Remove the unused observability contract and stale identity token field

[szweibel]

Summary

Follow-up to the open question in #84. It removes the parts of lib/observability/contract.ts and lib/observability/action-attempt.ts that only tests read, removes the token field from resolveRequestIdentity's verified result, and updates docs/cail-log-alignment.md to match. It adds no behavior.

Removed

contract.ts

• createCloudflareHealthCheckSpec and CloudflareHealthCheckSpec
• auditTelemetryLifecyclePairs, TelemetryQualityIssue, TelemetryRecord, TelemetryValue
• CAIL_LOG_ENVIRONMENTS (parseCailLogEnvironment stays; it has its own switch)
• OBSERVABILITY_CONTRACT_VERSION, plus the schemaVersion and productId fields
• The collection, fleetProjection, access, syntheticMonitor, serviceLevels, dashboardViews and telemetryQuality sections
• The SiteStudioAction type, and the imports of cail-log Analytics Engine constants, action-attempt schema constants, the fleet point cap, and zod that only those sections used

action-attempt.ts

• summarizeDurableActionReliability, ActionReliabilitySummary, basisPoints

cail-identity.ts

• token in { status: "verified" }. The doc comment said model calls forward it. That has been false since e1cf4b6: authMiddleware forwards only the separately verified gateway leg (cailGatewayJwt).

Tests

• observability-contract.test.ts: "pins privacy, access, export, and conservative monitor defaults" and "audits lifecycle projection gaps without deciding product success". Removed the CAIL_LOG_ENVIRONMENTS, contract-version and telemetryQuality assertions from the tests that remain.
• action-attempt-contract.test.ts: the two summarizeDurableActionReliability tests and their fixtures.
• cail-identity.test.ts: "returns the verified identity and exact canonical token". Without token, it repeated "accepts a valid canonical identity token", which already asserts the full verified result with toEqual.

Reader map

git grep -w over the repository (packages/, scripts/, .github/, packages/app/scripts/), plus rg over every local CAIL repository under ~/Apps/cail, including the systems map and cail-log:

Export or key	Non-test readers
createCloudflareHealthCheckSpec	none
auditTelemetryLifecyclePairs	none
summarizeDurableActionReliability	none
CAIL_LOG_ENVIRONMENTS	none
OBSERVABILITY_CONTRACT_VERSION, .schemaVersion, .productId	none
.collection, .fleetProjection, .access, .syntheticMonitor, .serviceLevels, .dashboardViews, .telemetryQuality	none. The removed helpers were their only readers.
RequestIdentityResolution.token	none. session.ts reads only identity, and scripts/local-browser-worker.ts reads only identity.subject.

No other CAIL repository references any of these symbols. Nothing publishes the contract as an artifact for the fleet dashboard to read.

Kept, and why

• OBSERVABILITY_CONTRACT.services.app (name, version, healthPath, healthMarker). lib/logging.ts reads LOG_SERVICE and LOG_RELEASE from it, and routes/health.ts reads the path and marker.
• OBSERVABILITY_CONTRACT.actions (route, method). Read by lib/logging.ts (action admitted/terminal events), routes/publish.ts and agents/site-builder.ts (admission route check).
• healthResponse and the version-metadata validation. The deploy job's "Probe production readiness" step in .github/workflows/ci.yml checks /api/health for status == "ok", product_id == "site-studio" and version_id == $EXPECTED_VERSION_ID. scripts/live-product-e2e.mjs checks status and product_id. The three health and version-metadata tests stay.
• parseCailLogEnvironment, serviceUnavailableResponse, PRODUCT_ID. Read by logging.ts and health.ts.
• Everything else in action-attempt.ts: schema versions, retention, routes, record types and terminal validators. agents/site-builder.ts and the /api/projects/{id}/observability read use them. The isActionAttemptTerminalConsistent tests stay.
• fleet-projection.ts, including SITE_STUDIO_MAX_FLEET_POINTS_PER_INVOCATION. The runtime boundary sink uses it.

Docs

docs/cail-log-alignment.md:

• Replaced the paragraphs about the source contract, contract version 2/4, the synthetic profile and the SLO table. The new paragraph says what contract.ts holds and that monitors, thresholds, SLOs and saved queries are operator configuration outside the repository.
• The publish-terminal paragraph no longer points to the lifecycle auditor. It says the durable record keeps an admission with no terminal, and the observability read shows it. This was checked against site-builder.ts, which returns every retained attempt with a nullable terminal_at.
• The health paragraph now covers the version ID and tag that the release probe waits for, and fixes a "They" with no referent.
• Removed the Query Builder, Health Check regions, Health Check notifications and HTTP traffic alerts source bullets. They only justified the removed sections. The Workers Logs bullet now refers to the single Wrangler config.

No other doc described the removed code. README, AGENTS.md, security-and-recovery.md and workers-builds.md were grepped.

Validation

• Focused vitest (observability-contract, action-attempt-contract, cail-identity, fleet-projection, session, boundary-logging, routes/agents): 7 files, 106 tests pass.
• bun run check: rc=0. That covers lint, app vitest (32 files, 745 tests, down from 750), the chat-runtime-contract and preview-route-contract boundary scripts, tsc --noEmit, the frontend check (224 tests) and the frontend build. No packages/app/scripts/*contract*.mjs script reads observability code. The only release probe that touches it is the CI health probe described above, and its response shape has not changed.
• git diff --check: clean.

	Added	Removed
Production	6	589
Tests	5	336
Docs	25	62

🤖 Generated with Claude Code