…x-envelope per probe

Per Lock R3-8 (b). Joshua does NOT check Vercel/Sentry/Doppler/
Supabase/Fly dashboards externally — Kora IS the dashboard. This
bucket audits all 5 probes for the cheap-cron-watches-and-wakes-
Kora-on-event architecture, ships issue-detection + wake-event
emission + declarative fix envelopes (all default OFF per fail-
CLOSED), and reserves the ``probe_investigation`` telemetry route
for the consumer-side follow-on.

# Phase 1 audit — all 5 probes ALREADY cheap-cron-only

Verified by grep: no probe in ``kora_cli/heartbeat_probes/``
imports anthropic / reasoning / record_inference. The 5 probes
(supabase / fly / vercel / sentry / doppler) run via the
heartbeat-scheduler periodic task at 5-min cadence, each
performing one HTTP call against the respective vendor API +
writing a ServiceHealthSnapshot to the in-memory cache. Zero LLM
cost on every routine cycle.

Phase 2 conversion: NO-OP. No probe required conversion.

# Phase 3 — issue criteria + wake-event emission (NEW)

New module ``kora_cli/probes/``:

  * ``issue_detector.py`` — pure-function classifier. Reads each
    ServiceHealthSnapshot and produces an Issue when the
    per-probe criterion fires. Criteria documented inline +
    surfaced in the audit table in the PR body.
  * ``fix_envelopes.py`` — declarative envelope table. Each probe
    has an envelope entry; only ``fly`` ships a non-none v1
    envelope (restart_unhealthy_machine); the other 4 are
    explicit "(none)" declarations + operator-required.
  * ``wake_emitter.py`` — writes one ``probe.wake_requested``
    audit row per Issue. Audit row carries probe + severity +
    category + title + detail + snapshot_details +
    envelope_enabled + envelope_fix_name.

New audit seam ``probe.wake_requested`` added to the SeamName
Literal in ``kora_cli/audit/jsonl_sink.py``.

Runner hook: ``kora_cli/heartbeat_probes/runner.run_all_probes``
gains a post-cycle issue-detect-and-emit pass. Routine cycle
stays $0 LLM cost (the emission path is audit JSONL append only).
Per-cycle latency impact: negligible (5 in-memory classification
+ 5 JSONL appends worst case).

# Phase 4 — fix-attempt envelopes

| Probe | v1 envelope | Default |
|---|---|---|
| supabase | (none) — substrate is critical; operator decides | OFF |
| fly | restart_unhealthy_machine (single machine) | OFF |
| vercel | (none) — failed deploys may revert intent | OFF |
| sentry | (none) — observability-only | OFF |
| doppler | (none) — credential surface | OFF |

ALL envelopes default OFF per fail-CLOSED discipline. Operator
opts in per-probe via ``KORA_PROBE_AUTOFIX_<NAME>_ENABLED`` truthy.

v1 ships the DECLARATIONS + envelope-enabled gate. Actual
fix-attempt execution (calling the Fly API to restart a machine)
is deferred to a follow-on bucket KR-PROBE-AUTOFIX-EXECUTION so
the capability-matrix / SECDEF / audit story can be reviewed
before Kora's daemon starts mutating cloud infrastructure. The
fly envelope reserves ``requires_capability="probe_autofix_fly_restart"``
for the executor's cap-matrix gate.

# Wake mechanism — proposed architecture (spec §4 STOP-ASK #1)

No existing wake-Kora-on-event mechanism for non-alert events.
Proposing the audit-event-as-wake-channel shape: probe runner
emits ``probe.wake_requested`` audit rows when an Issue fires; a
follow-on bucket (KR-PROBE-WAKE-CONSUMER) registers a listener
on the audit log that, when fresh rows appear AND envelope is
enabled, invokes the reasoning engine with
``route="probe_investigation"`` (the telemetry literal already
accepted by PR #161). v1 ships only the EMISSION side — operator
visibility via the audit panel + alerts is immediate; LLM
invocation is gated behind the follow-on.

# Telemetry route reservation

``route="probe_investigation"`` is documented in
``wake_emitter.py`` as the literal the future wake-listener bills
on. The route is ALREADY accepted by PR #161's telemetry
taxonomy (KNOWN_ROUTES includes it); no telemetry-side change
needed.

# Tests

39 new tests pass:
  * 14 issue_detector (per-probe × healthy/unhealthy/degraded
    classification + sentry-warning-not-critical exception +
    defensive bad-snapshot)
  * 10 fix_envelopes (declaration shape + per-probe envelope
    entry + truthy/falsy env handling + fail-CLOSED defaults +
    capability-literal reservation)
  * 9 wake_emitter (audit row shape + envelope_enabled
    reflection + fail-soft on audit-write/import error +
    cheap-cron contract: no reasoning import triggered)
  * 6 runner_post_hook integration (all-healthy → 0 events,
    multi-issue → multi-event, hook-failure-doesn't-crash-cycle,
    routine path doesn't invoke LLM)

592/592 cross-bucket regression (probes + alerts + audit +
test_listeners + telemetry + snapshot). Ruff clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>