feat(streaming): expose graph-level operational status

[aaltshuler]

Summary

• expose a checked, graph-redacted operational stream status cut through API types, HTTP/OpenAPI, and the remote CLI
• report logical declaration enrollment, lifecycle, drain, strict blocks, pending work, folds, tokens, recovery, and rebuild blockers without leaking dataset, lane, shard, binding, epoch, generation, Lance, or recovery identities
• bound status observation to one cut per graph root and one per server process, with graph-read authorization, no-store responses, and redacted typed failures
• update current-truth architecture, RFC, testing, CLI, server, error, and constants documentation

This slice adds no recovery-format or coordinator changes.

Validation

• cargo test --workspace --locked
• scripts/check-agents-md.sh
• git diff --check

---

Greptile Summary

This PR exposes a checked, graph-redacted streaming operational-status cut through the engine, shared API types, HTTP/OpenAPI route, and remote CLI.

• Adds bounded, read-only status capture covering profile, lifecycle, pending work, folds, token authority, recovery, driver health, and rebuild blockers.
• Adds graph-read authorization, process-wide observation admission, typed redacted failures, and Cache-Control: no-store.
• Adds omnigraph stream status with JSON and human-readable output, plus API, server, CLI, concurrency, and documentation coverage.

Confidence Score: 5/5

The PR appears safe to merge; no concrete blocking or independently actionable non-blocking defect remains.

The new route is protected by graph-read authorization, status capture is bounded and serialized with stream authority using a consistent gate order, movement is rejected rather than combined into a partial cut, and transport projection excludes physical and recovery identities.

Important Files Changed

Filename	Overview
crates/omnigraph/src/db/omnigraph/stream_status.rs	Adds bounded checked capture, authority fencing, movement detection, graph-safe projection, and deadline-controlled typed refusal.
crates/omnigraph/src/db/write_queue.rs	Adds status-observation and stream-authority gates while preserving the established round/profile/admission lock order.
crates/omnigraph-server/src/handlers.rs	Adds the graph-read-authorized status handler with process admission, redacted error mapping, and no-store responses.
crates/omnigraph-server/src/lib.rs	Registers the route, OpenAPI operation, process-wide semaphore, and status-specific error translation.
crates/omnigraph-api-types/src/lib.rs	Adds explicit graph-logical wire DTOs and fail-closed engine-to-wire projection without physical identities.
crates/omnigraph-cli/src/client.rs	Adds served-graph resolution and remote retrieval for the status endpoint.
crates/omnigraph-cli/src/output.rs	Adds complete JSON and human rendering for declaration, authority, recovery, driver, and rebuild status.
openapi.json	Documents the new endpoint, response codes, cache header, and status schemas.

Sequence Diagram

sequenceDiagram
    participant CLI as Remote CLI / HTTP client
    participant Server as OmniGraph server
    participant Policy as Graph read policy
    participant Gate as Process status gate
    participant Engine as Checked status capture
    participant Manifest as Manifest/token authority
    CLI->>Server: "GET /graphs/{graph_id}/stream/status"
    Server->>Policy: authorize graph read
    Policy-->>Server: allow
    Server->>Gate: try acquire single process slot
    Gate-->>Server: permit
    Server->>Engine: capture served graph status
    Engine->>Manifest: preflight immutable authority
    Engine->>Engine: fence fold/profile/lane movement
    Engine->>Manifest: verify trailing cut
    Engine-->>Server: graph-redacted operational status
    Server-->>CLI: 200 JSON + Cache-Control: no-store

Loading

_{Reviews (1): Last reviewed commit: "feat(streaming): expose graph-level oper..." | Re-trigger Greptile}

Context used (5)

• Knowledge Base — OmniGraph core storage: manifest, table store, and Lance access
• Knowledge Base — OmniGraph write path
• Knowledge Base — Server Request Handling
• Knowledge Base — CLI and Config
• Knowledge Base — Dev conventions and invariants

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.