feat(obs): 访问日志 SSOT 与 edge_health，去掉协议兼容层

Agent 仅上报 host_metrics/edge_health/access_logs；业务流量与 UV 由
Server 侧访问日志聚合。新增 of_node_edge_health 与 of_access_log_hourly，
删除 request_reports/openresty 吞吐路径；API 不再暴露 traffic_reports
与 openresty_rx|tx。心跳/离线默认阈值与回填迁移一并入库。

internal/apps/agent/agent/runner_test.go

@@ -403,11 +403,11 @@ func TestRunnerHeartbeatPayloadIncludesObservabilityExtensions(t *testing.T) {
 	if firstPayload.Profile == nil {
 		t.Fatal("expected first heartbeat payload to include system profile")
 	}
-	if firstPayload.Snapshot == nil {
-		t.Fatal("expected first heartbeat payload to include metric snapshot")
+	if firstPayload.HostMetrics == nil {
+		t.Fatal("expected first heartbeat payload to include host metrics")
 	}
-	if firstPayload.TrafficReport == nil || firstPayload.TrafficReport.RequestCount != 1 {
-		t.Fatalf("expected first heartbeat payload to include traffic report, got %+v", firstPayload.TrafficReport)
+	if firstPayload.SchemaVersion != 2 {
+		t.Fatalf("expected schema_version 2, got %d", firstPayload.SchemaVersion)
 	}
 	if len(firstPayload.AccessLogs) != 1 || firstPayload.AccessLogs[0].Path != "/" {
 		t.Fatalf("expected first heartbeat payload to include access logs, got %+v", firstPayload.AccessLogs)
@@ -420,11 +420,8 @@ func TestRunnerHeartbeatPayloadIncludesObservabilityExtensions(t *testing.T) {
 	if secondPayload.Profile != nil {
 		t.Fatal("expected unchanged profile to be omitted on subsequent heartbeat")
 	}
-	if secondPayload.Snapshot == nil {
-		t.Fatal("expected metric snapshot to continue reporting on subsequent heartbeat")
-	}
-	if secondPayload.TrafficReport != nil {
-		t.Fatalf("expected unchanged traffic window to be omitted on subsequent heartbeat, got %+v", secondPayload.TrafficReport)
+	if secondPayload.HostMetrics == nil {
+		t.Fatal("expected host metrics to continue reporting on subsequent heartbeat")
 	}
 	if len(secondPayload.AccessLogs) != 0 {
 		t.Fatalf("expected unchanged access log delta to be omitted on subsequent heartbeat, got %+v", secondPayload.AccessLogs)
@@ -442,8 +439,8 @@ func TestRunnerReplaysBufferedObservabilityAfterHeartbeatRecovery(t *testing.T)
 	bufferWindow := nowUnix - (nowUnix % 60) - 60
 	if err := bufferStore.Upsert(state.ObservabilityBufferRecord{
 		WindowStartedAtUnix: bufferWindow,
-		Snapshot:            &protocol.NodeMetricSnapshot{CapturedAtUnix: bufferWindow + 5, CPUUsagePercent: 30},
-		TrafficReport:       &protocol.NodeTrafficReport{WindowStartedAtUnix: bufferWindow, WindowEndedAtUnix: bufferWindow + 60, RequestCount: 8},
+		HostMetrics:         &protocol.NodeMetricSnapshot{CapturedAtUnix: bufferWindow + 5, CPUUsagePercent: 30},
+		EdgeHealth:          &protocol.NodeEdgeHealth{CapturedAtUnix: bufferWindow + 5, Connections: 3, Status: "healthy"},
 		QueuedAtUnix:        bufferWindow + 60,
 	}, 0); err != nil {
 		t.Fatalf("failed to seed observability buffer: %v", err)
@@ -493,11 +490,14 @@ func TestRunnerReplaysBufferedObservabilityAfterHeartbeatRecovery(t *testing.T)
 		t.Fatalf("expected two heartbeat payloads, got %d", len(heartbeatService.heartbeatPayloads))
 	}
 	secondPayload := heartbeatService.heartbeatPayloads[1]
-	if len(secondPayload.BufferedObservability) != 1 {
-		t.Fatalf("expected second heartbeat to replay one buffered observation, got %+v", secondPayload.BufferedObservability)
+	if len(secondPayload.Buffered) != 1 {
+		t.Fatalf("expected second heartbeat to replay one buffered observation, got %+v", secondPayload.Buffered)
 	}
-	if len(secondPayload.BufferedObservability[0].AccessLogs) != 0 {
-		t.Fatalf("expected seeded buffered observation to keep empty access logs, got %+v", secondPayload.BufferedObservability[0].AccessLogs)
+	if len(secondPayload.Buffered[0].AccessLogs) != 0 {
+		t.Fatalf("expected seeded buffered observation to keep empty access logs, got %+v", secondPayload.Buffered[0].AccessLogs)
+	}
+	if secondPayload.Buffered[0].EdgeHealth == nil || secondPayload.Buffered[0].EdgeHealth.Connections != 3 {
+		t.Fatalf("expected buffered edge health, got %+v", secondPayload.Buffered[0].EdgeHealth)
 	}
 
 	replayable, err := bufferStore.Replayable(0, 0)

internal/apps/agent/config/config.go

@@ -29,11 +29,11 @@ const (
 	defaultStateRelativePath               = "var/lib/openflare/agent-state.json"
 	defaultObservabilityBufferRelativePath = "var/lib/openflare/observability-buffer.json"
 	defaultOpenRestyObservabilityPort      = 18081
-	defaultObservabilityReplayMinutes      = 15
+	defaultObservabilityReplayMinutes      = 60
 	defaultMMDBUpdateInterval              = 24 * time.Hour
 	defaultMMDBDownloadURL                 = "https://github.com/FyraLabs/geolite2/releases/latest/download/GeoLite2-Country.mmdb"
 	defaultCityMMDBDownloadURL             = "https://github.com/FyraLabs/geolite2/releases/latest/download/GeoLite2-City.mmdb"
-	defaultHeartbeatInterval               = 10 * time.Second
+	defaultHeartbeatInterval               = 3 * time.Second
 	defaultRequestTimeout                  = 10 * time.Second
 	configFilePerm                         = 0o600
 )

internal/apps/agent/heartbeat/cycle.go

@@ -90,13 +90,10 @@ func (c *Cycle) NodePayload(ctx context.Context, nodeID string) protocol.NodePay
 		openrestyStatus = protocol.OpenrestyStatusUnknown
 	}
 	profile := observability.BuildProfile(c.Config, c.StateStore)
-	managedOpenRestyMetrics := observability.CollectManagedOpenRestyMetrics(ctx, c.Config)
-	trafficReport, accessLogs, fallbackMetrics := observability.BuildTrafficObservability(c.Config, c.StateStore, managedOpenRestyMetrics)
-	if managedOpenRestyMetrics == nil {
-		managedOpenRestyMetrics = fallbackMetrics
-	}
+	edgeSnapshot := observability.CollectEdgeHealth(ctx, c.Config)
+	accessLogs := observability.CollectAccessLogs(c.Config, c.StateStore)
 	metricSnapshot := observability.BuildSnapshot(c.Config, c.StateStore)
-	openrestyObservation := observability.BuildOpenrestyObservation(managedOpenRestyMetrics)
+	edgeHealth := observability.BuildEdgeHealth(edgeSnapshot, openrestyStatus, snapshot.OpenrestyMessage)
 	healthEvents := observability.BuildHealthEvents(snapshot)
 
 	ip := c.Config.NodeIP
@@ -105,21 +102,21 @@ func (c *Cycle) NodePayload(ctx context.Context, nodeID string) protocol.NodePay
 	}
 
 	payload := protocol.NodePayload{
-		NodeID:               nodeID,
-		Name:                 c.Config.NodeName,
-		IP:                   ip,
-		Version:              c.Config.Version,
-		ExtVersion:           c.Config.ExtVersion,
-		CurrentVersion:       snapshot.CurrentVersion,
-		LastError:            snapshot.LastError,
-		OpenrestyStatus:      openrestyStatus,
-		OpenrestyMessage:     snapshot.OpenrestyMessage,
-		Profile:              profile,
-		Snapshot:             metricSnapshot,
-		OpenrestyObservation: openrestyObservation,
-		TrafficReport:        trafficReport,
-		AccessLogs:           accessLogs,
-		HealthEvents:         healthEvents,
+		SchemaVersion:    2,
+		NodeID:           nodeID,
+		Name:             c.Config.NodeName,
+		IP:               ip,
+		Version:          c.Config.Version,
+		ExtVersion:       c.Config.ExtVersion,
+		CurrentVersion:   snapshot.CurrentVersion,
+		LastError:        snapshot.LastError,
+		OpenrestyStatus:  openrestyStatus,
+		OpenrestyMessage: snapshot.OpenrestyMessage,
+		Profile:          profile,
+		HostMetrics:      metricSnapshot,
+		EdgeHealth:       edgeHealth,
+		AccessLogs:       accessLogs,
+		HealthEvents:     healthEvents,
 	}
 	if c.Sync != nil {
 		checksums, err := c.Sync.WAFIPGroupChecksums()
@@ -135,23 +132,22 @@ func (c *Cycle) NodePayload(ctx context.Context, nodeID string) protocol.NodePay
 // PrepareHeartbeatPayload constructs the heartbeat payload with buffered observability records and returns the window timestamps to acknowledge.
 func (c *Cycle) PrepareHeartbeatPayload(ctx context.Context, nodeID string) (protocol.NodePayload, []int64) {
 	payload := c.NodePayload(ctx, nodeID)
-	if c.ObservabilityBuffer == nil || (payload.Snapshot == nil && payload.TrafficReport == nil && len(payload.AccessLogs) == 0) {
+	if c.ObservabilityBuffer == nil || (payload.HostMetrics == nil && payload.EdgeHealth == nil && len(payload.AccessLogs) == 0) {
 		return payload, nil
 	}
 	now := time.Now().UTC()
 	retainAfterUnix := now.Add(-time.Duration(c.Config.ObservabilityReplayMinutes) * time.Minute).Unix()
-	windowStartedAtUnix := state.ObservabilityWindowStartedAt(payload.Snapshot, payload.OpenrestyObservation, payload.TrafficReport)
+	windowStartedAtUnix := state.ObservabilityWindowStartedAt(payload.HostMetrics, payload.EdgeHealth)
 	if windowStartedAtUnix <= 0 {
 		return payload, nil
 	}
 
 	record := state.ObservabilityBufferRecord{
-		WindowStartedAtUnix:  windowStartedAtUnix,
-		Snapshot:             payload.Snapshot,
-		OpenrestyObservation: payload.OpenrestyObservation,
-		TrafficReport:        payload.TrafficReport,
-		AccessLogs:           payload.AccessLogs,
-		QueuedAtUnix:         now.Unix(),
+		WindowStartedAtUnix: windowStartedAtUnix,
+		HostMetrics:         payload.HostMetrics,
+		EdgeHealth:          payload.EdgeHealth,
+		AccessLogs:          payload.AccessLogs,
+		QueuedAtUnix:        now.Unix(),
 	}
 	if err := c.ObservabilityBuffer.Upsert(record, retainAfterUnix); err != nil {
 		slog.Error("upsert observability buffer failed", "error", err)
@@ -171,15 +167,14 @@ func (c *Cycle) PrepareHeartbeatPayload(ctx context.Context, nodeID string) (pro
 			continue
 		}
 		buffered = append(buffered, protocol.BufferedObservabilityRecord{
-			WindowStartedAtUnix:  item.WindowStartedAtUnix,
-			Snapshot:             item.Snapshot,
-			OpenrestyObservation: item.OpenrestyObservation,
-			TrafficReport:        item.TrafficReport,
-			AccessLogs:           item.AccessLogs,
+			CapturedAtUnix: item.WindowStartedAtUnix,
+			HostMetrics:    item.HostMetrics,
+			EdgeHealth:     item.EdgeHealth,
+			AccessLogs:     item.AccessLogs,
 		})
 		ackWindows = append(ackWindows, item.WindowStartedAtUnix)
 	}
-	payload.BufferedObservability = buffered
+	payload.Buffered = buffered
 	ackWindows = append(ackWindows, windowStartedAtUnix)
 	return payload, ackWindows
 }

internal/apps/agent/nginx/observability_assets.go

@@ -2,147 +2,52 @@ package nginx
 
 import "github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
 
-const (
-	openRestyObservabilityWindowTTL  = "7200"
-	openRestyObservabilityWindowSize = "60"
-)
+// Local OpenResty observability endpoint (target model):
+// GET /openflare/observability returns instantaneous health/connections only.
+// Business traffic is collected exclusively from access.log.
 
-const openRestyObservabilityInitLua = `local dict = ngx.shared.openflare_observability
-if not dict then
-    return
-end
-
-return
+const openRestyObservabilityInitLua = `return
 `
 
-const openRestyObservabilityLogLua = `local dict = ngx.shared.openflare_observability
-if not dict then
-    return
-end
-
-local request_uri = tostring(ngx.var.uri or "")
-if request_uri == "/openflare/observability" or request_uri == "/openflare/stub_status" then
-    return
-end
-
-local ttl = ` + openRestyObservabilityWindowTTL + `
-local now = ngx.time()
-local window_size = ` + openRestyObservabilityWindowSize + `
-local window_start = now - (now % window_size)
-
-local function ensure_counter(key)
-    dict:add(key, 0, ttl)
-end
-
-local function incr(key, delta)
-    ensure_counter(key)
-    local value, err = dict:incr(key, delta)
-    if not value and err == "not found" then
-        dict:set(key, delta, ttl)
-    end
-end
-
-local function remember_value(list_key, marker_key, value)
-    if value == "" then
-        return
-    end
-    if not dict:add(marker_key, 1, ttl) then
-        return
-    end
-    local existing = dict:get(list_key)
-    if not existing or existing == "" then
-        dict:set(list_key, value, ttl)
-        return
-    end
-    dict:set(list_key, existing .. "\n" .. value, ttl)
-end
-
-local window_prefix = tostring(window_start)
-incr("request_count:" .. window_prefix, 1)
-
-local status = tostring(ngx.status or 0)
-if status ~= "0" then
-    incr("status:" .. window_prefix .. ":" .. status, 1)
-    remember_value(
-        "status_keys:" .. window_prefix,
-        "status_marker:" .. window_prefix .. ":" .. status,
-        status
-    )
-    if tonumber(status) and tonumber(status) >= 500 then
-        incr("error_count:" .. window_prefix, 1)
-    end
-end
-
-local host = tostring(ngx.var.host or "")
-if host ~= "" then
-    incr("domain:" .. window_prefix .. ":" .. host, 1)
-    remember_value(
-        "domain_keys:" .. window_prefix,
-        "domain_marker:" .. window_prefix .. ":" .. host,
-        host
-    )
-end
-
-local remote_addr = tostring(ngx.var.binary_remote_addr or ngx.var.remote_addr or "")
-if remote_addr ~= "" and dict:add("visitor:" .. window_prefix .. ":" .. remote_addr, 1, ttl) then
-    incr("unique_visitor_count:" .. window_prefix, 1)
-end
-
-local request_length = tonumber(ngx.var.request_length) or 0
-if request_length > 0 then
-    incr("openresty_rx_bytes:" .. window_prefix, request_length)
-end
-
-local bytes_sent = tonumber(ngx.var.bytes_sent) or tonumber(ngx.var.body_bytes_sent) or 0
-if bytes_sent > 0 then
-    incr("openresty_tx_bytes:" .. window_prefix, bytes_sent)
-end
+// log.lua no longer accumulates business counters (access.log is the authority).
+const openRestyObservabilityLogLua = `return
 `
 
+// read.lua exposes stub_status-style connection gauges as JSON.
 const openRestyObservabilityReadLua = `local cjson = require "cjson.safe"
 
-local dict = ngx.shared.openflare_observability
-if not dict then
-    ngx.status = ngx.HTTP_SERVICE_UNAVAILABLE
-    ngx.say(cjson.encode({ message = "shared dict unavailable" }))
-    return
-end
-
-local now = ngx.time()
-local window_size = ` + openRestyObservabilityWindowSize + `
-local window_start = now - (now % window_size)
-local current_window = tostring(window_start)
-
-local function read_counter(key)
-    return tonumber(dict:get(key) or 0) or 0
-end
-
-local function read_map(window_id, prefix, list_key)
-    local result = {}
-    local raw = dict:get(list_key .. ":" .. window_id)
-    if not raw or raw == "" then
-        return result
+local function read_stub_status()
+    local res = ngx.location.capture("/openflare/stub_status")
+    if not res or res.status ~= 200 or not res.body then
+        return nil
     end
-    for value in string.gmatch(raw, "[^\n]+") do
-        result[value] = read_counter(prefix .. ":" .. window_id .. ":" .. value)
-    end
-    return result
+    local body = res.body
+    local active = tonumber(string.match(body, "Active connections:%s*(%d+)")) or 0
+    local reading = tonumber(string.match(body, "Reading:%s*(%d+)")) or 0
+    local writing = tonumber(string.match(body, "Writing:%s*(%d+)")) or 0
+    local waiting = tonumber(string.match(body, "Waiting:%s*(%d+)")) or 0
+    return {
+        active = active,
+        reading = reading,
+        writing = writing,
+        waiting = waiting
+    }
 end
 
+local connections = read_stub_status()
 local payload = {
-    window_started_at_unix = window_start,
-    window_ended_at_unix = now,
-    request_count = read_counter("request_count:" .. current_window),
-    error_count = read_counter("error_count:" .. current_window),
-    unique_visitor_count = read_counter("unique_visitor_count:" .. current_window),
-    status_codes = read_map(current_window, "status", "status_keys"),
-    top_domains = read_map(current_window, "domain", "domain_keys"),
-    source_countries = {},
-    openresty_rx_bytes = read_counter("openresty_rx_bytes:" .. current_window),
-    openresty_tx_bytes = read_counter("openresty_tx_bytes:" .. current_window)
+    ok = connections ~= nil,
+    captured_at_unix = ngx.time(),
+    connections = connections or {
+        active = 0,
+        reading = 0,
+        writing = 0,
+        waiting = 0
+    }
 }
 
 ngx.header.content_type = "application/json"
+ngx.status = ngx.HTTP_OK
 ngx.say(cjson.encode(payload))
 `
 

internal/apps/agent/nginx/observability_assets_test.go

@@ -0,0 +1,35 @@
+package nginx
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestManagedObservabilityLuaIsHealthOnly(t *testing.T) {
+	t.Parallel()
+
+	files := ManagedObservabilityLuaFiles()
+	var logLua, readLua string
+	for _, file := range files {
+		switch file.Path {
+		case "log.lua":
+			logLua = file.Content
+		case "read.lua":
+			readLua = file.Content
+		}
+	}
+	if logLua == "" || readLua == "" {
+		t.Fatal("expected log.lua and read.lua")
+	}
+	// Business counters must not be written in log phase.
+	if strings.Contains(logLua, "openresty_rx_bytes") ||
+		strings.Contains(logLua, "request_count") {
+		t.Fatal("log.lua must not accumulate business counters")
+	}
+	if !strings.Contains(readLua, "connections") || !strings.Contains(readLua, "ok") {
+		t.Fatal("read.lua must expose ok + connections health snapshot")
+	}
+	if strings.Contains(readLua, "top_domains") || strings.Contains(readLua, "request_count") {
+		t.Fatal("read.lua must not expose business traffic aggregates")
+	}
+}

internal/apps/agent/observability/collector.go

@@ -84,16 +84,37 @@ func BuildSnapshot(cfg *config.Config, stateStore *state.Store) *protocol.NodeMe
 	return metric
 }
 
-// BuildOpenrestyObservation builds the OpenResty observation protocol model from the managed metrics.
-func BuildOpenrestyObservation(managed *ManagedOpenRestyMetrics) *protocol.NodeOpenrestyObservation {
-	if managed == nil {
-		return nil
+// BuildEdgeHealth builds the edge_health payload from a local probe and node status.
+func BuildEdgeHealth(probe *EdgeHealthSnapshot, openrestyStatus, openrestyMessage string) *protocol.NodeEdgeHealth {
+	status := strings.TrimSpace(openrestyStatus)
+	message := strings.TrimSpace(openrestyMessage)
+	if probe == nil {
+		if status == "" {
+			return nil
+		}
+		return &protocol.NodeEdgeHealth{
+			CapturedAtUnix: time.Now().UTC().Unix(),
+			Status:         status,
+			Message:        message,
+			Connections:    0,
+		}
 	}
-	return &protocol.NodeOpenrestyObservation{
-		CapturedAtUnix:       time.Now().UTC().Unix(),
-		OpenrestyRxBytes:     managed.OpenrestyRxBytes,
-		OpenrestyTxBytes:     managed.OpenrestyTxBytes,
-		OpenrestyConnections: managed.OpenrestyConnections,
+
+	captured := probe.CapturedAtUnix
+	if captured <= 0 {
+		captured = time.Now().UTC().Unix()
+	}
+	if status == "" {
+		status = protocol.OpenrestyStatusUnknown
+		if probe.OK {
+			status = protocol.OpenrestyStatusHealthy
+		}
+	}
+	return &protocol.NodeEdgeHealth{
+		CapturedAtUnix: captured,
+		Status:         status,
+		Message:        message,
+		Connections:    probe.Connections,
 	}
 }
 

internal/apps/agent/observability/openresty_local.go

@@ -4,48 +4,37 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
-	"github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
 )
 
-const (
-	openRestyObservabilityPath      = "/openflare/observability"
-	openRestyStubStatusPath         = "/openflare/stub_status"
-	stubStatusActiveMatchGroupCount = 2
-)
+const openRestyObservabilityPath = "/openflare/observability"
 
-var stubStatusActivePattern = regexp.MustCompile(`Active connections:\s+(\d+)`)
-
-// ManagedOpenRestyMetrics holds metrics collected from the local OpenResty instance.
-type ManagedOpenRestyMetrics struct {
-	TrafficReport        *protocol.NodeTrafficReport
-	OpenrestyRxBytes     int64
-	OpenrestyTxBytes     int64
-	OpenrestyConnections int64
+// EdgeHealthSnapshot is the L2 OpenResty health probe result.
+type EdgeHealthSnapshot struct {
+	OK             bool
+	CapturedAtUnix int64
+	Connections    int64
+	Reading        int64
+	Writing        int64
+	Waiting        int64
 }
 
 type openRestyObservabilityResponse struct {
-	WindowStartedAtUnix int64            `json:"window_started_at_unix"`
-	WindowEndedAtUnix   int64            `json:"window_ended_at_unix"`
-	RequestCount        int64            `json:"request_count"`
-	ErrorCount          int64            `json:"error_count"`
-	UniqueVisitorCount  int64            `json:"unique_visitor_count"`
-	StatusCodes         map[string]int64 `json:"status_codes"`
-	TopDomains          map[string]int64 `json:"top_domains"`
-	SourceCountries     map[string]int64 `json:"source_countries"`
-	OpenrestyRxBytes    int64            `json:"openresty_rx_bytes"`
-	OpenrestyTxBytes    int64            `json:"openresty_tx_bytes"`
+	OK             bool  `json:"ok"`
+	CapturedAtUnix int64 `json:"captured_at_unix"`
+	Connections    struct {
+		Active  int64 `json:"active"`
+		Reading int64 `json:"reading"`
+		Writing int64 `json:"writing"`
+		Waiting int64 `json:"waiting"`
+	} `json:"connections"`
 }
 
-// CollectManagedOpenRestyMetrics collects metrics from the local OpenResty observability endpoints.
-func CollectManagedOpenRestyMetrics(ctx context.Context, cfg *config.Config) *ManagedOpenRestyMetrics {
+// CollectEdgeHealth probes the local OpenResty observability JSON endpoint.
+func CollectEdgeHealth(ctx context.Context, cfg *config.Config) *EdgeHealthSnapshot {
 	if cfg == nil || cfg.OpenrestyObservabilityPort <= 0 {
 		return nil
 	}
@@ -53,31 +42,23 @@ func CollectManagedOpenRestyMetrics(ctx context.Context, cfg *config.Config) *Ma
 	baseURL := fmt.Sprintf("http://127.0.0.1:%d", cfg.OpenrestyObservabilityPort)
 	client := &http.Client{Timeout: 1500 * time.Millisecond}
 
-	observabilityResp := openRestyObservabilityResponse{}
-	if err := fetchLocalJSON(ctx, client, baseURL+openRestyObservabilityPath, &observabilityResp); err != nil {
+	var resp openRestyObservabilityResponse
+	if err := fetchLocalJSON(ctx, client, baseURL+openRestyObservabilityPath, &resp); err != nil {
 		return nil
 	}
 
-	result := &ManagedOpenRestyMetrics{
-		TrafficReport: &protocol.NodeTrafficReport{
-			WindowStartedAtUnix: observabilityResp.WindowStartedAtUnix,
-			WindowEndedAtUnix:   observabilityResp.WindowEndedAtUnix,
-			RequestCount:        observabilityResp.RequestCount,
-			ErrorCount:          observabilityResp.ErrorCount,
-			UniqueVisitorCount:  observabilityResp.UniqueVisitorCount,
-			StatusCodes:         normalizeCountMap(observabilityResp.StatusCodes),
-			TopDomains:          normalizeCountMap(observabilityResp.TopDomains),
-			SourceCountries:     normalizeCountMap(observabilityResp.SourceCountries),
-		},
-		OpenrestyRxBytes: observabilityResp.OpenrestyRxBytes,
-		OpenrestyTxBytes: observabilityResp.OpenrestyTxBytes,
+	captured := resp.CapturedAtUnix
+	if captured <= 0 {
+		captured = time.Now().UTC().Unix()
 	}
-
-	if text, err := fetchLocalText(ctx, client, baseURL+openRestyStubStatusPath); err == nil {
-		result.OpenrestyConnections = parseStubStatusActiveConnections(text)
+	return &EdgeHealthSnapshot{
+		OK:             resp.OK,
+		CapturedAtUnix: captured,
+		Connections:    resp.Connections.Active,
+		Reading:        resp.Connections.Reading,
+		Writing:        resp.Connections.Writing,
+		Waiting:        resp.Connections.Waiting,
 	}
-
-	return result
 }
 
 func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target any) error {
@@ -95,50 +76,3 @@ func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target
 	}
 	return json.NewDecoder(resp.Body).Decode(target)
 }
-
-func fetchLocalText(ctx context.Context, client *http.Client, url string) (string, error) {
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return "", err
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("unexpected local stub status: %s", resp.Status)
-	}
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-func parseStubStatusActiveConnections(raw string) int64 {
-	matches := stubStatusActivePattern.FindStringSubmatch(raw)
-	if len(matches) != stubStatusActiveMatchGroupCount {
-		return 0
-	}
-	value, err := strconv.ParseInt(matches[1], 10, 64)
-	if err != nil {
-		return 0
-	}
-	return value
-}
-
-func normalizeCountMap(values map[string]int64) map[string]int64 {
-	if len(values) == 0 {
-		return map[string]int64{}
-	}
-	result := make(map[string]int64, len(values))
-	for key, value := range values {
-		key = strings.TrimSpace(key)
-		if key == "" || value <= 0 {
-			continue
-		}
-		result[key] = value
-	}
-	return result
-}

internal/apps/agent/observability/openresty_local_test.go

@@ -2,82 +2,63 @@ package observability
 
 import (
 	"context"
-	"net"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
 )
 
-func TestCollectManagedOpenRestyMetrics(t *testing.T) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("Listen failed: %v", err)
-	}
-	port := listener.Addr().(*net.TCPAddr).Port
-
-	mux := http.NewServeMux()
-	mux.HandleFunc(openRestyObservabilityPath, func(writer http.ResponseWriter, request *http.Request) {
-		writer.Header().Set("Content-Type", "application/json")
-		_, _ = writer.Write([]byte(`{"window_started_at_unix":1710403200,"window_ended_at_unix":1710403210,"request_count":12,"error_count":2,"unique_visitor_count":5,"status_codes":{"200":10,"502":2},"top_domains":{"app.example.com":9,"api.example.com":3},"source_countries":{},"openresty_rx_bytes":4096,"openresty_tx_bytes":8192}`))
-	})
-	mux.HandleFunc(openRestyStubStatusPath, func(writer http.ResponseWriter, request *http.Request) {
-		_, _ = writer.Write([]byte("Active connections: 7 \nserver accepts handled requests\n 10 10 12 \nReading: 1 Writing: 2 Waiting: 4 \n"))
-	})
-
-	server := httptest.NewUnstartedServer(mux)
-	server.Listener = listener
-	server.Start()
+func TestCollectEdgeHealth(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/openflare/observability" {
+			http.NotFound(w, r)
+			return
+		}
+		_, _ = w.Write([]byte(`{"ok":true,"captured_at_unix":1710403200,"connections":{"active":12,"reading":1,"writing":2,"waiting":9}}`))
+	}))
 	defer server.Close()
 
-	metrics := CollectManagedOpenRestyMetrics(context.Background(), &config.Config{
-		OpenrestyObservabilityPort: port,
+	health := CollectEdgeHealth(context.Background(), &config.Config{
+		OpenrestyObservabilityPort: mustPort(server.URL),
 	})
-	if metrics == nil || metrics.TrafficReport == nil {
-		t.Fatalf("expected managed openresty metrics, got %+v", metrics)
+	if health == nil {
+		t.Fatal("expected edge health")
 	}
-	if metrics.TrafficReport.RequestCount != 12 || metrics.TrafficReport.ErrorCount != 2 {
-		t.Fatalf("unexpected traffic report: %+v", metrics.TrafficReport)
-	}
-	if metrics.OpenrestyRxBytes != 4096 || metrics.OpenrestyTxBytes != 8192 {
-		t.Fatalf("unexpected openresty byte counters: %+v", metrics)
-	}
-	if metrics.OpenrestyConnections != 7 {
-		t.Fatalf("unexpected openresty connections: %+v", metrics)
+	if !health.OK || health.Connections != 12 {
+		t.Fatalf("unexpected health: %+v", health)
 	}
 }
 
-func TestParseStubStatusActiveConnections(t *testing.T) {
-	if value := parseStubStatusActiveConnections("Active connections: 19\n"); value != 19 {
-		t.Fatalf("unexpected active connections: %d", value)
+func mustPort(rawURL string) int {
+	u := rawURL
+	idx := stringsLastColon(u)
+	if idx < 0 {
+		return 0
 	}
+	var port int
+	for _, ch := range u[idx+1:] {
+		if ch < '0' || ch > '9' {
+			break
+		}
+		port = port*10 + int(ch-'0')
+	}
+	return port
 }
 
-func TestNormalizeCountMapDropsEmptyKeys(t *testing.T) {
-	normalized := normalizeCountMap(map[string]int64{
-		"":                4,
-		" 200 ":           3,
-		"app.example.com": 0,
-	})
-	if len(normalized) != 1 || normalized["200"] != 3 {
-		t.Fatalf("unexpected normalized map: %+v", normalized)
+func stringsLastColon(s string) int {
+	for i := len(s) - 1; i >= 0; i-- {
+		if s[i] == ':' {
+			return i
+		}
 	}
+	return -1
 }
 
-func TestCollectManagedOpenRestyMetricsHandlesUnavailableEndpoint(t *testing.T) {
-	cfg := &config.Config{OpenrestyObservabilityPort: 1}
-	if metrics := CollectManagedOpenRestyMetrics(context.Background(), cfg); metrics != nil {
-		t.Fatalf("expected nil metrics for unavailable endpoint, got %+v", metrics)
-	}
-}
-
-func TestOpenRestyObservabilityPathsAreStable(t *testing.T) {
-	if !strings.HasPrefix(openRestyObservabilityPath, "/openflare/") {
-		t.Fatalf("unexpected observability path: %s", openRestyObservabilityPath)
-	}
-	if !strings.HasPrefix(openRestyStubStatusPath, "/openflare/") {
-		t.Fatalf("unexpected stub status path: %s", openRestyStubStatusPath)
+func TestCollectEdgeHealthHandlesUnavailableEndpoint(t *testing.T) {
+	if health := CollectEdgeHealth(context.Background(), &config.Config{
+		OpenrestyObservabilityPort: 1,
+	}); health != nil {
+		t.Fatalf("expected nil health, got %+v", health)
 	}
 }

internal/apps/agent/observability/traffic.go

@@ -6,10 +6,8 @@ import (
 	"errors"
 	"io"
 	"log/slog"
-	"net/http"
 	"os"
 	"regexp"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -20,63 +18,42 @@ import (
 )
 
 type accessLogRecord struct {
-	Timestamp     string `json:"ts"`
-	Host          string `json:"host"`
-	RemoteAddr    string `json:"remote_addr"`
-	Path          string `json:"path"`
-	Status        int    `json:"status"`
-	BytesSent     int64  `json:"bytes_sent"`
-	RequestLength int64  `json:"request_length"`
+	Timestamp     string  `json:"ts"`
+	Host          string  `json:"host"`
+	RemoteAddr    string  `json:"remote_addr"`
+	Path          string  `json:"path"`
+	Status        int     `json:"status"`
+	BytesSent     int64   `json:"bytes_sent"`
+	RequestLength int64   `json:"request_length"`
+	RequestTime   float64 `json:"request_time"`
 }
 
 const (
 	combinedAccessLogMatchGroupCount = 5
-	trafficTopDomainsLimit           = 8
+	// requestTimeSecondsToMs converts OpenResty $request_time (seconds float) to ms.
+	requestTimeSecondsToMs = 1000.0
+	// roundHalfUp is added before int64 truncate to round to nearest millisecond.
+	roundHalfUp = 0.5
 )
 
 var combinedAccessLogPattern = regexp.MustCompile(`^(\S+)\s+\S+\s+\S+\s+\[([^]]+)]\s+"\S+\s+(\S+)(?:\s+[^"]*)?"\s+(\d{3})\s+\S+`)
 
+// trafficAggregate collects access-log facts for the current heartbeat window.
+// Pre-aggregation (UV/TopN/TrafficReport) is intentionally not built.
 type trafficAggregate struct {
-	windowStartedAt  time.Time
-	windowEndedAt    time.Time
-	requestCount     int64
-	errorCount       int64
-	openrestyRxBytes int64
-	openrestyTxBytes int64
-	statusCodes      map[string]int64
-	topDomains       map[string]int64
-	visitors         map[string]struct{}
-	logs             []protocol.NodeAccessLog
+	logs []protocol.NodeAccessLog
 }
 
-// BuildTrafficReport generates a traffic report using access logs or falling back to managed metrics.
-func BuildTrafficReport(cfg *config.Config, stateStore *state.Store, managed *ManagedOpenRestyMetrics) *protocol.NodeTrafficReport {
-	report, _, _ := BuildTrafficObservability(cfg, stateStore, managed)
-	return report
-}
-
-// BuildTrafficObservability returns the traffic report, parsed access logs, and managed metrics.
-func BuildTrafficObservability(cfg *config.Config, stateStore *state.Store, managed *ManagedOpenRestyMetrics) (*protocol.NodeTrafficReport, []protocol.NodeAccessLog, *ManagedOpenRestyMetrics) {
+// CollectAccessLogs tails access.log and returns L1 fact rows for the current heartbeat.
+func CollectAccessLogs(cfg *config.Config, stateStore *state.Store) []protocol.NodeAccessLog {
 	if cfg == nil || stateStore == nil {
-		if managed != nil && managed.TrafficReport != nil {
-			return managed.TrafficReport, nil, managed
-		}
-		return nil, nil, managed
+		return nil
 	}
-
 	aggregate := readAccessLogDelta(cfg, stateStore)
-	var accessLogs []protocol.NodeAccessLog
-	if aggregate != nil {
-		accessLogs = aggregate.accessLogs()
-	}
-	if managed != nil && managed.TrafficReport != nil {
-		return managed.TrafficReport, accessLogs, managed
-	}
 	if aggregate == nil {
-		return nil, accessLogs, managed
+		return nil
 	}
-	fallbackManaged := aggregate.managedMetrics()
-	return aggregate.report(), accessLogs, fallbackManaged
+	return aggregate.accessLogs()
 }
 
 func readAccessLogDelta(cfg *config.Config, stateStore *state.Store) *trafficAggregate {
@@ -149,11 +126,7 @@ func managedAccessLogPath(cfg *config.Config) string {
 }
 
 func newTrafficAggregate() *trafficAggregate {
-	return &trafficAggregate{
-		statusCodes: make(map[string]int64),
-		topDomains:  make(map[string]int64),
-		visitors:    make(map[string]struct{}),
-	}
+	return &trafficAggregate{}
 }
 
 func (aggregate *trafficAggregate) consume(line []byte) {
@@ -167,39 +140,15 @@ func (aggregate *trafficAggregate) consume(line []byte) {
 		return
 	}
 
-	if aggregate.windowStartedAt.IsZero() || record.Timestamp.Before(aggregate.windowStartedAt) {
-		aggregate.windowStartedAt = record.Timestamp
-	}
-	if aggregate.windowEndedAt.IsZero() || record.Timestamp.After(aggregate.windowEndedAt) {
-		aggregate.windowEndedAt = record.Timestamp
-	}
-
-	aggregate.requestCount++
-	if record.Status >= http.StatusInternalServerError {
-		aggregate.errorCount++
-	}
-	if record.Status > 0 {
-		aggregate.statusCodes[strconv.Itoa(record.Status)]++
-	}
-	if record.RequestLength > 0 {
-		aggregate.openrestyRxBytes += record.RequestLength
-	}
-	if record.BytesSent > 0 {
-		aggregate.openrestyTxBytes += record.BytesSent
-	}
-	if host := strings.TrimSpace(record.Host); host != "" {
-		aggregate.topDomains[host]++
-	}
-	if remoteAddr := strings.TrimSpace(record.RemoteAddr); remoteAddr != "" {
-		aggregate.visitors[remoteAddr] = struct{}{}
-	}
 	aggregate.logs = append(aggregate.logs, protocol.NodeAccessLog{
-		LoggedAtUnix: record.Timestamp.Unix(),
-		RemoteAddr:   strings.TrimSpace(record.RemoteAddr),
-		Host:         strings.TrimSpace(record.Host),
-		Path:         normalizeAccessLogPath(record.Path),
-		StatusCode:   record.Status,
-		BytesSent:    record.BytesSent,
+		LoggedAtUnix:  record.Timestamp.Unix(),
+		RemoteAddr:    strings.TrimSpace(record.RemoteAddr),
+		Host:          strings.TrimSpace(record.Host),
+		Path:          normalizeAccessLogPath(record.Path),
+		StatusCode:    record.Status,
+		BytesSent:     record.BytesSent,
+		RequestLength: record.RequestLength,
+		RequestTimeMs: record.RequestTimeMs,
 	})
 }
 
@@ -211,6 +160,7 @@ type parsedAccessLogRecord struct {
 	Status        int
 	BytesSent     int64
 	RequestLength int64
+	RequestTimeMs int64
 }
 
 func parseAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
@@ -230,6 +180,10 @@ func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 	if err != nil {
 		return parsedAccessLogRecord{}, false
 	}
+	requestTimeMs := int64(0)
+	if record.RequestTime > 0 {
+		requestTimeMs = int64(record.RequestTime*requestTimeSecondsToMs + roundHalfUp)
+	}
 	return parsedAccessLogRecord{
 		Timestamp:     timestamp,
 		Host:          strings.TrimSpace(record.Host),
@@ -238,6 +192,7 @@ func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 		Status:        record.Status,
 		BytesSent:     record.BytesSent,
 		RequestLength: record.RequestLength,
+		RequestTimeMs: requestTimeMs,
 	}, true
 }
 
@@ -262,23 +217,6 @@ func parseCombinedAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 	}, true
 }
 
-func (aggregate *trafficAggregate) report() *protocol.NodeTrafficReport {
-	if aggregate.requestCount == 0 || aggregate.windowStartedAt.IsZero() || aggregate.windowEndedAt.IsZero() {
-		return nil
-	}
-
-	return &protocol.NodeTrafficReport{
-		WindowStartedAtUnix: aggregate.windowStartedAt.Unix(),
-		WindowEndedAtUnix:   aggregate.windowEndedAt.Unix(),
-		RequestCount:        aggregate.requestCount,
-		ErrorCount:          aggregate.errorCount,
-		UniqueVisitorCount:  int64(len(aggregate.visitors)),
-		StatusCodes:         cloneTrafficCounts(aggregate.statusCodes, 0),
-		TopDomains:          topCounts(aggregate.topDomains, trafficTopDomainsLimit),
-		SourceCountries:     map[string]int64{},
-	}
-}
-
 func (aggregate *trafficAggregate) accessLogs() []protocol.NodeAccessLog {
 	if aggregate == nil || len(aggregate.logs) == 0 {
 		return []protocol.NodeAccessLog{}
@@ -286,21 +224,6 @@ func (aggregate *trafficAggregate) accessLogs() []protocol.NodeAccessLog {
 	return append([]protocol.NodeAccessLog(nil), aggregate.logs...)
 }
 
-func (aggregate *trafficAggregate) managedMetrics() *ManagedOpenRestyMetrics {
-	if aggregate == nil {
-		return nil
-	}
-	report := aggregate.report()
-	if report == nil && aggregate.openrestyRxBytes <= 0 && aggregate.openrestyTxBytes <= 0 {
-		return nil
-	}
-	return &ManagedOpenRestyMetrics{
-		TrafficReport:    report,
-		OpenrestyRxBytes: aggregate.openrestyRxBytes,
-		OpenrestyTxBytes: aggregate.openrestyTxBytes,
-	}
-}
-
 func parseAccessLogTime(value string) (time.Time, error) {
 	trimmed := strings.TrimSpace(value)
 	if trimmed == "" {
@@ -313,35 +236,6 @@ func parseAccessLogTime(value string) (time.Time, error) {
 	return time.Parse("02/Jan/2006:15:04:05 -0700", trimmed)
 }
 
-func cloneTrafficCounts(values map[string]int64, limit int) map[string]int64 {
-	if len(values) == 0 {
-		return map[string]int64{}
-	}
-	items := make([]trafficCountItem, 0, len(values))
-	for key, value := range values {
-		items = append(items, trafficCountItem{key: key, value: value})
-	}
-	sort.Slice(items, func(i int, j int) bool {
-		if items[i].value == items[j].value {
-			return items[i].key < items[j].key
-		}
-		return items[i].value > items[j].value
-	})
-	if limit > 0 && len(items) > limit {
-		items = items[:limit]
-	}
-	result := make(map[string]int64, len(items))
-	for _, item := range items {
-		result[item.key] = item.value
-	}
-	return result
-}
-
-type trafficCountItem struct {
-	key   string
-	value int64
-}
-
 const accessLogPathMaxRunes = 100
 
 func normalizeAccessLogPath(value string) string {
@@ -365,7 +259,3 @@ func truncateAccessLogPath(value string) string {
 	}
 	return string(runes[:accessLogPathMaxRunes])
 }
-
-func topCounts(values map[string]int64, limit int) map[string]int64 {
-	return cloneTrafficCounts(values, limit)
-}

internal/apps/agent/observability/traffic_test.go

@@ -7,39 +7,33 @@ import (
 	"testing"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
-	"github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/state"
 )
 
-func TestBuildTrafficReportAggregatesManagedAccessLog(t *testing.T) {
+func TestCollectAccessLogsReturnsFactsOnly(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
+	logPath := filepath.Join(tempDir, "openflare_access.log")
 	content := []byte(
-		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n" +
-			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"app.example.com\",\"path\":\"/healthz\",\"remote_addr\":\"10.0.0.2\",\"status\":503}\n" +
-			"{\"ts\":\"2026-03-14T08:00:08Z\",\"host\":\"api.example.com\",\"path\":\"/api\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
+		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512,\"request_time\":0.015}\n" +
+			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256,\"request_time\":0.008}\n",
 	)
 	if err := os.WriteFile(logPath, content, 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 
 	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil {
-		t.Fatal("expected traffic report")
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(accessLogs) != 2 {
+		t.Fatalf("expected access logs, got %+v", accessLogs)
 	}
-	if report.RequestCount != 3 || report.ErrorCount != 1 || report.UniqueVisitorCount != 2 {
-		t.Fatalf("unexpected traffic report counters: %+v", report)
+	if accessLogs[0].BytesSent != 512 || accessLogs[0].RequestLength != 128 {
+		t.Fatalf("unexpected first log: %+v", accessLogs[0])
 	}
-	if report.StatusCodes["200"] != 2 || report.StatusCodes["503"] != 1 {
-		t.Fatalf("unexpected status codes: %+v", report.StatusCodes)
+	if accessLogs[0].RequestTimeMs != 15 {
+		t.Fatalf("request_time_ms = %d, want 15", accessLogs[0].RequestTimeMs)
 	}
-	if report.TopDomains["app.example.com"] != 2 || report.TopDomains["api.example.com"] != 1 {
-		t.Fatalf("unexpected top domains: %+v", report.TopDomains)
+	if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
+		t.Fatalf("unexpected access log paths: %+v", accessLogs)
 	}
 
 	snapshot, err := stateStore.Load()
@@ -50,20 +44,16 @@ func TestBuildTrafficReportAggregatesManagedAccessLog(t *testing.T) {
 		t.Fatalf("unexpected access log offset: %d", snapshot.AccessLogOffset)
 	}
 
-	secondReport := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if secondReport != nil {
-		t.Fatalf("expected no report without appended lines, got %+v", secondReport)
+	moreLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(moreLogs) != 0 {
+		t.Fatalf("expected no new logs, got %+v", moreLogs)
 	}
 }
 
-func TestBuildTrafficReportResetsOffsetAfterTruncate(t *testing.T) {
+func TestCollectAccessLogsResetsOffsetAfterTruncate(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	if err := os.WriteFile(logPath, []byte("{\"ts\":\"2026-03-14T09:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.3\",\"status\":200}\n"), 0o644); err != nil {
+	logPath := filepath.Join(tempDir, "openflare_access.log")
+	if err := os.WriteFile(logPath, []byte("{\"ts\":\"2026-03-14T09:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.3\",\"status\":200,\"bytes_sent\":1}\n"), 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 
@@ -72,50 +62,15 @@ func TestBuildTrafficReportResetsOffsetAfterTruncate(t *testing.T) {
 		t.Fatalf("Save failed: %v", err)
 	}
 
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil || report.RequestCount != 1 {
-		t.Fatalf("expected one request after truncate reset, got %+v", report)
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(accessLogs) != 1 {
+		t.Fatalf("expected one access log after truncate reset, got %+v", accessLogs)
 	}
 }
 
-func TestBuildTrafficObservabilityReturnsAccessLogs(t *testing.T) {
+func TestCollectAccessLogsTruncatesLongAccessLogPath(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	content := []byte(
-		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512}\n" +
-			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256}\n",
-	)
-	if err := os.WriteFile(logPath, content, 0o644); err != nil {
-		t.Fatalf("WriteFile failed: %v", err)
-	}
-
-	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report, accessLogs, fallbackMetrics := BuildTrafficObservability(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil || report.RequestCount != 2 {
-		t.Fatalf("expected traffic report, got %+v", report)
-	}
-	if len(accessLogs) != 2 {
-		t.Fatalf("expected access logs, got %+v", accessLogs)
-	}
-	if fallbackMetrics == nil || fallbackMetrics.OpenrestyRxBytes != 192 || fallbackMetrics.OpenrestyTxBytes != 768 {
-		t.Fatalf("expected fallback throughput metrics, got %+v", fallbackMetrics)
-	}
-	if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
-		t.Fatalf("unexpected access log paths: %+v", accessLogs)
-	}
-}
-
-func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
-	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
+	logPath := filepath.Join(tempDir, "openflare_access.log")
 	longPath := "/" + strings.Repeat("a", 140)
 	content := []byte(
 		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"" + longPath + "\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
@@ -125,7 +80,7 @@ func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
 	}
 
 	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	_, accessLogs, _ := BuildTrafficObservability(&config.Config{AccessLogPath: logPath}, stateStore, nil)
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
 	if len(accessLogs) != 1 {
 		t.Fatalf("expected one access log, got %+v", accessLogs)
 	}
@@ -133,56 +88,3 @@ func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
 		t.Fatalf("expected truncated path length %d, got %d (%q)", accessLogPathMaxRunes, got, accessLogs[0].Path)
 	}
 }
-
-func TestBuildTrafficReportParsesCombinedAccessLog(t *testing.T) {
-	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	content := []byte(
-		"10.0.0.1 - - [14/Mar/2026:08:00:00 +0000] \"GET / HTTP/1.1\" 200 123 \"-\" \"curl/8.0\"\n" +
-			"10.0.0.2 - - [14/Mar/2026:08:00:05 +0000] \"GET /healthz HTTP/1.1\" 502 64 \"-\" \"curl/8.0\"\n" +
-			"10.0.0.1 - - [14/Mar/2026:08:00:10 +0000] \"GET /api HTTP/1.1\" 200 256 \"-\" \"curl/8.0\"\n",
-	)
-	if err := os.WriteFile(logPath, content, 0o644); err != nil {
-		t.Fatalf("WriteFile failed: %v", err)
-	}
-
-	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil {
-		t.Fatal("expected traffic report from combined access log")
-	}
-	if report.RequestCount != 3 || report.ErrorCount != 1 || report.UniqueVisitorCount != 2 {
-		t.Fatalf("unexpected combined log counters: %+v", report)
-	}
-	if report.StatusCodes["200"] != 2 || report.StatusCodes["502"] != 1 {
-		t.Fatalf("unexpected combined log status codes: %+v", report.StatusCodes)
-	}
-	if len(report.TopDomains) != 0 {
-		t.Fatalf("expected combined access log to omit top domains when host is unavailable, got %+v", report.TopDomains)
-	}
-}
-
-func TestBuildTrafficReportReturnsManagedWindowEvenWhenRequestCountZero(t *testing.T) {
-	report := BuildTrafficReport(nil, nil, &ManagedOpenRestyMetrics{
-		TrafficReport: &protocol.NodeTrafficReport{
-			WindowStartedAtUnix: 1710403200,
-			WindowEndedAtUnix:   1710403260,
-			RequestCount:        0,
-			ErrorCount:          0,
-			UniqueVisitorCount:  0,
-			StatusCodes:         map[string]int64{},
-			TopDomains:          map[string]int64{},
-			SourceCountries:     map[string]int64{},
-		},
-	})
-	if report == nil {
-		t.Fatal("expected managed traffic report to be returned even when request count is zero")
-	}
-	if report.RequestCount != 0 || report.WindowStartedAtUnix != 1710403200 || report.WindowEndedAtUnix != 1710403260 {
-		t.Fatalf("unexpected managed traffic report: %+v", report)
-	}
-}

internal/apps/agent/protocol/alias.go

@@ -33,11 +33,8 @@ type NodeSystemProfile = pkgprotocol.NodeSystemProfile
 // NodeMetricSnapshot is an alias for pkgprotocol.NodeMetricSnapshot.
 type NodeMetricSnapshot = pkgprotocol.NodeMetricSnapshot
 
-// NodeOpenrestyObservation is an alias for pkgprotocol.NodeOpenrestyObservation.
-type NodeOpenrestyObservation = pkgprotocol.NodeOpenrestyObservation
-
-// NodeTrafficReport is an alias for pkgprotocol.NodeTrafficReport.
-type NodeTrafficReport = pkgprotocol.NodeTrafficReport
+// NodeEdgeHealth is an alias for pkgprotocol.NodeEdgeHealth.
+type NodeEdgeHealth = pkgprotocol.NodeEdgeHealth
 
 // NodeAccessLog is an alias for pkgprotocol.NodeAccessLog.
 type NodeAccessLog = pkgprotocol.NodeAccessLog

internal/apps/agent/state/observability_buffer.go

@@ -14,14 +14,13 @@ import (
 
 const observabilityBufferWindowSeconds = 60
 
-// ObservabilityBufferRecord stores observability data for a single time window.
+// ObservabilityBufferRecord stores observability facts for a single time window.
 type ObservabilityBufferRecord struct {
-	WindowStartedAtUnix  int64                              `json:"window_started_at_unix"`
-	Snapshot             *protocol.NodeMetricSnapshot       `json:"snapshot,omitempty"`
-	OpenrestyObservation *protocol.NodeOpenrestyObservation `json:"openresty_observation,omitempty"`
-	TrafficReport        *protocol.NodeTrafficReport        `json:"traffic_report,omitempty"`
-	AccessLogs           []protocol.NodeAccessLog           `json:"access_logs,omitempty"`
-	QueuedAtUnix         int64                              `json:"queued_at_unix"`
+	WindowStartedAtUnix int64                        `json:"window_started_at_unix"`
+	HostMetrics         *protocol.NodeMetricSnapshot `json:"host_metrics,omitempty"`
+	EdgeHealth          *protocol.NodeEdgeHealth     `json:"edge_health,omitempty"`
+	AccessLogs          []protocol.NodeAccessLog     `json:"access_logs,omitempty"`
+	QueuedAtUnix        int64                        `json:"queued_at_unix"`
 }
 
 // ObservabilityBufferStore persists observability records to disk for replay on heartbeat.
@@ -39,7 +38,7 @@ func NewObservabilityBufferStore(path string) *ObservabilityBufferStore {
 
 // Upsert inserts or merges an observability record and prunes entries older than retainAfterUnix.
 func (s *ObservabilityBufferStore) Upsert(record ObservabilityBufferRecord, retainAfterUnix int64) error {
-	if s == nil || record.WindowStartedAtUnix <= 0 || (record.Snapshot == nil && record.OpenrestyObservation == nil && record.TrafficReport == nil && len(record.AccessLogs) == 0) {
+	if s == nil || record.WindowStartedAtUnix <= 0 || (record.HostMetrics == nil && record.EdgeHealth == nil && len(record.AccessLogs) == 0) {
 		return nil
 	}
 	s.mu.Lock()
@@ -70,14 +69,11 @@ func (s *ObservabilityBufferStore) Upsert(record ObservabilityBufferRecord, reta
 
 func mergeObservabilityBufferRecord(existing ObservabilityBufferRecord, incoming ObservabilityBufferRecord) ObservabilityBufferRecord {
 	merged := existing
-	if incoming.Snapshot != nil {
-		merged.Snapshot = incoming.Snapshot
+	if incoming.HostMetrics != nil {
+		merged.HostMetrics = incoming.HostMetrics
 	}
-	if incoming.OpenrestyObservation != nil {
-		merged.OpenrestyObservation = incoming.OpenrestyObservation
-	}
-	if incoming.TrafficReport != nil {
-		merged.TrafficReport = incoming.TrafficReport
+	if incoming.EdgeHealth != nil {
+		merged.EdgeHealth = incoming.EdgeHealth
 	}
 	merged.AccessLogs = mergeAccessLogs(existing.AccessLogs, incoming.AccessLogs)
 	if incoming.QueuedAtUnix > 0 {
@@ -222,18 +218,15 @@ func (s *ObservabilityBufferStore) saveUnlocked(records []ObservabilityBufferRec
 	return nil
 }
 
-// ObservabilityWindowStartedAt calculates the start of the 60-second window for the given metrics, openresty observation, or traffic report.
-func ObservabilityWindowStartedAt(snapshot *protocol.NodeMetricSnapshot, openresty *protocol.NodeOpenrestyObservation, traffic *protocol.NodeTrafficReport) int64 {
-	if traffic != nil && traffic.WindowStartedAtUnix > 0 {
-		return traffic.WindowStartedAtUnix - (traffic.WindowStartedAtUnix % observabilityBufferWindowSeconds)
+// ObservabilityWindowStartedAt returns the 60s window start for host metrics or edge health.
+func ObservabilityWindowStartedAt(hostMetrics *protocol.NodeMetricSnapshot, edgeHealth *protocol.NodeEdgeHealth) int64 {
+	if edgeHealth != nil && edgeHealth.CapturedAtUnix > 0 {
+		return edgeHealth.CapturedAtUnix - (edgeHealth.CapturedAtUnix % observabilityBufferWindowSeconds)
 	}
-	if openresty != nil && openresty.CapturedAtUnix > 0 {
-		return openresty.CapturedAtUnix - (openresty.CapturedAtUnix % observabilityBufferWindowSeconds)
-	}
-	if snapshot == nil || snapshot.CapturedAtUnix <= 0 {
+	if hostMetrics == nil || hostMetrics.CapturedAtUnix <= 0 {
 		return 0
 	}
-	return snapshot.CapturedAtUnix - (snapshot.CapturedAtUnix % observabilityBufferWindowSeconds)
+	return hostMetrics.CapturedAtUnix - (hostMetrics.CapturedAtUnix % observabilityBufferWindowSeconds)
 }
 
 func pruneObservabilityBufferRecords(records []ObservabilityBufferRecord, retainAfterUnix int64) []ObservabilityBufferRecord {

internal/apps/agent/state/observability_buffer_test.go

@@ -12,24 +12,23 @@ func TestObservabilityBufferStoreUpsertReplayAndAck(t *testing.T) {
 
 	if err := store.Upsert(ObservabilityBufferRecord{
 		WindowStartedAtUnix: 1710403200,
-		Snapshot:            &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403205},
-		TrafficReport:       &protocol.NodeTrafficReport{WindowStartedAtUnix: 1710403200, WindowEndedAtUnix: 1710403260, RequestCount: 5},
+		HostMetrics:         &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403205},
+		EdgeHealth:          &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403205, Connections: 5},
 		QueuedAtUnix:        1710403205,
 	}, 1710403000); err != nil {
 		t.Fatalf("first upsert failed: %v", err)
 	}
 	if err := store.Upsert(ObservabilityBufferRecord{
 		WindowStartedAtUnix: 1710403200,
-		Snapshot:            &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403255},
-		TrafficReport:       &protocol.NodeTrafficReport{WindowStartedAtUnix: 1710403200, WindowEndedAtUnix: 1710403260, RequestCount: 12},
+		HostMetrics:         &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403255, CPUUsagePercent: 40},
+		EdgeHealth:          &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403255, Connections: 12},
 		QueuedAtUnix:        1710403255,
 	}, 1710403000); err != nil {
 		t.Fatalf("second upsert failed: %v", err)
 	}
 	if err := store.Upsert(ObservabilityBufferRecord{
 		WindowStartedAtUnix: 1710403260,
-		Snapshot:            &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403265},
-		TrafficReport:       &protocol.NodeTrafficReport{WindowStartedAtUnix: 1710403260, WindowEndedAtUnix: 1710403320, RequestCount: 2},
+		HostMetrics:         &protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403265},
 		QueuedAtUnix:        1710403265,
 	}, 1710403000); err != nil {
 		t.Fatalf("third upsert failed: %v", err)
@@ -42,7 +41,7 @@ func TestObservabilityBufferStoreUpsertReplayAndAck(t *testing.T) {
 	if len(records) != 1 {
 		t.Fatalf("expected one replayable record before current window, got %d", len(records))
 	}
-	if records[0].TrafficReport == nil || records[0].TrafficReport.RequestCount != 12 {
+	if records[0].EdgeHealth == nil || records[0].EdgeHealth.Connections != 12 {
 		t.Fatalf("expected replayable record to keep latest upsert, got %+v", records[0])
 	}
 
@@ -89,10 +88,10 @@ func TestObservabilityBufferStoreMergesAccessLogsWithinWindow(t *testing.T) {
 }
 
 func TestObservabilityWindowStartedAt(t *testing.T) {
-	if value := ObservabilityWindowStartedAt(nil, nil, &protocol.NodeTrafficReport{WindowStartedAtUnix: 1710403200}); value != 1710403200 {
-		t.Fatalf("unexpected traffic window start: %d", value)
+	if value := ObservabilityWindowStartedAt(nil, &protocol.NodeEdgeHealth{CapturedAtUnix: 1710403259}); value != 1710403200 {
+		t.Fatalf("unexpected edge-health window start: %d", value)
 	}
-	if value := ObservabilityWindowStartedAt(&protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403259}, nil, nil); value != 1710403200 {
-		t.Fatalf("unexpected snapshot-derived window start: %d", value)
+	if value := ObservabilityWindowStartedAt(&protocol.NodeMetricSnapshot{CapturedAtUnix: 1710403259}, nil); value != 1710403200 {
+		t.Fatalf("unexpected host-metrics window start: %d", value)
 	}
 }