{
  "canon_meta": {
    "canon_id": "devon-monitoring-canonical",
    "version": "1.0.0",
    "status": "ACTIVE",
    "contract_mode": "real_time_monitoring_authority",
    "master_authority": "master_architecture_index.md",
    "phase_origin": [
      "phase-10"
    ],
    "installation_order": 85,
    "canonical_layer_key": "monitoring_layer"
  },
  "monitoring_canonical": {
    "objective": "Define the canonical real-time monitoring model for the Devon host, containers and services. Monitoring is a first-class operational layer and feeds the Operator Panel monitoring section directly.",
    "monitoring_targets": [
      {
        "target_id": "host_cpu",
        "label": "CPU Usage",
        "category": "host",
        "metrics": [
          "usage_pct",
          "load_1m",
          "load_5m",
          "load_15m",
          "core_count"
        ],
        "alert_threshold": {
          "usage_pct": 85
        },
        "refresh_interval_sec": 5,
        "why": "Devon has no GPU — CPU is the primary compute resource and must be monitored continuously"
      },
      {
        "target_id": "host_memory",
        "label": "Memory / RAM",
        "category": "host",
        "metrics": [
          "usage_pct",
          "used_mb",
          "total_mb",
          "swap_used_mb"
        ],
        "alert_threshold": {
          "usage_pct": 90
        },
        "refresh_interval_sec": 5,
        "why": "LLM inference and embedding are memory-intensive"
      },
      {
        "target_id": "host_disk",
        "label": "Disk Usage & I/O",
        "category": "host",
        "metrics": [
          "usage_pct",
          "used_gb",
          "total_gb",
          "io_read_mbps",
          "io_write_mbps"
        ],
        "alert_threshold": {
          "usage_pct": 85
        },
        "refresh_interval_sec": 10,
        "why": "model weights, vector DBs and canonical artifacts require reliable disk"
      },
      {
        "target_id": "host_network",
        "label": "Network & Latency",
        "category": "host",
        "metrics": [
          "in_mbps",
          "out_mbps",
          "latency_ms"
        ],
        "alert_threshold": {
          "latency_ms": 200
        },
        "refresh_interval_sec": 5,
        "why": "API calls and SSE bridge depend on stable network"
      },
      {
        "target_id": "host_uptime",
        "label": "Uptime & Processes",
        "category": "host",
        "metrics": [
          "uptime_seconds",
          "process_count",
          "open_file_descriptors"
        ],
        "refresh_interval_sec": 30,
        "why": "unexpected restarts and FD exhaustion are silent failure modes"
      },
      {
        "target_id": "containers",
        "label": "Docker Containers",
        "category": "docker",
        "metrics": [
          "running_count",
          "stopped_count",
          "per_container_cpu_pct",
          "per_container_mem_mb",
          "restart_count"
        ],
        "alert_threshold": {
          "restart_count": 3
        },
        "refresh_interval_sec": 5,
        "why": "container health is the primary runtime health signal"
      },
      {
        "target_id": "nginx",
        "label": "Nginx Status",
        "category": "services",
        "metrics": [
          "active",
          "connections_active",
          "requests_per_sec"
        ],
        "refresh_interval_sec": 10,
        "why": "reverse proxy is the entry point for all external traffic"
      },
      {
        "target_id": "security",
        "label": "Security Services",
        "category": "security",
        "metrics": [
          "ufw_active",
          "fail2ban_active",
          "fail2ban_banned_count",
          "ssh_active"
        ],
        "refresh_interval_sec": 30,
        "why": "security posture must be continuously observable"
      }
    ],
    "transport_policy": {
      "primary": "sse",
      "fallback": "polling",
      "polling_interval_sec": 5,
      "sse_endpoint": "/monitoring/stream",
      "sse_retry_ms": 3000
    },
    "runtime_artifact": "monitoring_runtime.json",
    "status_rules": {
      "PASS": "all targets observable and within thresholds",
      "WARN": "observable but one or more thresholds exceeded",
      "FAIL": "target not observable or critical threshold exceeded",
      "MISSING": "monitoring collector not running"
    }
  },
  "id": "monitoring_canonical",
  "label": "Monitoring Canonical",
  "phase": "phase-10",
  "category": "monitoring_observability",
  "status": "ACTIVE_DH_MIRROR",
  "purpose": "Govern runtime telemetry, health signals, service state and operational visibility for DEVON-DEV.",
  "function": "Convert runtime behavior into structured monitoring evidence before the future execution panel trusts health, readiness, degradation or incident state.",
  "overview": {
    "summary": "Monitoring Canonical is the runtime truth boundary of Phase 10. It defines how hosts, containers, services, queues, events and panel signals become operational evidence instead of decorative status.",
    "function": "FUNCTION: Normalize health state, execution continuity, service symptoms, queue pressure, latency, failure indicators and operator-visible telemetry into records that the panel can inspect, compare and escalate.",
    "system_position": "Self-Monitoring depends on this canon to detect internal drift. Scheduler depends on it to run timed checks against meaningful signals. Incident Management consumes its degraded states. SSE Bridge streams its live surface. Monitoring Canonical decides which observations are authoritative enough to drive operational response.",
    "failure_impact": "Blind runtime is the failure mode here. DEVON-DEV may still execute commands and render pages, but the operator cannot tell the difference between healthy service, stale state, delayed queue, broken source, silent container failure or telemetry noise pretending to be truth."
  },
  "failure_impact": "Blind runtime is the failure mode here. DEVON-DEV may still execute commands and render pages, but the operator cannot tell the difference between healthy service, stale state, delayed queue, broken source, silent container failure or telemetry noise pretending to be truth.",
  "technology_requirements": [
    {
      "technology": "Monitoring Telemetry Store",
      "required_for": "Govern runtime telemetry, health signals, service state and operational visibility for DEVON-DEV.",
      "required_by_phase": "phase-10",
      "required_by_category": "monitoring_canonical",
      "required_by_buckets": [
        "Prerequisites",
        "Installation",
        "Configuration",
        "Validation",
        "Observable Evidence",
        "Failure Modes & Recovery",
        "Completion & Promotion"
      ],
      "expected_version": "MISSING until Monitoring Telemetry Store is implemented and validated in the future Execution & Monitoring Panel",
      "validation_command": "MISSING until monitoring_canonical can prove monitored state, evidence routing and operator-facing visibility",
      "evidence_path": "/home/yeff/public_html/devon/canon/execution/state/dh_sources/monitoring_canonical.json",
      "status_source": "Documentation Hub + future Execution & Monitoring Panel",
      "blocking_if_missing": true,
      "failure_impact": "Blind runtime is the failure mode here. DEVON-DEV may still execute commands and render pages, but the operator cannot tell the difference between healthy service, stale state, delayed queue, broken source, silent container failure or telemetry noise pretending to be truth."
    }
  ],
  "depends_on": [
    "observability_audit",
    "execution_ledger",
    "terminal_output_panel"
  ],
  "used_by": [
    "self_monitoring",
    "incident_management",
    "sse_bridge_canonical",
    "operator_panel"
  ]
}