Description
Logpush health is exported only as account-wide upload and record totals, so a failing job cannot be alerted on. logpushHealthAdaptiveGroups can be filtered to non-200 status with job, destination type and final-attempt dimensions, at both account and zone scope.
Acceptance Criteria
- #1 Failed uploads are exported by job ID, destination type, status and final-attempt flag, at account and zone scope
- #2 A shipped alert rule fires on a job failing its final attempt
- #3 A new dataset or endpoint has a live-verified entry in doc-0003 and an API drift canary probe
- #4 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Loop14 frozen extension A9v2 is active on an isolated lane. The shared seam is landed at 9705290 with fresh independent review, full gate, successful integrated live contract canary, ordinary exact-SHA CI and doc-0003 section 15. Failure selection uses source success=0, not an invented non-200-only predicate; explicit enablement opts into bounded job-ID labels. I1 behavior proof passed but stopped on lint; root commissioned bounded I2 lint repair. AC1 remains unchecked until exact-candidate review/landing; alerts and dashboard AC2/4 remain unshipped beyond the final release boundary.
Fresh independent review rejected candidate f8ebf96: a successful account response followed by a null owned-zone dataset could normalize to empty and emit partial account counts before advancing the window. Root commissioned RR1 through the existing raw batch interface inside the owned collector; required real-HTTP account-then-zone-null proof must preserve cursor and emit nothing, while genuine empty arrays remain valid. Prior CodeRabbit destination whitelist and second opt-in recommendations were independently nonblocking under the frozen bounded source-destination/explicit collector-opt-in contract. Lifetime job/destination churn remains a real residual risk: the cap bounds each window, not lifetime labels, and SDK overflow can reduce per-job attribution. It is not claimed solved.
Reviewed repaired candidate dbc47b5 received fresh independent PASS. Root integration 2bc151b passed exact-SHA just check and net/newly-reachable-history privacy scans, then was pushed. Its CI run was cancelled by the newer containing Health landing; the CI gate moves to the latest containing SHA rather than counting cancellation as success. AC1 is locally proven and source-landed; AC2 alerts and AC4 panels/live remain unshipped. Root accepts the independent contract-based disposition of CodeRabbit zone-skipping advice: partial zone omission would violate all-owned-scope failure-before-emission; an unavailable owned zone can stall the entire collector. Per-window cap does not bound lifetime job/destination churn.
Loop16 RECON-M1 checked source criteria 2,4 against landed tests at ced4edfbfb66f1b9ee45037bdb425b69820a8ebe. Evidence: codex/evidence-loop16/RECON-return.txt. No new live or browser observation is claimed.
Final Summary
Loop16 reconciled all acceptance criteria on the landed source and cited test evidence.