feat(observability): restore monitoring coverage, make gaps visible, stream executions

Monitoring coverage was 3 of 89 active entities. Three bugs, each hidden by discarded errors in checkdefaults: - writeCheck generated a fresh uuid, inserted the check entity ON CONFLICT (slug) DO NOTHING, then wrote a check_defs row referencing it. On any re-seed the slug already existed, the entity insert no-oped, and the FK violated — aborting the ingest transaction and surfacing as an unrelated failure several entities later. Re-seeding has been broken since; prod's coverage was frozen at its first successful seed. This is what TestSeedIngestIdempotentAndNoDuplicateEdges had been reporting. - shortSlug truncated to the last 8 chars, so all 21 ingress routes collapsed to ".network" and overwrote each other; service:jellyfin collided with lxc:jellyfin. - The ssh-script checker never read the `args` config checkdefaults wrote, so process_check.sh always ran without its unit name and returned "unknown". Coverage is now 75/89. Monitoring is declared per entity type in seeds/ontology.yaml and resolved through the is-a hierarchy, so a type can say it warrants nothing (site, lan, mesh, cluster) and never be reported as a gap. coverageSweep raises an `unmonitored` signal only where a type declares monitoring it lacks — 8 real gaps, no false positives. Also: - entity_types.attribute_schema was never ingested: the seed loader read "attribute_schema" but the YAML says "attributes", so all 60 types stored JSON null. - ListExecutions ignored its declared target/action/correlation_id filters and paginated on a non-unique target slug, dropping and repeating rows. - started_at was captured but only written at terminal state, so a running execution reported NULL for its whole life. The three MCP auto-run copies wrote no timing at all; they are now one autoRun helper. - SSH output was buffered to completion and discarded entirely on timeout. Both sshExec copies now stream through a shared execlog sink into execution_logs, and keep partial output when a command is cancelled. - executions.correlation_id was a random per-execution uuid that correlated nothing; it is now the chat session id, which is what lets the chat tail live output. - reversible_low had no auto-run branch despite policy declaring it unattended. Since computeCommandRisk never returns it, the class only arises when an agent declares it over a read_only command — so gating it penalised candor without adding safety. - backup-target gains a backup-freshness checker (portable find -mmin, since the first target is on macOS), resolving its host by walking backs-up-to backwards. The pre-deploy pg_dump is now a tracked backup target. UI: an Executions section on entity detail with live output tailing, and streamed output under a running `run` call in the chat timeline. Migrations 022-024. Ops.svelte and context.ts exclude execution.output from their refetch triggers, which would otherwise fire once a second per command. Co-Authored-By: Claude <noreply@anthropic.com>
2026-07-28 13:51:14 +02:00
parent 873b00ac42
commit 1dca2cfd7a
39 changed files with 3105 additions and 273 deletions
--- a/internal/httpapi/actuator.go
+++ b/internal/httpapi/actuator.go
@@ -1,6 +1,7 @@
 package httpapi

 import (
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
@@ -9,10 +10,12 @@ import (
 	"os"
 	"strconv"
 	"strings"
+	"sync"
 	"time"

 	"github.com/dtoro/oikos/internal/db"
 	"github.com/dtoro/oikos/internal/db/sqlcgen"
+	"github.com/dtoro/oikos/internal/execlog"
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/google/uuid"
 	"golang.org/x/crypto/ssh"
@@ -71,7 +74,35 @@ func initSSH() {
 // report. Generous enough for a real apt/docker install; not infinite.
 const sshExecTimeout = 10 * time.Minute

+// streamWriter buffers everything it is given while forwarding each write to a
+// sink. One on session.Stdout and another sharing the same buffer on
+// session.Stderr reproduces CombinedOutput's interleaving in the order the
+// remote end produced it. Mirrors the twin in internal/mcp/server.go.
+type streamWriter struct {
+	mu     *sync.Mutex
+	buf    *bytes.Buffer
+	stream string
+	sink   execlog.Sink
+}
+
+func (w *streamWriter) Write(p []byte) (int, error) {
+	w.mu.Lock()
+	w.buf.Write(p)
+	w.mu.Unlock()
+	if w.sink != nil {
+		// Copy: the ssh library reuses p once Write returns.
+		w.sink(w.stream, append([]byte(nil), p...))
+	}
+	return len(p), nil
+}
+
 func sshExec(ctx context.Context, host, user, command string) (string, error) {
+	return sshExecStream(ctx, host, user, command, nil)
+}
+
+// sshExecStream runs a command and reports its combined output, forwarding
+// each chunk to sink as it arrives. A nil sink behaves exactly as before.
+func sshExecStream(ctx context.Context, host, user, command string, sink execlog.Sink) (string, error) {
 	initSSH()
 	if len(_sshKey) == 0 {
 		return "", fmt.Errorf("no SSH key available")
@@ -105,50 +136,62 @@ func sshExec(ctx context.Context, host, user, command string) (string, error) {
 	}
 	defer session.Close()

-	type result struct {
-		out []byte
-		err error
+	var (
+		mu  sync.Mutex
+		buf bytes.Buffer
+	)
+	session.Stdout = &streamWriter{mu: &mu, buf: &buf, stream: "stdout", sink: sink}
+	session.Stderr = &streamWriter{mu: &mu, buf: &buf, stream: "stderr", sink: sink}
+
+	collected := func() string {
+		mu.Lock()
+		defer mu.Unlock()
+		return strings.TrimSpace(buf.String())
 	}
-	done := make(chan result, 1)
+
+	done := make(chan error, 1)
 	go func() {
 		// See internal/mcp/server.go's sshExec for why this recovers rather
 		// than letting a rare SSH-library panic crash the whole api process.
 		defer func() {
 			if r := recover(); r != nil {
-				done <- result{nil, fmt.Errorf("panic in ssh exec: %v", r)}
+				done <- fmt.Errorf("panic in ssh exec: %v", r)
 			}
 		}()
-		out, err := session.CombinedOutput(command)
-		done <- result{out, err}
+		// Run rather than CombinedOutput so the assigned writers are used;
+		// Run returns only after both streams are fully drained.
+		done <- session.Run(command)
 	}()

 	select {
-	case r := <-done:
-		text := strings.TrimSpace(string(r.out))
+	case err := <-done:
+		text := collected()
 		// A non-zero exit MUST surface as an error. The previous guard only
 		// errored when there was no output, so a `pct create` that printed
 		// "CT 132 already exists" and exited non-zero was reported as
 		// success — the execution was marked completed though nothing was
 		// provisioned.
-		if r.err != nil {
+		if err != nil {
 			if text != "" {
-				return text, fmt.Errorf("%w: %s", r.err, text)
+				return text, fmt.Errorf("%w: %s", err, text)
 			}
-			return text, fmt.Errorf("exec: %w", r.err)
+			return text, fmt.Errorf("exec: %w", err)
 		}
 		return text, nil
 	case <-time.After(sshExecTimeout):
 		// Close the session/client to hang up the remote side; the
-		// goroutine above will eventually exit once that unblocks
-		// CombinedOutput, but we don't wait for it — the caller needs an
-		// answer now, not an indefinite hang.
+		// goroutine above will eventually exit once that unblocks Run, but we
+		// don't wait for it — the caller needs an answer now, not an
+		// indefinite hang.
 		session.Close()
 		client.Close()
-		return "", fmt.Errorf("timed out after %s waiting for command to finish on %s", sshExecTimeout, host)
+		// Return what arrived before it hung, rather than "". A provisioning
+		// command that stalls halfway is precisely when its output matters.
+		return collected(), fmt.Errorf("timed out after %s waiting for command to finish on %s", sshExecTimeout, host)
 	case <-ctx.Done():
 		session.Close()
 		client.Close()
-		return "", ctx.Err()
+		return collected(), ctx.Err()
 	}
 }

@@ -231,7 +274,16 @@ func emitExecutionEvent(ctx context.Context, pool *db.Pool, execID uuid.UUID, st
 	if status == "failed" {
 		severity = "warning"
 	}
-	_ = observability.Event(ctx, sqlcgen.New(pool), "execution."+status, &execID, severity, "actuator", "", detail)
+	// The correlation id was hardcoded to "", so execution events could not be
+	// tied back to the session that caused them — the one join you want when
+	// asking "what did this agent turn actually do?". It is already on the
+	// execution row; read it rather than threading it through eleven callers.
+	var correlationID string
+	if err := pool.QueryRow(ctx,
+		`SELECT correlation_id FROM executions WHERE entity_id = $1`, execID).Scan(&correlationID); err != nil {
+		correlationID = ""
+	}
+	_ = observability.Event(ctx, sqlcgen.New(pool), "execution."+status, &execID, severity, "actuator", correlationID, detail)
 	if status == "completed" || status == "failed" || status == "cancelled" {
 		closePlanStepForExecution(ctx, pool, execID, status)
 	}
@@ -280,6 +332,29 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 	action, params := actionStr[:idx], actionStr[idx+1:]

 	startedAt := time.Now()
+	// Persist started_at now, not at the end. It was captured here but only
+	// written in the terminal UPDATE, so a running execution reported
+	// started_at = NULL for its entire life — the UI could not show how long
+	// anything had been going, which is exactly when you want to know.
+	if _, err := pool.Exec(ctx,
+		`UPDATE executions SET status = 'running', started_at = $2 WHERE entity_id = $1`,
+		execID, startedAt); err != nil {
+		slog.Error("httpapi: mark execution running", "error", err, "execution_id", execID)
+	}
+
+	// Stream output for the actions whose output an operator actually watches:
+	// a long apt upgrade, a pct create, an arbitrary approved `run`. The small
+	// internal lookups further down (listing template cache, pvesh nextid) stay
+	// unstreamed — they are plumbing, and logging them would bury the command
+	// the operator approved.
+	var correlationID string
+	if qerr := pool.QueryRow(ctx,
+		`SELECT correlation_id FROM executions WHERE entity_id = $1`, execID).Scan(&correlationID); qerr != nil {
+		correlationID = ""
+	}
+	sink, flushLogs := execlog.New(ctx, pool, execID, correlationID)
+	defer flushLogs()
+
 	var output, cmd string

 	switch action {
@@ -295,30 +370,30 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 		default:
 			cmd = fmt.Sprintf("systemctl %s %s 2>&1", params, svc)
 		}
-		output, err = sshExec(ctx, host, user, cmd)
+		output, err = sshExecStream(ctx, host, user, cmd, sink)

 	case "apt_upgrade":
 		svc := strings.TrimPrefix(targetSlug, "lxc:")
 		cmd = fmt.Sprintf("apt update -qq 2>&1 >/dev/null && apt upgrade -y -qq 2>&1; echo '---'; systemctl is-active %s || true", svc)
-		output, err = sshExec(ctx, host, user, cmd)
+		output, err = sshExecStream(ctx, host, user, cmd, sink)

 	case "pct_create":
 		var cfg struct {
-			VMID        int      `json:"vmid"`
-			Hostname    string   `json:"hostname"`
-			Cores       int      `json:"cores"`
-			Memory      int      `json:"memory"`
-			DiskGB      int      `json:"disk_gb"`
-			IP          string   `json:"ip"`
-			GW          string   `json:"gw"`
-			Bridge      string   `json:"bridge"` // e.g. vmbr0/vmbr1 — which bridge actually reaches the target subnet on this host varies per host, don't assume vmbr0
-			Storage     string   `json:"storage"`
-			Template    string   `json:"template"`
-			Privileged  flexBool `json:"privileged"`
-			Nesting     flexBool `json:"nesting"`
-			Mounts      []string `json:"mounts"`
-			Nameserver  string   `json:"nameserver"`
-			Searchdomain string  `json:"searchdomain"`
+			VMID         int      `json:"vmid"`
+			Hostname     string   `json:"hostname"`
+			Cores        int      `json:"cores"`
+			Memory       int      `json:"memory"`
+			DiskGB       int      `json:"disk_gb"`
+			IP           string   `json:"ip"`
+			GW           string   `json:"gw"`
+			Bridge       string   `json:"bridge"` // e.g. vmbr0/vmbr1 — which bridge actually reaches the target subnet on this host varies per host, don't assume vmbr0
+			Storage      string   `json:"storage"`
+			Template     string   `json:"template"`
+			Privileged   flexBool `json:"privileged"`
+			Nesting      flexBool `json:"nesting"`
+			Mounts       []string `json:"mounts"`
+			Nameserver   string   `json:"nameserver"`
+			Searchdomain string   `json:"searchdomain"`
 			// No services/post_install here anymore — pct_create is atomic
 			// (create + start + register only). Installing packages and
 			// running setup scripts is the agent's job via follow-up `run`
@@ -504,7 +579,7 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 		}

 		slog.Info("httpapi: pct_create running", "vmid", cfg.VMID, "hostname", cfg.Hostname, "cmd", createCmd)
-		output, err = sshExec(ctx, host, user, createCmd)
+		output, err = sshExecStream(ctx, host, user, createCmd, sink)

 		// pct_create is now DELIBERATELY ATOMIC: create + start + register,
 		// nothing else. It used to also run apt installs and a post_install
@@ -579,7 +654,7 @@ func executeApprovedAction(ctx context.Context, pool *db.Pool, execID uuid.UUID,
 			return
 		}
 		cmd = wrap(cfg.Command)
-		output, err = sshExec(ctx, host, user, cmd)
+		output, err = sshExecStream(ctx, host, user, cmd, sink)

 	default:
 		slog.Error("httpapi: unknown gated action for approved execution", "action", action, "execution_id", execID)
--- a/internal/httpapi/default_checks.go
+++ b/internal/httpapi/default_checks.go
@@ -4,10 +4,30 @@ import (
 	"context"

 	"github.com/dtoro/oikos/internal/checkdefaults"
+	"github.com/dtoro/oikos/internal/db"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 )

-func ensureDefaultChecks(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType string, attrsJSON []byte) {
-	checkdefaults.Ensure(ctx, tx, entityID, slug, entityType, attrsJSON)
+// ensureDefaultChecks derives an entity's default checks from the monitoring
+// kinds its type declares.
+//
+// Note the ordering caveat: an entity created through the API usually has no
+// edges yet, so a type whose address comes from its host (a service) will
+// produce no checks on this pass. That gap is real and deliberately visible —
+// coverageSweep reports it, and the next inventory ingest fills it in once
+// the hosting edge exists.
+func ensureDefaultChecks(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType, name string, attrsJSON []byte) error {
+	tree, err := db.LoadTypeTree(ctx, tx)
+	if err != nil {
+		return err
+	}
+	res, err := checkdefaults.Ensure(ctx, tx, tree, checkdefaults.Target{
+		ID: entityID, Slug: slug, Type: entityType, Name: name, Attrs: attrsJSON,
+	})
+	if err != nil {
+		return err
+	}
+	checkdefaults.LogResult(slug, entityType, res)
+	return nil
 }
--- a/internal/httpapi/execution_logs.go
+++ b/internal/httpapi/execution_logs.go
@@ -0,0 +1,55 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/dtoro/oikos/internal/execlog"
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+)
+
+// serveExecutionLogs returns an execution's streamed command output.
+//
+// Registered as a carve-out rather than through the OpenAPI codegen for the
+// same reason as /activity/recent: it is a recency-ordered projection with no
+// schema type yet. Without this the execution_logs rows would be write-only —
+// which is the exact shape of the bugs this whole change set has been about.
+func (s *Server) serveExecutionLogs(w http.ResponseWriter, req *http.Request) {
+	ctx := req.Context()
+
+	rawID := chi.URLParam(req, "id")
+	execID, err := uuid.Parse(rawID)
+	if err != nil {
+		writeProblem(w, req, http.StatusBadRequest, "invalid execution id", rawID)
+		return
+	}
+
+	limit := 1000
+	if l := req.URL.Query().Get("limit"); l != "" {
+		if n, perr := strconv.Atoi(l); perr == nil && n > 0 && n <= 5000 {
+			limit = n
+		}
+	}
+
+	chunks, err := execlog.Read(ctx, s.pool, execID, limit)
+	if err != nil {
+		writeProblem(w, req, http.StatusInternalServerError, "query failed", err.Error())
+		return
+	}
+
+	// Also hand back the concatenation, since that is what a caller tailing
+	// output actually wants to render.
+	var combined strings.Builder
+	for _, c := range chunks {
+		combined.WriteString(c.Chunk)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(map[string]any{
+		"items":    chunks,
+		"combined": combined.String(),
+	})
+}
--- a/internal/httpapi/executions.go
+++ b/internal/httpapi/executions.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
+	"time"

 	"github.com/dtoro/oikos/internal/db/sqlcgen"
 	"github.com/dtoro/oikos/internal/domain"
@@ -15,8 +17,22 @@ import (

 // ─── Executions ────────────────────────────────────────────────────────

+// ListExecutions returns executions newest-first.
+//
+// The target/action/correlation_id filters are declared in the OpenAPI spec and
+// generated into the request struct, but were never bound — so
+// `GET /executions?target=<id>` silently returned the first page of the whole
+// fleet. Ordering was by target slug, which is neither useful for a history
+// view nor unique enough to paginate on: several executions share a target, so
+// a slug cursor could skip or repeat rows.
 func (s *Server) ListExecutions(ctx context.Context, req gen.ListExecutionsRequestObject) (gen.ListExecutionsResponseObject, error) {
 	limit := clampLimit(req.Params.Limit)
+
+	cursorTime, cursorID, err := parseExecutionCursor(req.Params.Cursor)
+	if err != nil {
+		return nil, err
+	}
+
 	rows, err := s.pool.Query(ctx, `
 		SELECT e.entity_id, e.classification_id::text, e.signal_entity_id::text,
 		       e.target_entity_id, e.action, e.risk_class,
@@ -27,10 +43,18 @@ func (s *Server) ListExecutions(ctx context.Context, req gen.ListExecutionsReque
 		FROM executions e
 		JOIN entities te ON te.id = e.target_entity_id
 		WHERE ($1::text IS NULL OR e.status = $1)
-		  AND ($2::text IS NULL OR te.slug > $2)
-		ORDER BY te.slug
-		LIMIT $3`,
-		req.Params.Status, req.Params.Cursor, limit+1)
+		  -- target accepts a slug or a uuid: the SPA passes an entity id,
+		  -- while a human poking the API reaches for the slug.
+		  AND ($2::text IS NULL OR te.slug = $2 OR e.target_entity_id::text = $2)
+		  -- the run tool encodes action as "run:{json}", so match the verb too
+		  AND ($3::text IS NULL OR e.action = $3 OR split_part(e.action, ':', 1) = $3)
+		  AND ($4::text IS NULL OR e.correlation_id = $4)
+		  AND ($5::timestamptz IS NULL
+		       OR (e.created_at, e.entity_id) < ($5::timestamptz, $6::uuid))
+		ORDER BY e.created_at DESC, e.entity_id DESC
+		LIMIT $7`,
+		req.Params.Status, req.Params.Target, req.Params.Action, req.Params.CorrelationId,
+		cursorTime, cursorID, limit+1)
 	if err != nil {
 		return nil, err
 	}
@@ -64,7 +88,9 @@ func (s *Server) ListExecutions(ctx context.Context, req gen.ListExecutionsReque
 	var next *string
 	if len(items) > limit {
 		items = items[:limit]
-		next = &items[len(items)-1].Slug
+		last := items[len(items)-1]
+		cursor := formatExecutionCursor(last.CreatedAt, last.Id)
+		next = &cursor
 	}
 	if items == nil {
 		items = []gen.Execution{}
@@ -72,6 +98,32 @@ func (s *Server) ListExecutions(ctx context.Context, req gen.ListExecutionsReque
 	return gen.ListExecutions200JSONResponse{Items: items, NextCursor: next}, nil
 }

+// Executions are ordered by (created_at DESC, entity_id DESC), so the cursor
+// has to carry both — created_at alone is not unique, and paginating on a
+// non-unique key drops or repeats rows at page boundaries.
+func formatExecutionCursor(createdAt time.Time, id uuid.UUID) string {
+	return createdAt.UTC().Format(time.RFC3339Nano) + "," + id.String()
+}
+
+func parseExecutionCursor(cursor *string) (*time.Time, *uuid.UUID, error) {
+	if cursor == nil || *cursor == "" {
+		return nil, nil, nil
+	}
+	rawTime, rawID, ok := strings.Cut(*cursor, ",")
+	if !ok {
+		return nil, nil, domain.ErrInvalidInput
+	}
+	t, err := time.Parse(time.RFC3339Nano, rawTime)
+	if err != nil {
+		return nil, nil, domain.ErrInvalidInput
+	}
+	id, err := uuid.Parse(rawID)
+	if err != nil {
+		return nil, nil, domain.ErrInvalidInput
+	}
+	return &t, &id, nil
+}
+
 func (s *Server) GetExecution(ctx context.Context, req gen.GetExecutionRequestObject) (gen.GetExecutionResponseObject, error) {
 	id, err := s.resolveEntityID(ctx, req.Id)
 	if err != nil {
--- a/internal/httpapi/executions_cursor_test.go
+++ b/internal/httpapi/executions_cursor_test.go
@@ -0,0 +1,64 @@
+package httpapi
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// The cursor carries both created_at and entity_id because executions are
+// ordered by the pair. created_at alone is not unique — several executions can
+// share a millisecond — and paginating on a non-unique key silently drops or
+// repeats rows at page boundaries. The previous cursor was the target slug,
+// which is far less unique still: every execution against the same host shares
+// it.
+func TestExecutionCursorRoundTrips(t *testing.T) {
+	created := time.Date(2026, 7, 28, 9, 15, 30, 123456789, time.UTC)
+	id := uuid.MustParse("018f3a2b-0000-7000-8000-000000000042")
+
+	cursor := formatExecutionCursor(created, id)
+
+	gotTime, gotID, err := parseExecutionCursor(&cursor)
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if !gotTime.Equal(created) {
+		t.Errorf("time round-trip: got %v, want %v", gotTime, created)
+	}
+	if *gotID != id {
+		t.Errorf("id round-trip: got %v, want %v", *gotID, id)
+	}
+}
+
+func TestExecutionCursorNanosecondsSurvive(t *testing.T) {
+	// Truncating to seconds would make the cursor ambiguous for executions
+	// started in the same second, which is the normal case for a plan whose
+	// steps run back to back.
+	a := time.Date(2026, 7, 28, 9, 15, 30, 1, time.UTC)
+	b := time.Date(2026, 7, 28, 9, 15, 30, 2, time.UTC)
+	id := uuid.New()
+
+	if formatExecutionCursor(a, id) == formatExecutionCursor(b, id) {
+		t.Error("cursors one nanosecond apart must not collide")
+	}
+}
+
+func TestExecutionCursorRejectsGarbage(t *testing.T) {
+	empty := ""
+	tm, id, err := parseExecutionCursor(&empty)
+	if err != nil || tm != nil || id != nil {
+		t.Errorf("empty cursor should mean 'no cursor', got %v/%v/%v", tm, id, err)
+	}
+
+	if tm, id, err := parseExecutionCursor(nil); err != nil || tm != nil || id != nil {
+		t.Errorf("nil cursor should mean 'no cursor', got %v/%v/%v", tm, id, err)
+	}
+
+	for _, bad := range []string{"nonsense", "2026-07-28T09:15:30Z", "notatime,018f3a2b-0000-7000-8000-000000000042", "2026-07-28T09:15:30Z,notauuid"} {
+		b := bad
+		if _, _, err := parseExecutionCursor(&b); err == nil {
+			t.Errorf("cursor %q should have been rejected", bad)
+		}
+	}
+}
--- a/internal/httpapi/impl.go
+++ b/internal/httpapi/impl.go
@@ -999,7 +999,9 @@ func (s *Server) CreateEntity(ctx context.Context, req gen.CreateEntityRequestOb
 		return nil, eventErr
 	}

-	ensureDefaultChecks(ctx, tx, inserted.ID, slug, req.Body.Type, attrsJSON)
+	if err := ensureDefaultChecks(ctx, tx, inserted.ID, slug, req.Body.Type, inserted.Name, attrsJSON); err != nil {
+		return nil, err
+	}

 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
@@ -1265,7 +1267,9 @@ func (s *Server) EnrollClient(ctx context.Context, req gen.EnrollClientRequestOb
 		"info", "oikos-api", "",
 		map[string]any{"slug": req.Body.Slug, "type": current.Type})

-	ensureDefaultChecks(ctx, tx, id, req.Body.Slug, current.Type, attrsJSON)
+	if err := ensureDefaultChecks(ctx, tx, id, req.Body.Slug, current.Type, current.Name, attrsJSON); err != nil {
+		return nil, err
+	}

 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
--- a/internal/httpapi/server.go
+++ b/internal/httpapi/server.go
@@ -111,6 +111,7 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 	//   /api/v1/knowledge/content/{id} — returns raw markdown, not a gen type
 	//   /api/v1/activity/recent        — recency-ordered, not paginated
 	//   /api/v1/activity/session/{id}  — session-scoped aggregation
+	//   /api/v1/executions/{id}/logs   — streamed command output, no schema type
 	//   /api/v1/learning/timeline      — derived view, no backing schema type
 	//   /api/v1/learning/trend         — derived view, no backing schema type
 	//
@@ -207,6 +208,11 @@ func NewHandler(ctx context.Context, pool *db.Pool, cfg config.Config) http.Hand
 	// per-session "what did this session do" digest.
 	// (See "Non-OpenAPI routes" carve-out block above.)
 	r.With(combinedAuth(cfg, false)).Get("/api/v1/activity/recent", s.serveRecentActivity)
+	// Streamed command output for one execution — a projection over
+	// execution_logs with no schema type yet (same carve-out rationale as
+	// /activity/recent above). Nests cleanly under the generated
+	// /executions/{id} subtree: chi accepts sibling children on a param node.
+	r.With(combinedAuth(cfg, false)).Get("/api/v1/executions/{id}/logs", s.serveExecutionLogs)
 	r.With(combinedAuth(cfg, false)).Get("/api/v1/activity/session/{id}", s.serveSessionDigest)

 	// Learning view: capability timeline + success trend, both derived from
@@ -349,10 +355,10 @@ func staticTokenActor(cfg config.Config, raw string) (actor, bool) {
 // jwtVerificationKey holds a parsed RSA public key or HMAC secret for JWT
 // verification, identified by its key ID (kid).
 type jwtVerificationKey struct {
-	Kid     string
-	Alg     string
-	Key     any // *rsa.PublicKey or []byte for HMAC
-	IsHMAC  bool
+	Kid    string
+	Alg    string
+	Key    any // *rsa.PublicKey or []byte for HMAC
+	IsHMAC bool
 }

 // discoverJWKSURI fetches the OIDC discovery document and extracts the
@@ -598,8 +604,8 @@ func resolveOIDCTokenURL(issuer string) string {
 func (s *Server) serveOIDCConfig(w http.ResponseWriter, _ *http.Request, cfg config.Config) {
 	w.Header().Set("Content-Type", "application/json")
 	json.NewEncoder(w).Encode(map[string]string{
-		"issuer":                cfg.OIDCIssuer,
-		"client_id":             cfg.OIDCClientID,
+		"issuer":                 cfg.OIDCIssuer,
+		"client_id":              cfg.OIDCClientID,
 		"authorization_endpoint": resolveOIDCEndpointURL(cfg.OIDCIssuer, "/authorize/"),
 	})
 }
@@ -863,4 +869,4 @@ func ListenAndServe(ctx context.Context, pool *db.Pool, cfg config.Config) error
 		defer cancel()
 		return srv.Shutdown(shutdownCtx)
 	}
-}
+}