feat(observe): surface revoked install tokens; doctor managed-observe section

[michiosw]

What & why

Revoked-token DevX + kontext doctor, and the final wire-format change (ENG-442). Closes the loop so a self-serve operator whose key was revoked gets an actionable message instead of a silently-dead daemon. Builds on #277.

• Consecutive-401 detection: managedstream fires OnAuthFailure after 3 straight 401/403s (re-fires periodically), and OnFlushSuccess only after an accepted post. The daemon turns that into a stderr line ("token rejected — run kontext setup with a new token") and a last-auth-error.json breadcrumb next to the guard DB; a later success clears it.
• kontext doctor managed-observe section: config path + scope (system MDM / user / env), org, installation id, live token-resolve check through the daemon's read path, socket probe, LaunchAgent presence + MDM-coexistence warning, and the breadcrumb (kind-aware: auth vs startup).
• Batches no longer send organization_id. The install token is the only org binding (server resolves it per request, see #574); managed.json keeps the org id purely as a local label for doctor/setup output. Stream Options/Payload drop the field and tests assert it is absent from the wire.

How to review / test — pure Go

go build ./... && go vet ./... && go test ./... && go test -race ./...

• managedstream/stream_test.go: the 401 counter + refire, OnFlushSuccess only on accepted post, and assertion that organization_id is absent from the posted payload.
• managedobserve/autherr_test.go + doctor_test.go: breadcrumb round-trip, corrupt-file tolerance, doctor section rendering.

To see the live revoked-token behaviour, use the branch-built binary from #277 against the local stack, then revoke the key in the dashboard: within a few flushes the daemon logs the actionable message and the breadcrumb appears; kontext doctor shows it; seeding a fresh key clears it on the next accepted flush. (No brew required.)

Risk

The claim removal is forward-safe: old deployed agents keep sending organization_id and the server keeps verifying it (#574); only new agents omit it. Rollout: the kontext API change (#574) must be deployed before a CLI release that omits the claim.

Part of the ENG-442 kontext-cli stack: #276 -> #277 -> #278.

[michiosw]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix(selfserve): harden managed observe cli readiness #286
• feat(observe): surface revoked install tokens; doctor managed-observe section #278 👈 (View in Graphite)
• feat(setup): kontext setup / --uninstall for self-serve managed observe #277
• feat(selfserve): scope-aware config/identity paths, user settings merge, version fallback #276
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR improves managed-observe diagnostics and updates the hosted ledger wire format. The main changes are:

• Adds auth and startup breadcrumb files for daemon token failures.
• Surfaces managed-observe status in kontext doctor.
• Reports repeated hosted 401/403 responses and clears breadcrumbs after accepted posts.
• Removes organization_id from managedstream batch payloads.
• Tightens hosted hook detection in Guard doctor output.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

_{Reviews (2): Last reviewed commit: "feat(observe): surface revoked install t..." | Re-trigger Greptile}

[michiosw]

@greptileai