helpers-no
diff --git a/‎website/docs/ai-developer/plans/backlog/1PRIORITY.md‎
Lines changed: 6 additions & 2 deletions b/‎website/docs/ai-developer/plans/backlog/1PRIORITY.md‎
Lines changed: 6 additions & 2 deletions
@@ -24,7 +24,11 @@ tool, not a roadmap.
   it; one completes → strike it and promote dependents; a child PLAN ships
   → re-rank the parent. Full re-rank quarterly or after every 3 ships.
 
-**Last triaged:** 2026-07-14 — [`INVESTIGATE-dependency-upgrade-sweep.md`](INVESTIGATE-dependency-upgrade-sweep.md) mostly shipped: GitHub Actions (all 5 actions bumped, confirmed via a real triggered run that the recurring "Node.js 20 is deprecated" annotation is gone), Docusaurus (`3.10.1`→`3.10.2`, PR #18, verified with a real local build since this repo has no CI configured to lean on), and `@types/node`/`tsx` consistency for `tools/validation` + `tools/dashboards` (PRs #22, #23) all done directly, each verified with a real `tsc --noEmit` rather than trusting a green Dependabot check. Also found and corrected a real mistake from the 2026-07-13 pass: PR #12 had been closed with a comment claiming its `typescript` bump was "superseded by a manual commit" — it wasn't; that comment was wrong and has been corrected. That correction led to the pass's one substantive new finding: `typescript@7.0.2` breaks ambient Node global type resolution (`process`/`Buffer`/`node:fs` unresolvable) under this repo's `tsconfig.json` pattern — confirmed by isolating it in `tools/validation`, not assumed. `typescript` stays pinned everywhere until a dedicated migration is scoped; 3 open PRs (#13, #15, #19) closed/deferred with this recorded on each. ESLint 8→10 (PRs #14, #17) also deliberately left open — a real flat-config migration, not a mechanical bump. Demoted from Tier 1 to Tier 2: the urgent/mechanical parts are done, what remains needs two dedicated follow-up investigations (`INVESTIGATE-eslint9-migration.md`, `INVESTIGATE-typescript7-migration.md`) not yet written.
+**Last triaged:** 2026-07-14 — Two things shipped in the same session: (1) a real Grafana Cloud consistency-check CI gate — `.github/workflows/ci.yml`'s new `grafana-cloud-consistency` job runs `sovdev-selftest` (fail-fast) then a full write→validate-file→read-back→diff-against-file check via the new `tools/validation/grafana-cloud/full-consistency-check.sh`, using dedicated `sovdev-ci-ingest`/`sovdev-ci-verify` credentials — this is what would have caught the `uuid` ESM-crash regression (see the dependency-sweep entry below) before it shipped; verified live in production CI before merging. (2) [`INVESTIGATE-tenant-write-isolation.md`](../completed/INVESTIGATE-tenant-write-isolation.md) — while setting up those CI credentials, confirmed a real, structural finding: Grafana Cloud's Label-Based Access Control only restricts *read* scopes, never write — any ingest token in this project (`ollacrm-ingest`, `sovdev-ci-ingest`, every future customer's) can write fabricated data under *any* `service_name` in the shared stack, not just its own, confirmed both empirically (a spoofed write test) and via two first-party Grafana docs. The real fix (separate Grafana Cloud stacks per system) exists but costs the single shared dashboard this project's whole onboarding design is built around — maintainer decided **not** to pursue it, accepted as a documented, known limitation; corrected `using/onboarding/index.md`'s previously-overstated "blast radius stays contained" claim to be explicit about read-only isolation. Investigation moved straight to `completed/`, no child plan.
+>
+> Earlier: [`INVESTIGATE-developer-first-onboarding.md`](INVESTIGATE-developer-first-onboarding.md)'s remaining 6 open questions ([Q1]–[Q5], [Q9]) all answered by the maintainer: ollacrm developers confirmed to have **no** Grafana Cloud login today (settles [Q1]/[Q9] decisively in favor of Option E1's public, no-login dashboard link); Option B (bundled connection string) ships TypeScript-first as JSON→base64, generated by a new `tools/` script, strictly one-per-system (no shared-string design); Option D (shutdown-handler convenience function) deferred until a second server-shaped consumer exists. Nothing left blocking a plan — next action is drafting `PLAN-*.md`(s) for E1, Option A (the 3-way docs split), and Option B, likely as 3 separate plans given how independently each ships.
+>
+> Earlier: [`INVESTIGATE-dependency-upgrade-sweep.md`](INVESTIGATE-dependency-upgrade-sweep.md) mostly shipped: GitHub Actions (all 5 actions bumped, confirmed via a real triggered run that the recurring "Node.js 20 is deprecated" annotation is gone), Docusaurus (`3.10.1`→`3.10.2`, PR #18, verified with a real local build since this repo has no CI configured to lean on), and `@types/node`/`tsx` consistency for `tools/validation` + `tools/dashboards` (PRs #22, #23) all done directly, each verified with a real `tsc --noEmit` rather than trusting a green Dependabot check. Also found and corrected a real mistake from the 2026-07-13 pass: PR #12 had been closed with a comment claiming its `typescript` bump was "superseded by a manual commit" — it wasn't; that comment was wrong and has been corrected. That correction led to the pass's one substantive new finding: `typescript@7.0.2` breaks ambient Node global type resolution (`process`/`Buffer`/`node:fs` unresolvable) under this repo's `tsconfig.json` pattern — confirmed by isolating it in `tools/validation`, not assumed. `typescript` stays pinned everywhere until a dedicated migration is scoped; 3 open PRs (#13, #15, #19) closed/deferred with this recorded on each. ESLint 8→10 (PRs #14, #17) also deliberately left open — a real flat-config migration, not a mechanical bump. Demoted from Tier 1 to Tier 2: the urgent/mechanical parts are done, what remains needs two dedicated follow-up investigations (`INVESTIGATE-eslint9-migration.md`, `INVESTIGATE-typescript7-migration.md`) not yet written.
 >
 > Earlier: [`INVESTIGATE-operator-dashboard-panel.md`](../completed/INVESTIGATE-operator-dashboard-panel.md) and its child [`PLAN-operator-dashboard-panel.md`](../completed/PLAN-operator-dashboard-panel.md) both shipped and moved to `completed/`: a new "Active Clients" panel (fleet-wide distinct `client_name` count) added to both dashboard variants, next to "Active Integrations." This investigation replaced an earlier informal Tier 5 spot-check that turned out to be wrong when re-checked against realistic data — the naive query counted "no client set" as a distinct client, and a genuinely-zero-clients service returned empty instead of `0`; both fixed and re-verified. Validated end-to-end on both real backends, including the maintainer visually confirming both live dashboards and watching "Active Clients" flip from `0` to `1` live as fresh data landed — which also surfaced a real, not-a-bug finding the investigation had predicted: this panel respects the dashboard's time-range picker literally (unlike "Active Integrations," a persistent Prometheus counter), so it can show `0` even with recent-but-just-outside-the-window activity.
 >
@@ -46,7 +50,7 @@ tool, not a roadmap.
 
 ## Tier 1 — next up
 
-- [`INVESTIGATE-developer-first-onboarding.md`](INVESTIGATE-developer-first-onboarding.md) — the app-facing code is already simple (3 function calls); the entire burden is in hand-producing 6 OTLP env vars, and verification is a console message the developer can't fully trust. Checked how Sentry/Datadog/Grafana Labs solve this: Sentry's DSN validates the "bundled connection string" idea; Grafana Cloud's own "Share externally" public-dashboard feature gives a near-zero-cost way to copy Sentry's "watch it appear live" UX with no credential changing hands at all — the recommended near-term action. Also found Grafana Cloud's Label-Based Access Control (LBAC): one Access Policy per system can combine Write with a label-selector-scoped Read (same `service_name`) — one token, not two, that both writes and reads back only its own data. This resolves the credential-sharing risk that previously made the bespoke self-test CLI (Option E3) feel riskier than the dashboard-link option — now just a build-effort question, evidence-gated rather than risk-gated. Also has forward-looking Azure/GCP research (connection-string shapes, official read-back CLIs) for when those backends are added — see [`INVESTIGATE-external-backend-verification.md`](INVESTIGATE-external-backend-verification.md). 9 open questions need maintainer answers — see the doc.
+- [`INVESTIGATE-developer-first-onboarding.md`](INVESTIGATE-developer-first-onboarding.md) — **all 6 remaining open questions resolved 2026-07-14, ready for PLAN(s).** The app-facing code is already simple (3 function calls); the entire burden was hand-producing 6 OTLP env vars, with verification only a console message the developer couldn't fully trust. Decided: **Option A** (3-way docs split — developer/operator/contributor), **Option B** (bundled connection string, JSON→base64, TypeScript-first, one-per-system, generated by a new `tools/` script), and **Option E1** (Grafana Cloud's public "Share externally" dashboard link — confirmed the *only* verification path that works, since ollacrm developers have no Grafana Cloud login today). Option D (shutdown-handler convenience function) deferred until a second server-shaped consumer exists. Option E3 (bespoke self-test CLI) already shipped separately as `sovdev-selftest`, see [`INVESTIGATE-selftest-cli.md`](../completed/INVESTIGATE-selftest-cli.md). Also has forward-looking Azure/GCP research (connection-string shapes, official read-back CLIs) for when those backends are added — see [`INVESTIGATE-external-backend-verification.md`](INVESTIGATE-external-backend-verification.md). Next action: draft `PLAN-*.md`(s) for E1, A, and B.
 ## Tier 2 — real, not urgent
 
 - [`INVESTIGATE-dependency-upgrade-sweep.md`](INVESTIGATE-dependency-upgrade-sweep.md) — the parent sweep across every *other* software component in the repo. **Mostly shipped** (2026-07-14): OTel (done separately, security-relevant), GitHub Actions (all 5 bumped, deprecation annotation confirmed gone), Docusaurus (`3.10.1`→`3.10.2`), and `@types/node`/`tsx` consistency for `tools/validation`+`tools/dashboards` are all done and verified with real builds, not just green Dependabot checks. Remaining scope spun off into two dedicated follow-ups (below); this parent stays open only until their child plans ship.