Description
cf1AccessLoginsRawGroups (sum.logins, 3h window), accessLoginRequestsAdaptiveGroups (service-token/nonidentity traffic), SCIM updates REST, and inventory gauges from /access/apps and /access/users.
Acceptance Criteria
- #1 Login metrics keep identity and nonidentity (service token/bypass) separable
- #2 SCIM updates emitted as log records with a persisted cursor
- #3 Inventory gauges for apps and users with bounded attributes; app names/domains feed enrichment of the other Access signals
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Access Groups, SCIM cursor and inventory tests passed in exact CI 35875578089. Live m7kni metrics include access apps, users and separated login/request counters.
Final Summary
Access metrics, SCIM and inventory released; tests and live metric families verified.