metrics

var (
	WorkspacesCreatedTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspaces_created_total", Help: "Total workspaces created"},
		[]string{"runtime", "security_level"},
	)
	WorkspacesDeletedTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspaces_deleted_total", Help: "Total workspaces deleted"},
		[]string{"runtime", "security_level"},
	)
	WorkspacesRunning = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_workspaces_running", Help: "Workspaces currently in Active phase"},
		[]string{"runtime", "security_level"},
	)
	WorkspaceRecoveryAttemptsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_recovery_attempts_total", Help: "Recovery state-machine entries by failure class"},
		[]string{"failure_class"},
	)
	// #760: recovery episodes that crossed the per-class exhaustion
	// threshold. Incremented once per episode (on the crossing), labeled
	// by failure class — the alertable replacement for the retired
	// SafeMode funnel. A non-zero rate means a workspace is stuck in a
	// failure loop that will not self-heal (the Longhorn silent-loop
	// class, which previously produced no signal at all);
	// spec.suspend=true halts it.
	WorkspaceRecoveryExhaustedTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_recovery_exhausted_total", Help: "Recovery episodes that crossed the per-class consecutive-failure exhaustion threshold (#760), by failure class. Once per episode, on the crossing"},
		[]string{"failure_class"},
	)
	WorkspaceRecoverySuccessTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_recovery_success_total", Help: "Recovery attempts that returned to Active"},
		[]string{"failure_class"},
	)
	WorkspaceRecoveryBackoffDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{
			Name:    "llmsafespaces_workspace_recovery_backoff_duration_seconds",
			Help:    "Time in recovery backoff before restart attempt",
			Buckets: []float64{5, 15, 30, 60, 120, 300, 600, 1800},
		},
		[]string{"failure_class"},
	)
	WorkspaceControllerRestartsTotal = prometheus.NewCounter(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_controller_restarts_total", Help: "Pod restarts initiated by the controller's health-check loop (distinct from user-initiated RestartGeneration bumps)"},
	)
	// #761 session-aware drain before controller-initiated pod deletion.
	// Deferred: a deletion was postponed because sessions were busy (once
	// per drain window, not per poll). Forced: deletion proceeded despite
	// busy sessions stalled beyond the drain bound. FailedOpen: statusz was
	// unreachable, so busy state was unknown and deletion proceeded.
	WorkspaceDrainDeferredTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_drain_deferred_total", Help: "Pod-deletion drains deferred behind busy sessions (#761), by deletion path. Once per drain window"},
		[]string{"reason"},
	)
	WorkspaceDrainForcedTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_drain_forced_total", Help: "Pod deletions forced despite busy sessions stalled beyond the drain bound (#761), by deletion path"},
		[]string{"reason"},
	)
	WorkspaceDrainFailedOpenTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_drain_failed_open_total", Help: "Pod-deletion drains that failed open because agentd statusz was unreachable (#761), by deletion path"},
		[]string{"reason"},
	)
	WorkspacesInRecovery = prometheus.NewGauge(
		prometheus.GaugeOpts{Name: "llmsafespaces_workspaces_in_recovery", Help: "Workspaces currently in recovery backoff (ConsecutiveFailures > 0 and not Active)"},
	)
	// #863: entrypoint agentd sha256 verification failures. Should-never-
	// fire signal — a single occurrence indicates rollout drift, node
	// corruption, or tampering. Page-on-any, not threshold.
	WorkspaceAgentdVerifyFailuresTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_agentd_verify_failures_total", Help: "Entrypoint agentd binary verification failures by outcome/node/agentd digest (verify_failed = sha256 mismatch, overlay_missing = pinned binary absent). Once per failure episode, not per restart"},
		[]string{"outcome", "node", "agentd"},
	)
	// Design 0053 §4.2: supervisor opencode sha256 verification
	// failures. Same should-never-fire semantics as the agentd counter —
	// one increment is rollout drift, corruption, or tampering with the
	// delivered opencode binary.
	WorkspaceOpencodeVerifyFailuresTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_opencode_verify_failures_total", Help: "Supervisor opencode binary verification failures by outcome/node/opencode digest (verify_failed = sha256 mismatch, overlay_missing = pinned binary absent). Once per failure episode, not per restart"},
		[]string{"outcome", "node", "opencode"},
	)
	// Design 0051 sidecar migration step 1: platform boot-phase failures
	// (init-fs operational failure, bootstrap/materialize non-zero exit in
	// the sidecar's boot phase or the legacy platform init containers).
	// High-signal — a persistent occurrence means a platform regression
	// (code or contract skew), never user load.
	WorkspacePlatformBootFailuresTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_platform_boot_failures_total", Help: "Platform boot-phase failures (init-fs/bootstrap/materialize in platform containers) by container/node. Once per failure episode, not per restart"},
		[]string{"container", "node"},
	)
	WorkspaceRecoveryDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{
			Name:    "llmsafespaces_workspace_recovery_duration_seconds",
			Help:    "Wall-clock time from recovery entry (enterRecovery) to successful return to Active",
			Buckets: []float64{5, 15, 30, 60, 120, 300, 600, 1800, 3600},
		},
		[]string{"failure_class"},
	)
	WorkspaceStatusUpdateConflictsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "llmsafespaces_workspace_status_update_conflicts_total",
			Help: "Optimistic-lock conflicts on workspace status updates, labeled by the calling site",
		},
		[]string{"site"},
	)
	// #772: workspace terminations where the explicit PVC delete failed and
	// cleanup was delegated to owner-reference garbage collection, by API
	// error reason (conflict = likely stuck CSI finalizer, forbidden = RBAC
	// denial). Non-zero rate means physical volume reclaim may lag or stay
	// blocked even though the Workspace object completed termination —
	// alert-worthy, not page-on-any.
	WorkspacePVCCleanupDelegatedTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "llmsafespaces_workspace_pvc_cleanup_delegated_total",
			Help: "Workspace terminations where the PVC delete failed and cleanup was delegated to owner-reference garbage collection, by API error reason",
		},
		[]string{"reason"},
	)
	WorkspaceCreateDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{Name: "llmsafespaces_workspace_create_duration_seconds", Help: "Wall-clock time from creation request to Active", Buckets: startupBuckets},
		[]string{"has_packages", "has_init_script"},
	)
	WorkspaceResumeDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{Name: "llmsafespaces_workspace_resume_duration_seconds", Help: "Wall-clock time from Resuming to Active", Buckets: startupBuckets},
		[]string{"resume_type"},
	)
	WorkspaceInitContainerDurationSeconds = prometheus.NewHistogram(
		prometheus.HistogramOpts{Name: "llmsafespaces_workspace_init_container_duration_seconds", Help: "Time in workspace-setup init container", Buckets: []float64{0.5, 1, 2, 5, 10, 30, 60, 120, 300}},
	)
	ReconciliationDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{Name: "llmsafespaces_reconciliation_duration_seconds", Help: "Reconciliation loop duration", Buckets: prometheus.DefBuckets},
		[]string{"resource", "status"},
	)
	ReconciliationErrorsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_reconciliation_errors_total", Help: "Reconciliation errors"},
		[]string{"resource", "error_type"},
	)

	WorkspaceActiveSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_active_seconds_total", Help: "Cumulative seconds in Active phase per workspace"},
		[]string{"workspace_id", "user_id", "runtime", "security_level"},
	)
	WorkspaceStorageBytes = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_workspace_storage_bytes", Help: "PVC allocated bytes per workspace"},
		[]string{"workspace_id", "user_id"},
	)
	WorkspaceDiskUsedBytesSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_disk_used_bytes_seconds_total", Help: "Cumulative (disk_used_bytes x elapsed_seconds) per workspace"},
		[]string{"workspace_id", "user_id"},
	)
	WorkspaceDiskUsedBytes = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_workspace_disk_used_bytes", Help: "Current disk bytes used (gauge for alerting)"},
		[]string{"workspace_id", "user_id"},
	)
	WorkspaceMemoryUsedBytesSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_memory_used_bytes_seconds_total", Help: "Cumulative (memory_used_bytes x elapsed_seconds) per workspace"},
		[]string{"workspace_id", "user_id"},
	)
	WorkspaceMemoryUsedBytes = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_workspace_memory_used_bytes", Help: "Current memory bytes used (gauge for alerting)"},
		[]string{"workspace_id", "user_id"},
	)
	WorkspaceCPUMillisecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_workspace_cpu_milliseconds_total", Help: "Cumulative CPU milliseconds consumed by the workspace pod cgroup"},
		[]string{"workspace_id", "user_id"},
	)

	UserActiveSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_user_active_seconds_total", Help: "Cumulative active compute seconds per user"},
		[]string{"user_id", "runtime", "security_level"},
	)
	UserCPUMillisecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_user_cpu_milliseconds_total", Help: "Cumulative CPU milliseconds per user (divide by 60000 for CPU-minutes)"},
		[]string{"user_id"},
	)
	UserDiskBytesSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_user_disk_bytes_seconds_total", Help: "Cumulative (disk_used_bytes x elapsed_seconds) per user"},
		[]string{"user_id"},
	)
	UserMemoryBytesSecondsTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_user_memory_bytes_seconds_total", Help: "Cumulative (memory_used_bytes x elapsed_seconds) per user"},
		[]string{"user_id"},
	)
	APIKeyLegacyTotal = prometheus.NewGauge(
		prometheus.GaugeOpts{Name: "llmsafespaces_api_key_legacy_total", Help: "API keys using plaintext storage (pre-migration 000017, target: 0)"},
	)

	RelayHealthyReplicas = prometheus.NewGauge(
		prometheus.GaugeOpts{Name: "llmsafespaces_relay_healthy_replicas", Help: "count of healthy relay VMs"},
	)
	RelayProvisioningFailed = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_relay_provisioning_failed", Help: "circuit breaker tripped (0/1)"},
		[]string{"provider"},
	)
	RelayDraining = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_relay_draining", Help: "relay in drain state (0/1)"},
		[]string{"provider"},
	)
	RelayQuotaExhausted = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{Name: "llmsafespaces_relay_quota_exhausted", Help: "egress quota exhausted (0/1)"},
		[]string{"provider"},
	)
	RelayProvisionDurationSeconds = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{
			Name:    "llmsafespaces_relay_provision_duration_seconds",
			Help:    "time to provision + health-check a relay",
			Buckets: []float64{5, 15, 30, 60, 120, 300, 600, 900, 1200},
		},
		[]string{"provider"},
	)
	RelayRotationTotal = prometheus.NewCounterVec(
		prometheus.CounterOpts{Name: "llmsafespaces_relay_rotation_total", Help: "rotation events (429, failure, manual)"},
		[]string{"provider", "reason"},
	)
)