docs: WIP/HISTORY — fleet-metrics deployed, trilogy complete

Co-Authored-By: Gerald KERMA <devel@cybermind.fr>

.claude/HISTORY.md

@@ -3,6 +3,14 @@
 
 ---
 
+## 2026-07-27 — fleet-metrics: centralized+meshed node snapshots (trilogy 3/3, #912, deployed gk2)
+
+Last sub-project of the "auto-centre" trilogy. Each node signs a compact `MetricSnapshot` (vitals + module health + counters) with its sovereign node key into a dedicated last-wins store `/var/lib/secubox/annuaire/fleet/self.json` (NOT the immutable CSPN journal — it can't be pruned); peers pull each other's over the existing `:8799` gondwana mesh read-path (`GET /fleet/self`, public signed, mirrors `/log/export`); `GET /fleet` (JWT) aggregates self + verified peers concurrently (asyncio.gather + to_thread — never blocks the aggregator loop); a `/fleet` panel renders the mesh. Built SDD (5 tasks + opus whole-branch review). `secubox-annuaire 0.10.0`, 424 tests.
+
+- **Security:** `verify_snapshot` fail-closed 4-way DID binding (`did_from_pubkey(signer_pub)==signer_did==node_did==issued_by` + Ed25519); a peer can't serve a snapshot under another node's DID. `sign_snapshot` signs the normalized model payload. Publisher `User=secubox` (node key, non-root); opt-in `[metrics] fleet_publish`.
+- **Final-review blocking fix:** the `:8799` listener template is an exact-match allow-list — `/fleet/self` was missing → peer pulls 403, the meshed half inert (tests all mocked the fetch). Added the location (mirror `/log/export`, postinst-rendered) + 2 regression tests; re-review MERGEABLE.
+- **Deployed gk2:** `/fleet`=401 JWT, panel=200, `:8799/fleet/self`=200, publisher timer ~60s, signed self.json. Trilogy complete (Centres&Grants + assist + fleet-metrics, all deployed). Follow-ups: deploy c3box/amd64; module-health counts oneshots as "down" (filter to `failed`); disk_pct/soc_alerts sources.
+
 ## 2026-07-27 — Trilogy sub-projects 1-2 finalized + p2p-ephemeral foundation (deployed gk2)
 
 Large session across three deployed deliverables (all merged to master, SDD + opus final reviews):

.claude/WIP.md

@@ -12,9 +12,14 @@ Grosse session : sous-projets 1-2 de la trilogie finalisés/durcis + déployés,
 - **INCIDENT (résolu)** : déployer annuaire 0.8.1 (master) par-dessus 0.7.0 (assist-dual non-mergé) a **droppé `assist_match.py`** → assist API 502. Réparé en mergeant assist-dual→master (annuaire **0.9.0** superset). Leçon en mémoire : ne jamais déployer une lib partagée par-dessus une branche déployée-non-mergée.
 - **p2p-ephemeral (PR #911, secubox-p2p 1.11.0 + secubox-assist 0.2.3, déployé)** : `secubox-p2pctl` (CLI root neuf) + iface `wg-ephemeral` persistante-silencieuse (10.11.0.0/24, udp/51825), peers WG scopés-session pour l'escalade assist, auto-révoqués (backstop TTL sweep). L'assist `join` **exec** enfin via `sudo -n`. 4 tâches SDD + revue opus MERGEABLE. Bonus sécu : sudo `env_reset` strippe les `P2P_*` (pas de substitution de faux `wg`). Installé via `--force-depends` (aiohttp/websockets fournis par pip). Iface up + silencieuse vérifiée live.
 
+### ✅ 2026-07-27 : fleet-metrics — métriques centralisées+meshed (sous-projet 3/3, PR #912, déployé gk2)
+
+Dernier de la trilogie. Chaque nœud signe un `MetricSnapshot` (vitals+santé+compteurs) dans un store dédié last-wins `self.json` (PAS le journal CSPN immuable) ; les pairs se tirent mutuellement sur `:8799` (`/fleet/self` public signé, mirror `/log/export`) ; panneau `/fleet`. 5 tâches SDD + revue opus. `secubox-annuaire 0.10.0`, 424 tests. Bloquant rattrapé en revue finale : le listener `:8799` (allow-list exact-match) n'exposait pas `/fleet/self` → pulls 403 (moitié meshed inerte) — corrigé + tests. Déployé+vérifié gk2 : `/fleet`=401 JWT, panneau=200, `:8799/fleet/self`=200, timer publie ~60s. **TRILOGIE COMPLÈTE** (Centres&Grants ✅ + assist ✅ + fleet-metrics ✅, tous déployés).
+
 ### ⬜ Next
-- **Sous-projet 3/3 — métriques centralisées+meshed** (dernier de la trilogie) : brainstorm à démarrer.
-- **Fast-follow p2p-ephemeral** : câbler `cmd_close`→`escalate.teardown` (actuellement sweep-only, peer vit jusqu'au TTL ≤4h/reboot) ; commentaire caveat `env_keep` au sudoers. **Phase 2** : rendezvous HTTPS `/assist/join/<token>`.
+- **fleet-metrics** : déployer aussi c3box + amd64 (les 2 autres nœuds mesh) ; **health-noise** — `metrics_collect` compte tout unit `secubox-*` non-active comme "down" (incl. oneshots/timers by-design) → filtrer sur état `failed` ; sources disk_pct/soc_alerts (=0 actuellement).
+- **Fast-follow p2p-ephemeral** : câbler `cmd_close`→`escalate.teardown` (sweep-only, peer vit jusqu'au TTL ≤4h/reboot) ; caveat `env_keep` au sudoers ; **Phase 2** rendezvous HTTPS `/assist/join/<token>`.
+- **Dette Depends pip-shadow** : `secubox-p2p` (aiohttp), `secubox-eye-square`/`secubox-soc-gateway` (websockets) → passer en Recommends (comme assist 0.2.2).
 - **Prérequis deploy** : Freebox UDP/**51825** forward → gk2 (escalade externe réelle). reprepro `sync-repo` reste manuel (passphrase GPG).
 - **Dette Depends pip-shadow** : `secubox-p2p` (aiohttp), `secubox-eye-square`/`secubox-soc-gateway` (websockets) ont le même hard-Depends absent sur gk2 → passer en Recommends (comme assist 0.2.2).