feat(observability): emit run and reaction baseline audit events

Diagrams reviewed: docs/architecture/AGENT_DIAGRAM.md, docs/architecture/GATEWAY_SESSIONS_AND_QUEUE.md, docs/api/PROTOCOL.md (no changes required).

src/daemon/routing.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi, afterEach } from 'vitest';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
 import { AgentRouter } from '../agents/router.js';
 import { AgentConfigRegistry } from '../agents/registry.js';
 import { HookEngine } from '../hooks/index.js';
@@ -355,6 +355,165 @@ describe('daemon command fast-path integration', () => {
     );
   });
 
+  it('emits run.cancel telemetry for /stop command fast-path', async () => {
+    const processSpy = vi.spyOn(AgentOrchestrator.prototype, 'process');
+    const mockAuditLogger = {
+      userAction: vi.fn(),
+      runCancel: vi.fn(),
+      runState: vi.fn(),
+    };
+    initAuditLogger(mockAuditLogger as any);
+
+    const session = {
+      id: 'telegram:user-stop',
+      addMessage: vi.fn(),
+      getHistory: vi.fn(() => []),
+      clear: vi.fn(),
+      replaceHistory: vi.fn(),
+      getConfig: vi.fn(() => undefined),
+      setConfig: vi.fn(),
+      deleteConfig: vi.fn(),
+    };
+
+    const commandRegistry = new CommandRegistry();
+    registerBuiltinCommands(commandRegistry);
+
+    const router = createMessageRouter({
+      sessionManager: {
+        getSession: vi.fn(() => session),
+      } as unknown as MessageRouterDeps['sessionManager'],
+      modelRouter: {
+        getAvailableTiers: () => ['fast', 'default', 'complex', 'local'],
+        getAllLabels: () => ({ fast: 'fast', default: 'default', complex: 'complex', local: 'local' }),
+        getLabel: (tier: string) => tier,
+      } as unknown as MessageRouterDeps['modelRouter'],
+      systemPrompt: 'test prompt',
+      toolRegistry: {
+        clone() { return this; },
+        register: vi.fn(),
+      } as unknown as MessageRouterDeps['toolRegistry'],
+      toolExecutor: {} as unknown as MessageRouterDeps['toolExecutor'],
+      config: {
+        agents: {
+          primary_tier: 'default',
+          delegation: {
+            compaction: 'fast',
+            memory_extraction: 'fast',
+            classification: 'fast',
+            tool_summarisation: 'fast',
+            complex_reasoning: 'complex',
+          },
+          max_delegation_depth: 3,
+          max_iterations: 10,
+        },
+        compaction: { enabled: false },
+        models: { default: { provider: 'anthropic', model: 'claude' } },
+      } as unknown as MessageRouterDeps['config'],
+      commandRegistry,
+    });
+
+    const reply = vi.fn(async (_message: OutboundMessage) => {});
+    await router.handler({
+      id: 'm-stop',
+      channel: 'telegram',
+      senderId: 'user-stop',
+      text: '/stop',
+      timestamp: Date.now(),
+      metadata: { isCommand: true, command: 'stop' },
+    } as MessageRouterInput, reply);
+
+    expect(processSpy).not.toHaveBeenCalled();
+    expect(mockAuditLogger.runCancel).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'telegram:user-stop',
+        source: 'channel',
+        requested: true,
+        acknowledged: false,
+      }),
+    );
+    expect(reply).toHaveBeenCalledWith({
+      text: 'No active operation to cancel.',
+      replyTo: 'm-stop',
+    });
+  });
+
+  it('emits run.state start and complete for non-command channel messages', async () => {
+    const processSpy = vi.spyOn(AgentOrchestrator.prototype, 'process').mockResolvedValue('ok');
+    const mockAuditLogger = {
+      userAction: vi.fn(),
+      runState: vi.fn(),
+    };
+    initAuditLogger(mockAuditLogger as any);
+
+    const session = {
+      id: 'telegram:user-runstate',
+      addMessage: vi.fn(),
+      getHistory: vi.fn(() => []),
+      clear: vi.fn(),
+      replaceHistory: vi.fn(),
+      getConfig: vi.fn(() => undefined),
+      setConfig: vi.fn(),
+      deleteConfig: vi.fn(),
+    };
+
+    const router = createMessageRouter({
+      sessionManager: {
+        getSession: vi.fn(() => session),
+      } as unknown as MessageRouterDeps['sessionManager'],
+      modelRouter: {
+        getAvailableTiers: () => ['fast', 'default', 'complex', 'local'],
+        getAllLabels: () => ({ fast: 'fast', default: 'default', complex: 'complex', local: 'local' }),
+        getLabel: (tier: string) => tier,
+      } as unknown as MessageRouterDeps['modelRouter'],
+      systemPrompt: 'test prompt',
+      toolRegistry: {
+        clone() { return this; },
+        register: vi.fn(),
+      } as unknown as MessageRouterDeps['toolRegistry'],
+      toolExecutor: {} as unknown as MessageRouterDeps['toolExecutor'],
+      config: {
+        agents: {
+          primary_tier: 'default',
+          delegation: {
+            compaction: 'fast',
+            memory_extraction: 'fast',
+            classification: 'fast',
+            tool_summarisation: 'fast',
+            complex_reasoning: 'complex',
+          },
+          max_delegation_depth: 3,
+          max_iterations: 10,
+        },
+        compaction: { enabled: false },
+        models: { default: { provider: 'anthropic', model: 'claude' } },
+      } as unknown as MessageRouterDeps['config'],
+    });
+
+    await router.handler({
+      id: 'm-runstate',
+      channel: 'telegram',
+      senderId: 'user-runstate',
+      text: 'hello',
+      timestamp: Date.now(),
+    } as MessageRouterInput, vi.fn(async (_message: OutboundMessage) => {}));
+
+    expect(processSpy).toHaveBeenCalledTimes(1);
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'telegram:user-runstate',
+        source: 'channel',
+        state: 'start',
+      }),
+    );
+    expect(mockAuditLogger.runState).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'telegram:user-runstate',
+        source: 'channel',
+        state: 'complete',
+      }),
+    );
+  });
+
   it('handles model command via fast-path and persists tier override', async () => {
     const processSpy = vi.spyOn(AgentOrchestrator.prototype, 'process');
     const setModelTierSpy = vi.spyOn(AgentOrchestrator.prototype, 'setModelTier');
@@ -2081,6 +2240,17 @@ describe('daemon tts routing integration', () => {
 });
 
 describe('daemon reactions routing integration', () => {
+  const mockAuditLogger = {
+    userAction: vi.fn(),
+    reactionMatch: vi.fn(),
+    reactionSkip: vi.fn(),
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    initAuditLogger(mockAuditLogger as any);
+  });
+
   afterEach(() => {
     vi.restoreAllMocks();
   });
@@ -2149,6 +2319,14 @@ describe('daemon reactions routing integration', () => {
     expect(prompt).toBe(
       'Summarize and suggest next steps:\n\nNew email from boss@company.com: Please share timeline',
     );
+    expect(mockAuditLogger.reactionMatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'gmail:reaction-user-1',
+        source: 'channel',
+        rule_name: 'boss-email',
+        candidate_count: 1,
+      }),
+    );
   });
 
   it('keeps original prompt when no reaction rule matches', async () => {
@@ -2213,6 +2391,14 @@ describe('daemon reactions routing integration', () => {
     expect(processSpy).toHaveBeenCalledTimes(1);
     const [prompt] = processSpy.mock.calls[0] ?? [];
     expect(prompt).toBe('New email from teammate@company.com: FYI');
+    expect(mockAuditLogger.reactionSkip).toHaveBeenCalledWith(
+      expect.objectContaining({
+        session_id: 'gmail:reaction-user-2',
+        source: 'channel',
+        reason: 'no_match',
+        candidate_count: 1,
+      }),
+    );
   });
 });