fix(observability): wire auto.interview.* events to EventStore (PR-ε)

[shaun0927]

Summary

`ouroboros_query_events` returns 0 events for auto sessions even when the interview loop demonstrably ran and emitted structlog events. This is the F2 follow-up from #1170 R2-diag (companion to PR-β #1252 substrate fix and PR-γ #1253 harness fix).

Diagnostic evidence

R2-diag (cli-todo canonical, auto_8afc447d551f, interview_c4dd59b4f57b43f7) showed:

• mcp__ouroboros__ouroboros_query_events(auto_session_id) → 0 events.
• mcp__ouroboros__ouroboros_session_status(interview_session_id) → "Session not found".
• Yet the interview loop demonstrably ran 12 rounds (visible in the BLOCKED envelope's blocker text and stop-reason).

Same regression observed in #1170 R2 (20260526-1636) and reproduced under R2-1709.

Root cause (confirmed by grep)

• src/ouroboros/auto/interview_driver.py:41 uses structlog.get_logger(__name__) only. Every log.info(\"auto.interview.*\", ...) call goes to structlog's configured sink (stderr / stdout / file handler depending on env), not to EventStore.
• EventStore is wired into the auto pipeline only via Ralph's job_event_store (see src/ouroboros/auto/pipeline.py:1350-1356 and adjacent). The interview phase has no parallel append path.
• mcp__ouroboros__ouroboros_query_events reads from EventStore, so it never sees the interview events. There is no architectural bug — the two systems are genuinely separate.

Why this matters

The L0 acceptance gate (#1170) relies on post-hoc evidence inspection. With structlog as the only sink for interview events, query_events is misleading (returns 0 even when the interview ran), and the interview session detachment from session_status makes resume diagnostics opaque.

The user-visible promise of ooo auto (per SSOT #1157 Closure Policy, 2026-05-27) is "produce a verifiable artifact then refine via evolutionary loop." Verification depends on inspectable evidence; right now the interview phase produces none that query_events can surface.

Design questions (needs-design)

Two viable approaches; pick one as the design contract:

Option A — Wire interview events to EventStore

Make interview_driver append a typed auto.interview.* event family to EventStore alongside its structlog emission. New event family entries (per #946 substrate vocabulary):

• auto.interview.opened / auto.interview.round_answered / auto.interview.ledger_only_closure / auto.interview.safe_default.{entered,closed,partial_unsafe_gaps} / auto.interview.blocked.

Pros: query_events becomes the SSOT for interview evidence. Resume diagnostics work. L0 evidence files can pull from one queryable surface.

Cons: new substrate (event family registration, schema migration if any). Coupling between interview_driver and EventStore wiring (currently interview_driver is store-agnostic).

Option B — Clarify the contract; expand inspectability via interview_session_id

Keep structlog as interview-event sink; expose a separate mcp__ouroboros__ouroboros_interview_status(interview_session_id) (or extend session_status to resolve nested interview ids). Document that query_events is for EventStore-stream events only (Ralph job lifecycle, watchdog, etc.).

Pros: minimal substrate addition. Honors existing separation.

Cons: dual surfaces for evidence retrieval. Acceptance reporter (#1170) must consult both. Doesn't fix the "Session not found" detachment by itself — interview events still aren't in a queryable store.

Recommendation

Option A aligns better with SSOT #1157's "every terminal carries one typed reason_code, no silent abandonment" invariant (Success Conditions #5/#7). A single queryable EventStore surface for the interview phase makes the canonical acceptance contract (#1170) verifiable without out-of-band log scraping. The substrate addition is bounded — one event family, additive to projection v1.

Acceptance criteria

• log.info(\"auto.interview.safe_default.entered\", ...) and the other interview structured events also call EventStore.append_event(...) (or equivalent) with the same payload shape.
• mcp__ouroboros__ouroboros_query_events(auto_session_id) returns the interview event stream when re-running the Meta SSOT slice: L0 — Canonical Test Harness for ooo auto acceptance #1170 R2-diag scenario.
• mcp__ouroboros__ouroboros_session_status(interview_session_id) resolves the nested interview session id (no "Session not found").
• PR-γ test(canonical): runtime-binary preflight + raw MCP passthrough (PR-γ) #1253's evidence-integrity contract pulls events from EventStore instead of relying on the worker session to capture structlog output.

Companion work

• PR-β feat(auto): make ledger_done the primary interview closure check (PR-β) #1252 (substrate ledger-primary closure) — independent
• PR-γ test(canonical): runtime-binary preflight + raw MCP passthrough (PR-γ) #1253 (canonical harness preflight + raw passthrough) — independent
• PR-δ (0.39.2 release cut) — independent

References

• Meta SSOT slice: L0 — Canonical Test Harness for ooo auto acceptance #1170 R2-diag (F2 finding) — original diagnostic that surfaced this.
• Meta SSOT: ooo auto Vision — Autonomous Completion Engine #1157 SSOT closure policy section (2026-05-27).
• [Feature] Define Run/Step/Artifact projections as the canonical harness vocabulary #946 EventStore vocabulary (for new event family registration).

[ouroboros-agent]

This looks like a multi-PR effort that needs design discussion before implementation. Labeling needs-design for human planning.

Scope assessment:

• Affected modules/files: src/ouroboros/auto/interview_driver.py, src/ouroboros/auto/pipeline.py, src/ouroboros/persistence/event_store.py, src/ouroboros/mcp/tools/query_handlers.py, and the interview/EventStore event definitions under src/ouroboros/events/.
• Estimated complexity: architectural. The issue asks to define the canonical evidence contract for auto interview telemetry, add or map a typed auto.interview.* event family, preserve EventStore query semantics, and resolve nested interview_session_id lookup behavior.
• Suggested approach: first decide whether Option A or Option B is the design contract. If Option A is accepted, split implementation into bounded PRs for event model/wiring, query/session-status projection behavior, and evidence harness updates.

ouroboros-agent[bot]

[shaun0927]

Scope expansion under RFC #1256 §I4

RFC #1256 §I4 (Unified observability) supersedes this issue's single-family scope. The original PR-ε targeted auto.interview.* events only; §I4 makes the same fix mandatory for every ooo auto state transition.

R3 evidence reinforces severity

R3 run (~/.ooo-observability/R3-20260527-131856/) showed eventstore-dump.tsv is 0 bytes for a 602 s live session that emitted ≥ 19 interview-related structlog lines + 4 mcp.tool.interview.* lines. The observability gap is not specific to interview events — the entire EventStore stayed silent for the session.

Expanded event families required (§I4)

Per RFC #1256, every ooo auto transition must emit a typed EventStore event:

• session lifecycle: auto.session.{started, finalized, partial}
• interview: auto.interview.{opened, round_answered, slot_auto_filled, ledger_done, deadline_fired} — original PR-ε scope
• closure ladder: auto.closure.{unstuck_entered, reframe_entered, safe_default_entered, partial_seed_generated}
• wall-clock: runtime.deadline.{interview, phase, session, runtime}.fired — also covers fix(auto): interview_phase_deadline preempts closure ladder (RFC #1256 §I2) #1257's typed deadline event need
• product emission: auto.product.{emitted, partial_emitted} with artifact reference

Implementation phasing

This issue becomes a multi-PR umbrella. Original PR-ε is the first slice (interview family). Subsequent slices cover the remaining families above. Each slice is a separate PR; the umbrella tracks completion.

Falsifiable acceptance (per §I4)

For any ooo auto session, ouroboros_query_events(session_id) returns ≥ 1 typed event of each lifecycle phase the session entered. The R3 0-byte dump is the state §I4 forbids.

Cross refs

• RFC RFC: ooo auto Product-or-Die Invariant — Closure Ladder Redefinition #1256 §I4
• fix(auto): interview_phase_deadline preempts closure ladder (RFC #1256 §I2) #1257 (typed runtime.deadline.*.fired event is dual-covered here and there)
• Meta SSOT slice: L0 — Canonical Test Harness for ooo auto acceptance #1170 (§I4 enables the silent-pass detection that L0 close trigger requires)