[jmfk]

Operators currently need direct server/database access to investigate production failures. This adds an opt-in, machine-only diagnostics API for bounded sanitized log search and masked database inspection across explicitly authorized tenants.

This PR is stacked on #274 (codex/workspace-messaging-roles); its diff contains only the diagnostics batch.

Changes

• Require explicit log/data/global diagnostic scopes, independent of CMS full access and ordinary role defaults. Bind opaque cursors and tenant selection to the current machine key.
• Add reviewed masked PostgreSQL views and a dedicated read-only login, with parameterized filters and no client SQL. Unreviewed fields/tables remain excluded.
• Export sanitized, signed error metadata through a bounded host timer; mount exports read-only in the backend without exposing the Docker socket. Preserve gaps, retention limits and stale-export indicators.
• Include protected credential provisioning, the helper/skill, OpenAPI contracts, PRD/ADR and operator installation/recovery instructions. Include helper tests in the existing Python CI discovery job.

Local verification

Backend commands ran against an isolated snapshot of this branch in the existing backend container, using only disposable test databases:

• python manage.py test core.diagnostics.tests --settings=core.diagnostics.test_settings --noinput — 23 passed; four new regression cases reproduced the reviewed defects before fixes.
• python manage.py test core.diagnostics.test_postgres --settings=core.diagnostics.postgres_test_settings --noinput — 6 passed, including real privilege denial, indirect tenant ownership, masking, timeout, pagination and unsafe inherited grants.
• python3 -m unittest discover -s scripts/tests -p test_diagnostics_helper.py -v — 5 passed.
• Changed backend Python files: Black 25.11.0, isort and flake8 — passed. CI helper wrapper lint — passed.
• python manage.py spectacular --settings=core.diagnostics.test_settings --file /tmp/eceee-diagnostics-pr-schema.yaml --validate --fail-on-warn — passed.
• Specs governance, skill validation, Python syntax, compose/unit static checks, bounded credential scan and git diff --check — passed.

Risk and rollout

This requires careful review of new diagnostic authorization, cross-tenant selection and PostgreSQL role/view provisioning. It adds no application-data migration or backfill. Access is disabled by default; production credentials, views, host timer installation and enabling the feature require separate owner gates. No production reads, provisioning or deployment have been performed. The Linux timer has been statically checked but not exercised on the production host.

A full local backend Django run passed 1,639 tests (18 skipped) on the current backend-editor image. The initial older-image attempt lacked ffmpeg; no product fix was needed for that environment issue. Frontend suites were not repeated because no frontend behavior changed; their prior Full CI evidence remains separate. Full CI is requested again for the updated authorization/database/deployment surface. This PR is worth a full CI run. CI results are verification, not code-review approval or merge authorization.

Review fixes

• Fix ordinary Django discovery declaring the absent optional diagnostics DB alias, which blocked the previous Full CI backend job before tests ran.
• Report input/time exhaustion even when the log-producing child has already exited successfully.
• Journal sanitized segments and checkpoints before publication and recover the same publication idempotently after interruption, preventing duplicate events.
• Bound source metadata to the latest 100 retained gap entries and report the retained count/truncation flag.

All four findings were P2 and have focused reproductions. Final independent review and current-head CI are reported separately from code-review/merge authorization.