Description
codexlb2otel has been turned off on camden and this replaces it. The service reads /opt/agent-sessions read-only and exports to the local Alloy on 4318, which Fleet Management already routes to Grafana Cloud, so the service holds no Grafana credential.
Acceptance Criteria
- #1 A hardened systemd unit runs the service as a dedicated unprivileged user with ReadOnlyPaths on the transcript tree
- #2 systemd-analyze verify is clean and the installed file hash matches the source
- #3 State lives in /var/lib/codingagent2otel and nothing is written under /opt/agent-sessions
- #4 The unit does not interfere with agent-session-archive.timer, agent-session-index.timer or agent-session-metrics.timer
- #5 A validation run covers both a successful collection and an injected source failure
- #6 Live verification: a named metric, a named log record and a named span are each confirmed present in Grafana Cloud after the install, not just a green unit
Definition of Done
- #1 just check passes: fmt-check, lint, build, test-short, probe-ci, dashboard-check and docs-links all clean
Implementation Plan
Wave 1 lane 12: after the integrated exact-SHA gate is green, root installs the systemd deployment on camden and verifies one metric, log and span in the m7kni stack.
Implementation Notes
Superseded in mechanism by CAOT-0039 on 2026-09-22. Rob’s standing rule is that camden runs containers under /opt following /opt/CLAUDE.md, never a hand-placed binary, so the systemd unit this task commissioned is being decommissioned rather than expanded. CAOT-0039 owns the compose deployment and the decommission.
What survives here is the only thing this task still gates: expanding the installed namespace list from the bounded set (codex-personal/sessions/2026/09/22 plus claude-personal/projects/-home-rob) to the full rolling roots, and proving stable memory and the three live signals at that scale. That expansion needs CAOT-0002 (collision-safe identity) and CAOT-0040 (bounded sweep) first, and it lands on the container from CAOT-0039, not on a unit.
Final Summary
Parked for full production coverage despite passing every deployment acceptance check on the bounded install. Camden is healthy as codingagent2otel with matching hashes, read-only transcript access, durable state, three unaffected timers, injected failure exit 1, and live Mimir/Loki/Tempo proof. Resume after CAOT-0002 makes full rolling namespaces collision-safe; then replace the bounded namespace list and prove stable memory.