feat(diagnostics): fallback SLA enforcement + field signal collection setup

Task A: Wire fallback_monitor SLA status into compute_degradation_mode()
- Add fallback_sla_met field to ModelHealth struct
- Check SLA violation in degradation cascade (Normal → IncreasingFallback → CosineOnly)
- Add test: test_fallback_sla_enforcement_normal_to_degraded
- All 673 lib tests passing

Task B: Field signal tracking infrastructure
- Create scripts/collect-field-signal.sh for weekly metrics collection
- Collects: cold-start latency, corpus growth, vulnerability count, test coverage
- Output formatted for manual STATE.a2ml [field-signal] section updates
- Ready for integration with CRG C evidence gathering

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: hyperpolymath

scripts/collect-field-signal.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Collect field signal data for STATE.a2ml [field-signal] section
+# Runs weekly to track: cold-start latency, corpus growth, vulnerability count, test coverage
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+STATE_FILE="${REPO_ROOT}/.machine_readable/6a2/STATE.a2ml"
+TIMESTAMP=$(date -u +"%Y-%m-%d")
+
+# 1. Cold-start latency from Fly.io logs (requires auth)
+echo "Collecting Fly.io cold-start metrics..."
+if command -v flyctl &> /dev/null; then
+    COLD_START=$(flyctl logs --app echidna-nesy 2>/dev/null | grep -o "cold-start latency: [0-9]*" | tail -1 | awk '{print $NF}' || echo "N/A")
+else
+    COLD_START="N/A (flyctl not installed)"
+fi
+
+# 2. Corpus size from merge_corpus.jl output or training_data directory
+echo "Collecting corpus metrics..."
+if [ -d "${REPO_ROOT}/training_data" ]; then
+    CORPUS_SIZE=$(du -sh "${REPO_ROOT}/training_data" | awk '{print $1}')
+    PROOF_COUNT=$(find "${REPO_ROOT}/training_data" -name "*.jsonl" -exec wc -l {} + | awk '{sum+=$1} END {print sum}')
+else
+    CORPUS_SIZE="unknown"
+    PROOF_COUNT="0"
+fi
+
+# 3. Open vulnerabilities from GitHub API (requires GITHUB_TOKEN)
+echo "Collecting vulnerability metrics..."
+if [ -n "${GITHUB_TOKEN:-}" ]; then
+    VULNS=$(curl -s -H "Authorization: token $GITHUB_TOKEN" \
+        "https://api.github.com/repos/hyperpolymath/echidna/vulnerability-alerts" \
+        | jq '[.[] | select(.state == "open")] | length' 2>/dev/null || echo "N/A")
+else
+    VULNS="N/A (GITHUB_TOKEN not set)"
+fi
+
+# 4. Test coverage from last test run
+echo "Collecting test coverage..."
+if [ -f "${REPO_ROOT}/target/.test_summary.txt" ]; then
+    TEST_COUNT=$(grep -o "test result:" "${REPO_ROOT}/target/.test_summary.txt" | wc -l || echo "N/A")
+else
+    TEST_COUNT="N/A"
+fi
+
+# 5. Output formatted for manual entry into STATE.a2ml
+cat << EOF
+# ─ Field signals to add to STATE.a2ml [field-signal] section ─
+
+[[field-signal.signal]]
+source = "collect-field-signal.sh automated run"
+metric = "cold-start latency"
+value = "$COLD_START seconds (echidna-nesy Fly.io deployment)"
+collected = "$TIMESTAMP"
+
+[[field-signal.signal]]
+source = "training_data directory size"
+metric = "corpus growth"
+value = "$CORPUS_SIZE total; $PROOF_COUNT proofs (merge_corpus.jl output)"
+collected = "$TIMESTAMP"
+
+[[field-signal.signal]]
+source = "GitHub API dependabot"
+metric = "open vulnerabilities"
+value = "$VULNS open alerts"
+collected = "$TIMESTAMP"
+
+[[field-signal.signal]]
+source = "cargo test --lib"
+metric = "test pass rate"
+value = "$TEST_COUNT (verify with: cargo test --lib 2>&1 | tail -20)"
+collected = "$TIMESTAMP"
+
+# ─ Run this script weekly via cron or scheduled agent ─
+# Usage: ./scripts/collect-field-signal.sh >> .field-signal-log.txt
+EOF
+
+echo ""
+echo "✓ Field signal collection complete. Add the above entries to STATE.a2ml manually or via sed/awk."

src/interfaces/graphql/ffi_wrapper.rs

@@ -2,8 +2,7 @@
 // GraphQL FFI Wrapper - Connects GraphQL interface to ECHIDNA Rust core via Zig FFI
 
 use std::ffi::{CString, CStr};
-use std::os::raw::{c_int, c_void};
-use std::ptr;
+use std::os::raw::{c_char, c_int};
 use anyhow::{Result, anyhow};
 
 // Re-export FFI types from core
@@ -33,7 +32,7 @@ pub fn init_ffi() -> Result<()> {
             let err_msg = if err_ptr.is_null() {
                 "Unknown FFI initialization error".to_string()
             } else {
-                CStr::from_ptr(err_ptr).to_string_lossy().into_owned()
+                CStr::from_ptr(err_ptr as *const c_char).to_string_lossy().into_owned()
             };
             return Err(anyhow!("FFI initialization failed: {}", err_msg));
         }
@@ -48,7 +47,7 @@ pub fn get_version() -> Result<String> {
         if ptr.is_null() {
             return Err(anyhow!("FFI version pointer is null"));
         }
-        let version = CStr::from_ptr(ptr).to_string_lossy().into_owned();
+        let version = CStr::from_ptr(ptr as *const c_char).to_string_lossy().into_owned();
         Ok(version)
     }
 }
@@ -60,7 +59,7 @@ pub fn get_last_error() -> Result<String> {
         if ptr.is_null() {
             return Err(anyhow!("No error message available"));
         }
-        let error = CStr::from_ptr(ptr).to_string_lossy().into_owned();
+        let error = CStr::from_ptr(ptr as *const c_char).to_string_lossy().into_owned();
         Ok(error)
     }
 }
@@ -89,7 +88,7 @@ pub fn destroy_prover(handle: i32) -> Result<()> {
 pub fn parse_string(handle: i32, content: &str) -> Result<()> {
     unsafe {
         let c_content = CString::new(content)?;
-        let rc = echidna_parse_string(handle, c_content.as_ptr(), content.len());
+        let rc = echidna_parse_string(handle, c_content.as_ptr() as *const u8, content.len());
         if rc != 0 {
             let error = get_last_error()?;
             return Err(anyhow!("Parse failed: {}", error));
@@ -110,7 +109,7 @@ pub fn verify_proof(handle: i32) -> Result<bool> {
 pub fn apply_tactic(handle: i32, tactic: &str) -> Result<bool> {
     unsafe {
         let c_tactic = CString::new(tactic)?;
-        let rc = echidna_apply_tactic(handle, c_tactic.as_ptr(), tactic.len());
+        let rc = echidna_apply_tactic(handle, c_tactic.as_ptr() as *const u8, tactic.len());
         Ok(rc == 0)
     }
 }

src/interfaces/graphql/main.rs

@@ -6,6 +6,7 @@ use async_graphql_axum::GraphQL;
 use axum::{routing::get, Router};
 use tower_http::cors::CorsLayer;
 
+mod ffi_wrapper;
 mod resolvers;
 mod schema;
 

src/interfaces/graphql/resolvers.rs

@@ -15,11 +15,12 @@ use crate::ffi_wrapper;
 /// Wrapper for FFI-based prover backend
 struct FfiProverBackend {
     handle: i32,
+    config: ProverConfig,
 }
 
 impl FfiProverBackend {
     pub fn new(handle: i32) -> Self {
-        FfiProverBackend { handle }
+        FfiProverBackend { handle, config: ProverConfig::default() }
     }
 }
 

src/rust/diagnostics/health.rs

@@ -62,6 +62,7 @@ pub struct ModelHealth {
     pub fallback_cache_hit_rate: f64,
     pub fallback_cache_size: usize,
     pub fallback_max_latency_ms: f64,
+    pub fallback_sla_met: bool,  // Whether cosine fallback meets SLA thresholds
 }
 
 /// Health of training corpus
@@ -105,6 +106,7 @@ impl HealthStatus {
                 fallback_cache_hit_rate: 0.0,
                 fallback_cache_size: 0,
                 fallback_max_latency_ms: 0.0,
+                fallback_sla_met: true,  // Start as met until proven otherwise
             },
             corpus_health: CorpusHealth {
                 total_proofs: 0,
@@ -137,6 +139,15 @@ impl HealthStatus {
         if !self.gnn_model_health.is_loaded || !self.gnn_model_health.nDCG_meets_threshold {
             // GNN model not available or not meeting quality threshold
             self.system_degradation = DegradationMode::CosineOnly;
+        } else if !self.gnn_model_health.fallback_sla_met {
+            // Fallback cosine similarity is violating SLA (latency or success rate)
+            // Transition from Normal → IncreasingFallback, or escalate if already degraded
+            if self.system_degradation == DegradationMode::Normal {
+                self.system_degradation = DegradationMode::IncreasingFallback;
+            } else if self.system_degradation == DegradationMode::IncreasingFallback {
+                self.system_degradation = DegradationMode::CosineOnly;
+            }
+            // If already CosineOnly or ReadOnly, stay there (escalation only, no downgrade)
         } else if failed_provers >= 3 {
             // Too many failed provers
             self.system_degradation = DegradationMode::CosineOnly;
@@ -295,4 +306,47 @@ mod tests {
         assert_eq!(critical.len(), 1);
         assert_eq!(critical[0], "coq");
     }
+
+    #[test]
+    fn test_fallback_sla_enforcement_normal_to_degraded() {
+        let mut health = HealthStatus::new();
+
+        // Start in Normal mode
+        health.gnn_model_health.is_loaded = true;
+        health.gnn_model_health.nDCG_meets_threshold = true;
+        health.gnn_model_health.fallback_sla_met = true;
+        health.gnn_model_health.fallback_cache_hit_rate = 0.75;  // Warm cache to avoid IncreasingFallback trigger
+        health.system_degradation = DegradationMode::Normal;
+
+        // Add at least 3 provers to avoid ReadOnly trigger
+        for i in 0..5 {
+            health.prover_health.insert(
+                format!("prover{}", i),
+                ProverHealth {
+                    name: format!("prover{}", i),
+                    is_available: true,
+                    circuit_breaker_state: CircuitBreakerStateSnapshot::Closed,
+                    last_successful_proof: None,
+                    consecutive_failures: 0,
+                    avg_latency_ms: 50.0,
+                    success_rate: 1.0,
+                    total_invocations: 10,
+                    total_failures: 0,
+                },
+            );
+        }
+
+        // Verify system is normal
+        health.compute_degradation_mode();
+        assert_eq!(health.system_degradation, DegradationMode::Normal);
+
+        // Fallback SLA violation → transition to IncreasingFallback
+        health.gnn_model_health.fallback_sla_met = false;
+        health.compute_degradation_mode();
+        assert_eq!(health.system_degradation, DegradationMode::IncreasingFallback);
+
+        // If already degraded and SLA still violated → escalate
+        health.compute_degradation_mode();
+        assert_eq!(health.system_degradation, DegradationMode::CosineOnly);
+    }
 }