SSA Screening Operations Runbook

ssa_screening_oldest_pending_seconds

gauge

Age of the oldest pending/in_flight job — the pipeline-stall watchdog. Recorded every worker drain pass, explicit 0 when drained. paused rows are NOT counted here (they have their own pair below).

ssa_screening_paused_jobs{reason}
ssa_screening_oldest_paused_age_seconds

gauges

The H16 pause depths by categorical token (contract-pending, gate-disabled, partner-unavailable, dsa-not-active, egress-refused) and the oldest pause’s age. Re-admission is ONLY the #1469 resume endpoint.

ssa_screening_job_errors_total{class}

counter

Per-attempt failures by categorical class (custody-unavailable, outcome-unavailable, the partner-* classes, request-encoding, partner-malformed).

ssa_retry_exhaustion_total

counter

Jobs terminally failed at the retry cap (member + job + run finalized in one transaction; counted post-commit).

ssa_partner_request_duration_seconds{outcome}

histogram

SOLQ partner round-trip wall time, outcome ∈ {ok, error} (the error CLASS is the counter above — join on time, not labels).

ssa_retention_lag_rows{class}

gauge

Rows past their retention window still present: transport (should drain to ~0 within one sweep cycle; the detector is deliberately WIDER than the sweep’s eligibility, so unsweepable family shapes surface here too) and provenance (nonzero is EXPECTED while the consent-gated archiver is off). Recorded hourly by the transport sweep’s executed pass — with the sweep disabled (TRANSPORT_RETENTION_DAYS=0) this gauge AND ssa_screening_held_runs are ABSENT, not zero (the report-only overrun invariant is the remaining backstop; window 0 is a devstack/test posture, UD4-noncompliant in production, and refused outright while the archiver is consented).

ssa_screening_held_runs

gauge

Runs under a UD10 legal hold (deliberate stops — excluded from the lag classes above). Same recorder as the lag gauge: absent while the sweep is disabled.

ssa_screening_ready

gauge

1 = the gate knob is ON and every live dispatch precondition holds; 0 = enabled-but-unready (the probe logs the held token on transitions). ABSENT while the gate is off. This is deliberately a metrics-plane signal, not /readyz — a partner-side condition must never unroute the pod.

CRAIG_EXCHANGESSA_SCREENINGTRANSPORT_RETENTION_DAYS

90

The UD4 transport window — a CEILING, load()-validated 0..=90 (0 = the sweep registers Disabled; a devstack/test posture that is UD4-noncompliant in production, silences the lag/held gauges, and is REFUSED at boot while the archiver is consented). Terminal jobs + their SSA transaction rows are snapshotted into ssa_transport_handoffs and pruned in one transaction.

CRAIG_EXCHANGERETENTION_ARCHIVEENABLED

false

The D11 consent knob for the provenance archiver (handoffs → members → runs, FK-ordered). Enabling requires an S3-class store (the D10 boot probe refuses Local) and the exchange floor HOT_WINDOW_DAYS ≥ 365.

Purge

—

No purge tooling exists — refused until DFCS names a records-retention schedule (#1480). Archived objects are held indefinitely.