Description
spec/cloudflare/contract.json checks 4 GraphQL datasets and 4 REST paths, so the canary does not watch firewall, DNS analytics, RUM, Gateway DNS, audit v2, SCIM, the 22 platform Groups datasets or email. The canary exists to catch the one-unentitled-field-fails-the-query trap. Rob authorised (2026-09-25) widening the schema-probe token with additional read-only permission groups where a dataset cannot otherwise be introspected; that token only.
Acceptance Criteria
- #1 contract.json has an entry with required fields and minimum maxDuration and notOlderThan for every dataset and REST path a registered collector queries, and a unit test fails when a registered collector’s dataset has no entry
- #2 A scheduled canary run succeeds at the exact SHA and its logs and artifacts contain zero token bytes
- #3 Any schema-probe token permission change is read-only, recorded by permission-group name before and after, and touches no other token
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Loop 7: contract and AST coverage test landed at 1daf4be; local live canary matched after the bounded firewall/detailed-log correction, just ci passed, and CI 36237411272 had ci-success success. TOKEN-32 added only Access Audit Logs Read, Access SCIM Logs Read, AI Gateway Read and Account Settings Read to the schema-probe token in one PUT, re-GET confirmed the read-only groups and unchanged resources; no runtime token edit. AC2 remains open until the first scheduled Cloudflare API drift run created after both the token edit and 1daf4be push concludes, with artifact/log token-byte inspection.
Loop 7 AC2: first scheduled Cloudflare API drift run after the read-only schema-token edit and L32 push was run 36238824560, created 2026-09-26T11:26:28Z at exact SHA eb5c2c7 (contains L32). The probe job succeeded and its log said Cloudflare API contract matched. The workflow produced zero artifacts; the downloaded run log and artifact directory were scanned against exact bytes of five locally held credentials, including the schema-probe token, with zero hits. No token bytes entered tracked files.
Loop 7 run-end: implementation attempts 2/4 (lane contract plus root live-canary correction), review-repair 0/3, infrastructure retries 0, token-edit grant 1/1 used for four read-only groups. Done because the first post-edit scheduled drift run 36238824560 at eb5c2c7 succeeded, reported contract matched and its downloaded log had zero credential-byte hits; no artifact was produced.
Run-end accounting correction: one CodeRabbit WebSocket connection failure was retried before a complete zero-finding review; infrastructure retries 1, not 0. Implementation 2/4, review-repair 0/3 and token-edit 1/1 are unchanged.
Final Summary
Expanded the drift contract to all registered collector API surfaces, added a coverage test, widened only the schema-probe token with four read-only groups, and verified the first post-change scheduled canary and token-byte scan.