feat(observability): register 26 missing metrics, add memory limits to 4 more services

[JSONbored]

Summary

Phase C of the observability audit (follow-up to #5302).

• 26 unregistered metrics — src/selfhost/metrics.ts's DEFAULT_METRIC_META registry was missing
  HELP/TYPE metadata for 26 metrics that are actually emitted throughout src/ (agent-action
  permission denials, AI review reuse/tiebreak counters, grounding/impact-map/linked-issue-satisfaction/
  repo-culture-profile/review-memory cache hit/miss, orb relay registration/malformed-events, PR
  outcomes, public-origin acknowledgement, and maintenance trickle-admission). Each one rendered as an
  undocumented bare sample at /metrics (no # HELP/# TYPE lines) forever. Found via a systematic
  scan of every incr()/gauge()/gaugeVector()/observe() call site in src/ against the registry.
• Added a drift-guard test (selfhost-metrics.test.ts) that repeats that same scan and fails CI if
  a future metric call site is ever added without a matching registry entry — closes this exact gap
  class for good instead of just fixing today's instance of it.
• Resource limits — added deploy.resources.limits.memory to alertmanager, promtail,
  otel-collector, and docker-proxy in docker-compose.yml, for consistency with
  prometheus/grafana/loki/tempo (which already had caps, per perf(selfhost): profile stack resources and tune defaults #1828/fix(selfhost): add memory/CPU resource limits to docker-compose services #2495). Extended the
  existing selfhost-compose-resource-limits.test.ts and .env.example documentation to match.

Test plan

• npm run typecheck — clean
• npm run test:ci — full local gate green
• New drift-guard test in selfhost-metrics.test.ts (scans src/ for every literal metric name,
  asserts each has a registered HELP/TYPE entry — sanity-checks it found >50 real call sites)
• Extended selfhost-compose-resource-limits.test.ts to cover the 4 newly-capped services

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.37%. Comparing base (b7a410d) to head (7d38e59).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5310   +/-   ##
=======================================
  Coverage   94.37%   94.37%           
=======================================
  Files         474      474           
  Lines       40128    40128           
  Branches    14631    14631           
=======================================
  Hits        37869    37869           
  Misses       1583     1583           
  Partials      676      676           

Flag	Coverage Δ
shard-1	46.28% <100.00%> (-0.28%)	⬇️
shard-2	34.74% <100.00%> (+0.06%)	⬆️
shard-3	32.05% <100.00%> (-0.05%)	⬇️
shard-4	31.97% <100.00%> (-0.11%)	⬇️
shard-5	33.45% <100.00%> (-0.15%)	⬇️
shard-6	45.07% <100.00%> (+0.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/selfhost/metrics.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[gittensory-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-12 13:49:53 UTC}

5 files · 1 AI reviewer · 1 blocker · readiness 100/100 · CI green · unstable

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Review summary
This PR registers HELP/TYPE metadata for 26 previously-unregistered metrics in DEFAULT_METRIC_META, adds a drift-guard test that scans src/ for literal metric-name call sites and fails if any lack registry entries, and adds memory limits to 4 more docker-compose services with matching test coverage and .env.example docs. The change is mechanical and low-risk, exporting DEFAULT_METRIC_META purely for test introspection, and the drift-guard regex correctly targets the incr/gauge/gaugeVector/observe call pattern described in the PR body. The docker-compose and .env.example additions mirror the existing pattern for prometheus/grafana/loki/tempo exactly, and the sanity check (`used.size > 50`) guards against a silently-empty scan.

Nits — 5 non-blocking

• The drift-guard regex `/\b(?:incr|gauge|gaugeVector|observe)\(\s*"([a-z0-9_]+)"/g` in test/unit/selfhost-metrics.test.ts only matches metric names built from string literals immediately following the call — if any call site interpolates or concatenates a metric name it will silently fail to be scanned, so the drift guard's coverage is only as good as the 'no dynamic names today' assumption noted in the comment.
• docker-compose.yml is called out as long (~826 lines) by the size-smell scan, but this PR only adds 16 lines to it in a pattern consistent with existing services, so it's not this diff's responsibility to split the file.
• Consider asserting the reverse direction too (every DEFAULT_METRIC_META entry has a real call site) to also catch stale/orphaned registry entries, though that's a follow-up not a blocker for this PR.
• test/unit/selfhost-metrics.test.ts:374: nit: the drift guard only recognizes double-quoted direct calls to `incr`, `gauge`, `gaugeVector`, and `observe`, so a future single-quoted literal or imported alias could still bypass the registry check.
• src/selfhost/metrics.ts:36: nit: exporting `DEFAULT_METRIC_META` only for the test slightly broadens the production module API; consider documenting that it is test/registry introspection surface if consumers start importing it.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.

Signal	Result	Evidence
Code review	❌ 1 blocker	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 44 registered-repo PR(s), 36 merged, 476 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 44 PR(s), 476 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.
Improvement	✅ Minor	risk: clean · value: minor — Code changes are accompanied by test evidence.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 44 PR(s), 476 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

[BETA] Chat with Gittensory

Ask Gittensory a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @gittensory ask <question> answers contribution-quality Q&A with source citations and freshness.
• @gittensory chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @gittensory mention with a real question is routed to the closest matching read-only command automatically -- no exact syntax required.

Full command reference: https://gittensory.aethereal.dev/docs/gittensory-commands

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review