (CLAUDE.md §13: the failure is surfaced in the log, not swallowed).

func RetentionProvider ¶ added in v1.13.0

func RetentionProvider(bus events.EventBus, taskReg tasks.TaskRegistry, lister sessions.SessionLister) func(context.Context, identity.Identity, bool) []types.RetentionHorizon

RetentionProvider returns a `protocol.PostureDeps.Retention` seam that reports the OBSERVED oldest-retained timestamp per durable surface — the honest, forward-looking retention horizon a fleet consumer reads before issuing a windowed read. Every value is read live from the store; NONE is a configured claim (Harbor has no retention knob — the durable log is gap-free and untrimmed).

Each entry carries a `scope` marker naming the identity scope the horizon was measured at, and — for a WIRED surface — an entry is ALWAYS emitted, with `OldestRetainedAt` omitted when the surface holds no rows AT THAT SCOPE. This makes the absence of a value representable: a consumer distinguishes `scope:"runtime"` + no-timestamp ("the runtime retains nothing — trustworthy empty") from `scope:"session"` / `scope:"tenant"` + no-timestamp ("nothing at your scope — the runtime-wide truth is not observable here").

• events: the bus's runtime-wide oldest retained event (a bare wall-clock instant, no identity content), sourced through the optional events.RetentionReporter capability both V1 bus drivers implement. Always `scope:"runtime"`. A bus WITHOUT the reader seam contributes no events entry (the reader being absent is not the same as "observable and empty" — honest absence, the headless / third-party-driver path); a bus WITH the reader but holding no events emits `scope:"runtime"` + no timestamp.
• tasks: when `widened`, the runtime-wide oldest CreatedAt read through the optional identity-free reader (`scope:"runtime"`); a registry that omits that reader contributes no runtime-wide entry. Otherwise the oldest CreatedAt across the caller's session scope (`scope:"session"`).
• sessions: when `widened`, the runtime-wide oldest OpenedAt through the optional identity-free reader (`scope:"runtime"`); a lister that omits it contributes no runtime-wide entry. Otherwise the oldest OpenedAt across the caller's tenant (`scope:"tenant"`; open OR closed-but-retained — "oldest retained", not "oldest ever", since the registry's idle GC reaps old sessions).

`widened` is a SERVER-DERIVED Go input the posture surface computes from the caller's verified elevated scope and threads in — it is NEVER a wire field and NEVER read from a request body. The ordinary (non-widened) fold is unchanged apart from the new scope label — no widening, no downgrade knob (CLAUDE.md §13).

A registry read error degrades that one surface to absent while the others still report — a posture read is a best-effort observability snapshot, never a load-bearing path. A nil dependency simply omits that surface; a nil-everything seam returns nil (the whole block is omitted on the wire).