implemented observability

AGENTS.md

@@ -41,9 +41,12 @@ internal/
       drift.go                — CheckDrift, handlePush, periodicCheck
       reconciler.go           — TriggerSync, handleDeploymentSucceeded/Failed
     federation/               — ActivityPub / ForgeFed (DATA LAYER ONLY — Phase 3F stub)
+  observability/              — Prometheus metrics + health (fully built — Phase 3E)
+    metrics.go                — metric definitions, HTTP middleware, NATS watcher
+    health.go                 — Check() returning HealthStatus (DB ping + NATS)
   models/                     — XORM structs + 13 migration files
   config/                     — ENV-driven config, fails fast on missing secrets
-  events/                     — NATS EventBus interface + NATSBus + NoOpBus
+  events/                     — NATS EventBus interface + NATSBus + NoOpBus (Healthy() bool)
 web/                          — //go:embed target for the built React SPA
 frontend/
   src/
@@ -57,7 +60,7 @@ frontend/
 
 **Middleware chain — this order is fixed, do not reorder:**
 ```
-Logger → RealIP → Recoverer → CORS → CSRF → SessionAuth → AuditLog → Handler
+Logger → RealIP → Recoverer → Metrics → CORS → CSRF → SessionAuth → AuditLog → Handler
 ```
 
 ---
@@ -74,7 +77,7 @@ Logger → RealIP → Recoverer → CORS → CSRF → SessionAuth → AuditLog
 | 3B | Unified operational timeline | **Complete** |
 | 3C | Workspaces + secret management (Global → Workspace → Repo → Env) | **Complete** |
 | 3D | GitOps controller + drift detection + auto-sync | **Complete** |
-| 3E | Observability (Prometheus endpoint, health checks, sparklines) | **Next** |
+| 3E | Observability (Prometheus `/metrics`, structured `/health`, repo health API) | **Complete** |
 | 3F | Federation handlers (ActivityPub inbox/outbox) | Planned |
 | 4 | AI diagnostics, signed artifacts, OCI registry, dep/secret scanning | Planned |
 
@@ -200,6 +203,9 @@ make lint     # go vet + ESLint
 | `internal/domain/ci/executor.go` | Docker job executor + log streaming |
 | `internal/domain/gitops/controller.go` | GitOps reconciliation controller |
 | `internal/domain/gitops/drift.go` | `CheckDrift`, drift detection logic |
+| `internal/observability/metrics.go` | Prometheus metric defs, HTTP middleware, NATS watcher |
+| `internal/observability/health.go` | `Check()` — DB ping + NATS liveness |
+| `internal/api/handlers/observability.go` | `/health` + `/repos/.../health` handlers |
 | `internal/api/handlers/environment.go` | Environment + deployment CRUD |
 | `internal/api/handlers/gitops.go` | GitOps config + drift HTTP endpoints |
 | `internal/api/handlers/secret.go` | Scoped secret management |