SCRUM-220 — Config service metrics¶

Plan ref: CFG-B11 (docs/11-admin-plane-plan.md).

What exists¶

On the internal listener's /metrics (same registry as the HTTP metrics):

Series	Meaning
`config_publish_total{channel}`	successful `POST …/channels/{ch}/releases` (ordinary and live route). `dev`, `staging`, `live` exist at 0 from start-up. Rollback and promote are not counted
`config_validation_failures_total`	a document found invalid against its namespace schema: `draft/validate` answering `valid:false`, or version creation refused because the draft has schema issues. Malformed request bodies are not counted
`config_pack_upload_bytes_total`	unchanged (SCRUM-217)

The api package stays free of Prometheus: Handlers.Published and Handlers.ValidationFailed are optional callbacks wired in server.New, next to PackUpload.

How to verify¶

cd services/config
. ../../handoff/pg-env.sh   # local Postgres; any Postgres 16 works
gofmt -l . && go vet ./...
CONFIG_TEST_DATABASE_URL=postgres://auth_rw:pw@127.0.0.1:5433/config_test?sslmode=disable \
  go test -race -count=1 ./...
curl -s localhost:9090/metrics | grep -E 'config_(publish|validation)'

internal/server/metrics_test.go: the three channel series at 0 on a fresh server (no DB); one publish → {channel="dev"} 1, and a stale-base 409 replay leaves it at 1; validate with an invalid document and create-version from an invalid draft each add 1, a malformed body adds nothing.

Results at time of writing¶

gofmt, go vet, go test -race with the DB (8 packages): pass.

How it was built¶

DeepSeek run scoped (Landlock) to services/config (136 s, ~13k output tokens, reasoning effort low). Claude review: no changes needed.