feat(P02): complete integration + tech-debt + NFR measurement phase — v0.1.12 tagged

Phase 2 (Integration + Tech-Debt + NFR Measurement) complete.
4 slices, 2 waves, 9 tasks. 4 REQs covered. 60 new tests (469 total).
8 v0.4 P1+ tech-debt findings addressed. Verify: APPROVE_WITH_NOTES.

NFR measurement (p95 latency + guardrail FP/FN), cohort aggregation
assist metrics (5 new metrics, no schema change), assist cost tracking
+ C-3 budget check, tech-debt wave (argon2id offload, cookie-secret
validation, credential enum, f-string SQL, cache persistence, zoneinfo,
audit log, 429 mock).

---ci---
project: praxis
phase: 2
milestone: v0.5
status: complete
requirements:
  covered: [REQ-NFR-ASSIST-01, REQ-IDEATE-04, REQ-IDEATE-06, REQ-IDEATE-07]
  partial: []
---/ci---

server/operator/cohort.py

@@ -1,10 +1,15 @@
-"""GET /api/operator/cohort — practice volume view (TASK-08-01, D-053, D-057).
+"""GET /api/operator/cohort — practice + assist volume view (TASK-08-01, TASK-10-02, D-053, D-057).
 
-Auth-gated (Depends(current_operator)). Returns k-anonymized practice-volume
-aggregates from cohort_aggregates: sessions_count + active_learners_count per
-path. Suppressed cells have value=null + cell_suppressed=true; the frontend
-renders \"— (<10 learners)\". No per-learner drill-down (R-DASH-02).
+Auth-gated (Depends(current_operator)). Returns k-anonymized practice + assist
+volume aggregates from cohort_aggregates: sessions_count + active_learners_count
+(practice) + assist_shifts_count + assist_turns_count (assist) per path.
+Suppressed cells have value=null + cell_suppressed=true; the frontend renders
+\"— (<10 learners)\". No per-learner drill-down (R-DASH-02).
 last_updated = max(updated_at) for freshness (REQ-NFR-DASH-02).
+
+D-062: assist metrics are new metric strings in the same cohort_aggregates
+table (no schema change). The view returns practice + assist volume
+side-by-side so operators see both modes per path.
 """
 
 from __future__ import annotations
@@ -24,7 +29,13 @@ from server.operator._common import (
 
 router = APIRouter(prefix="/api/operator", tags=["operator-cohort"])
 
-PRACTICE_METRICS = {"sessions_count", "active_learners_count"}
+# Practice volume metrics (v0.4) + assist volume metrics (v0.5 — TASK-10-02).
+PRACTICE_METRICS = {
+    "sessions_count",
+    "active_learners_count",
+    "assist_shifts_count",
+    "assist_turns_count",
+}
 
 
 @router.get("/cohort", response_model=ViewResponse)

server/operator/credentials.py

@@ -9,6 +9,7 @@ the credential asserts (D-043).
 from __future__ import annotations
 
 import datetime as _dt
+import logging
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from pydantic import BaseModel
@@ -19,6 +20,8 @@ from server.operator._common import require_pg_store
 
 router = APIRouter(prefix="/api/operator", tags=["operator-credentials"])
 
+log = logging.getLogger(__name__)
+
 
 class CredentialOut(BaseModel):
     id: str
@@ -72,6 +75,11 @@ async def revoke_credential(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
                             detail="credential not found")
     await pg_store.set_credential_status(cred_id, "revoked")
+    # TASK-12-04 (P1+ #5): application-level audit log for credential revocation.
+    # The revoking operator_id + cred_id are logged. No audit_log table (the
+    # log is sufficient for pilot — D-056 stateless cookies + revoked_at
+    # timestamp are the primary audit trail).
+    log.info("credential revoked: operator=%s cred_id=%s", op.id, cred_id)
     return OkResponse(ok=True, id=cred_id, status="revoked")
 
 

server/operator/failure_patterns.py

@@ -1,9 +1,14 @@
-"""GET /api/operator/failure-patterns — failure patterns view (TASK-08-03, D-053).
+"""GET /api/operator/failure-patterns — failure patterns + safety signals (TASK-08-03, TASK-10-02, D-053).
 
 Auth-gated. Returns failure pattern metrics: failure_mode frequency (cells
 with metric prefix `failure_mode:`) + branch outcome distribution (cells
-with metric prefix `branch:`). Weak-spot rubric criteria (mean < 3.0) are
-highlighted by the frontend. All k-anonymized.
+with metric prefix `branch:`) + the assist guardrail block rate safety signal
+(TASK-10-02 — `assist_guardrail_block_rate`). Weak-spot rubric criteria
+(mean < 3.0) are highlighted by the frontend. All k-anonymized.
+
+The `assist_guardrail_block_rate` is a safety signal for operators: a sudden
+spike signals either a prompt regression or learners pushing boundaries. High
+block rate = flag for operator review.
 """
 
 from __future__ import annotations
@@ -23,9 +28,17 @@ from server.operator._common import (
 
 router = APIRouter(prefix="/api/operator", tags=["operator-failure-patterns"])
 
+# The assist guardrail block-rate safety signal (TASK-10-02, D-060 layer 3).
+ASSIST_GUARDRAIL_BLOCK_RATE = "assist_guardrail_block_rate"
+
 
 def _is_failure_metric(metric: str) -> bool:
-    return metric.startswith("failure_mode:") or metric.startswith("branch:")
+    # Failure patterns (v0.4) + the assist guardrail block-rate safety signal (v0.5).
+    return (
+        metric.startswith("failure_mode:")
+        or metric.startswith("branch:")
+        or metric == ASSIST_GUARDRAIL_BLOCK_RATE
+    )
 
 
 @router.get("/failure-patterns", response_model=ViewResponse)

server/operator/mastery.py

@@ -1,8 +1,13 @@
-"""GET /api/operator/mastery — mastery progression view (TASK-08-02, D-053).
+"""GET /api/operator/mastery — mastery progression view (TASK-08-02, D-053, D-063).
 
 Auth-gated. Returns mastery progression metrics: gate_open_rate,
 median_mastery_score, rubric_criterion_means (cells with metric prefix
 `rubric_criterion_mean:`). All k-anonymized (suppressed if < 10).
+
+D-063 (binding): assist does NOT update mastery. This view is unchanged from
+v0.4 — assist metrics (assist_shifts_count, assist_turns_count) are NOT
+mastery metrics and are NOT included here. They appear in the cohort view
+(TASK-10-02). The assist metrics are separate from practice/mastery metrics.
 """
 
 from __future__ import annotations
@@ -26,6 +31,9 @@ MASTERY_METRICS = {"gate_open_rate", "median_mastery_score"}
 
 
 def _is_mastery_metric(metric: str) -> bool:
+    # D-063: assist metrics are NOT mastery metrics. Only practice mastery
+    # metrics (gate_open_rate, median_mastery_score, rubric_criterion_mean:*)
+    # are included in this view.
     return metric in MASTERY_METRICS or metric.startswith("rubric_criterion_mean:")