perf(deps): make prometheus and TUI onboarding opt-in, not default

[theonlyhennygod]

Summary

• Base branch target: master
• Problem: observability-prometheus and tui-onboarding (ratatui + crossterm) were enabled by default, adding dependency weight for features rarely needed in CLI/server usage.
• What changed:
  • Removed observability-prometheus from root and runtime default features
  • Removed tui-onboarding, dep:ratatui, dep:crossterm from agent-runtime
  • Added tui-onboarding to ci-all for full CI coverage
  • Moved run_tui_if_enabled fallback before test module (clippy fix)
• What did NOT change: Both features still available via --features observability-prometheus or --features tui-onboarding. CLI and config unchanged. The TUI fallback already prints a helpful error message when the feature is disabled.

How to enable

# Prometheus metrics
cargo build --release --features observability-prometheus

# TUI onboarding wizard
cargo build --release --features tui-onboarding

# Both (or use ci-all)
cargo build --release --features "observability-prometheus,tui-onboarding"

Label Snapshot (required)

• Risk label: risk: medium
• Size label: size: XS
• Scope labels: runtime, dependencies
• Change type: refactor
• Primary scope: runtime

Validation Evidence (required)

cargo check                        # clean
cargo check --no-default-features  # clean
cargo clippy --all-targets -- -D warnings  # clean
cargo test --workspace             # all passing

Binary size: 13,323,664 → 13,090,384 bytes (~228KB reduction, now 12MB).

Security Impact (required)

• New permissions/capabilities? No
• New external network calls? No
• Secrets/tokens handling changed? No
• File system access scope changed? No

Privacy and Data Hygiene (required)

• Data-hygiene status: pass
• Neutral wording confirmation: Yes

Compatibility / Migration

• Backward compatible? Partially — default build no longer includes prometheus metrics or TUI wizard
• Config/env changes? No
• Migration needed? Users relying on zeroclaw onboard --tui need --features tui-onboarding. Users relying on prometheus endpoint need --features observability-prometheus.

Rollback Plan (required)

• Fast rollback: git revert <merge-commit>
• Observable failure: TUI wizard shows error message; prometheus endpoint unavailable

---

🤖 Generated with Claude Code

[singlerider]

Hey! CI is failing on Security Audit due to RUSTSEC-2026-0098 and RUSTSEC-2026-0099, two rustls-webpki advisories published 2026-04-14. This is a repo-wide issue — not specific to your PR.

The fix landed in #5786 (merged today). Please merge upstream/master into your branch to pick up the updated .cargo/audit.toml and re-run CI:

git fetch upstream
git merge upstream/master
git push

Sorry for the noise!

[JordanTheJet]

Review verdict — Needs author action

Comprehension: Removes observability-prometheus and tui-onboarding (plus dep:ratatui, dep:crossterm) from the default feature set in root Cargo.toml and from zeroclaw-runtime/default; adds tui-onboarding to ci-all. Moves the #[cfg(not(feature = "tui-onboarding"))] fn run_tui_if_enabled fallback above #[cfg(test)] mod tests (clippy hygiene). Both features remain reachable via --features. No API/CLI/config surface change.

0.7.0 relevance check: PASS. Post-workspace-refactor crate names (zeroclaw-tui, zeroclaw-runtime, zeroclaw-gateway) exist; the PR's last merge of master is stale (762e41b vs master fe3ec58, ~26 commits behind), but git merge origin/master --no-commit --no-ff auto-merges cleanly. The gateway crate independently opts into observability-prometheus in its own [features] table, compatible with the master cascade commit 9753bc7.

Validation (local, macOS x86_64):

• cargo fmt --all -- --check — clean.
• cargo clippy --all-targets -- -D warnings (default) — clean.
• cargo clippy --all-features and cargo build --release — still running at time of review due to heavy concurrent-review contention; dep-graph evidence below is conclusive on the footprint claim.
• cargo tree -e normal --prefix none | sort -u | wc -l: master default = 331 unique crates, PR default = 293 — 38 fewer transitive deps. prometheus, ratatui, crossterm no longer in the default tree.

Size delta: Author reports 13,323,664 → 13,090,384 bytes (~228 KB). Corroborated by the 38-crate reduction.

Security: None.

Performance: Positive — the PR's goal, reproducible at the dep-graph level.

Findings

[blocking] Release/Docker workflows rely on defaults — prebuilt binaries silently lose prometheus + TUI

• .github/workflows/release-beta-on-push.yml:249 and release-stable-manual.yml:275 build with cargo build --release --features "$RELEASE_CARGO_FEATURES" where RELEASE_CARGO_FEATURES = channel-matrix,channel-lark,whatsapp-web (defaults included). Dockerfile/Dockerfile.debian (L45/L63) also rely on defaults.
• After this PR, users installing via prebuilt GitHub releases, Homebrew, or the published Docker image will no longer get the Prometheus /metrics endpoint or the zeroclaw onboard --tui wizard unless the workflows/Dockerfiles are updated.
• Please either (a) add observability-prometheus,tui-onboarding to RELEASE_CARGO_FEATURES + Dockerfile default arg to preserve prebuilt parity, or (b) get explicit maintainer sign-off to ship thin prebuilts and document the new baseline in the next release notes / install docs. The PR body only covers the source-build migration.

[suggestion] Changelog / upgrade-note absence

risk: high plus a behavior change to default builds warrants an explicit CHANGELOG.md / release-notes entry that mirrors the Migration section in the PR body — operators upgrading should see this without reading the PR.

[question] CI coverage of the disabled branch

ci-all now enables tui-onboarding, so the enabled arm of run_tui_if_enabled is covered. Is there any CI invocation that exercises the disabled arm (e.g. cargo test --no-default-features --features agent-runtime,schema-export)? Otherwise the anyhow::bail! fallback is untested and a future rename could silently drop one arm.

[suggestion] PR template completeness

Missing/empty sections per .github/pull_request_template.md: Linked Issue, Human Verification, Side Effects / Blast Radius, Risks and Mitigations, Agent Collaboration Notes. Please fill them.

[nit] Label mismatch

PR body declares risk: medium, size: XS, scope runtime,dependencies; applied auto-labels are risk: high, dependencies, core (auto-labeler picked up src/main.rs). Fine to leave, but the Label Snapshot should reflect the applied labels or note the delta.

---

CI note: Pre-Release Validation + Security Audit failures are pre-existing infra issues (missing PAT secret; RUSTSEC advisories fixed in #5786) per @singlerider's earlier comment, not attributable to this PR. Rebase onto current master will clear the Security Audit.

🤖 Generated with Claude Code

[singlerider]

Comprehension summary: Removes observability-prometheus and tui-onboarding (ratatui + crossterm) from the default feature set in both root Cargo.toml and crates/zeroclaw-runtime/Cargo.toml. Both features remain fully available via --features observability-prometheus or --features tui-onboarding. Adds tui-onboarding to ci-all to preserve CI coverage. Moves run_tui_if_enabled stub above the test module (clippy fix). Blast radius: root crate + zeroclaw-runtime feature graph + src/main.rs. Binary reduction ~228KB (13.3MB → 13.1MB).

Security/performance: Security Audit failure is pre-existing RUSTSEC-2026-0098/0099 on master — not introduced by this PR. CI Required Gate (CI workflow) passes. No new permissions, network calls, or secret handling.

Breaking: users relying on default prometheus metrics or zeroclaw onboard --tui must add --features observability-prometheus or --features tui-onboarding to their build. Risk label auto-corrected to risk: high (correct — core scope).

@JordanTheJet — routing for sign-off on the default feature set change before merge.