feat(orchestrator): harden zero-impact shadow rollout

Gate and bound Portal shadow observations while preserving Native execution. Add fail-closed service boundaries, terminal retention controls, Canary readiness telemetry, ops visibility, and isolated regression coverage.

services/orchestrator/shadow-observer.mjs

@@ -4,19 +4,6 @@ import {
 } from './contracts.mjs';
 import { createRemoteWorkflowEngine } from './engine-registry.mjs';
 
-const MAX_INSTRUCTION_CHARACTERS = 16_000;
-
-function extractMessageText(message) {
-  if (typeof message === 'string') return message;
-  if (!message || typeof message !== 'object') return '';
-  if (typeof message.content === 'string') return message.content;
-  if (!Array.isArray(message.content)) return '';
-  return message.content
-    .filter((part) => part?.type === 'text')
-    .map((part) => String(part.text ?? ''))
-    .join('\n');
-}
-
 function safeError(error) {
   return {
     code: String(error?.code ?? 'WORKFLOW_SHADOW_FAILED').slice(0, 128),
@@ -38,9 +25,7 @@ export function createWorkflowShadowObserver({
     runId,
     requestId,
     userId,
-    sessionId = null,
     workflowName = 'code-run-v1',
-    userMessage,
     taskType = null,
   } = {}) {
     const selection = await configService.selectEngine({
@@ -81,19 +66,15 @@ export function createWorkflowShadowObserver({
       timeoutMs: state.config.requestTimeoutMs,
       fetchImpl,
     });
-    const instruction = extractMessageText(userMessage).slice(0, MAX_INSTRUCTION_CHARACTERS);
     const spec = normalizeRunSpec({
       runId,
       requestId,
       workflow: { name: workflowName, version: 1 },
-      subject: { userId },
+      subject: {},
       input: {
-        instruction,
+        instruction: '[shadow-control-plane-only]',
         taskType,
         toolMode: 'code',
-        sessionRef: sessionId
-          ? { kind: 'goose-session', id: String(sessionId) }
-          : null,
       },
       policy: {
         executionMode: 'observe-only',
@@ -102,6 +83,7 @@ export function createWorkflowShadowObserver({
       metadata: {
         source: 'memind-agent-run',
         configVersion: selection.configVersion,
+        dataPolicy: 'control-plane-only-v1',
       },
     });
     try {
@@ -126,7 +108,5 @@ export function createWorkflowShadowObserver({
 }
 
 export const workflowShadowObserverInternals = {
-  MAX_INSTRUCTION_CHARACTERS,
-  extractMessageText,
   safeError,
 };