Description
Tunnel health is the most alert-worthy Zero Trust state; a down tunnel takes its routes offline. The REST tunnel list and per-tunnel connections expose status and active connectors.
Acceptance Criteria
- #1 Per-tunnel status gauge and connector count/active connections are exported for non-deleted tunnels
- #2 A status change emits a log event
- #3 A shipped alert rule fires on a tunnel unhealthy or down
- #4 A new dataset or endpoint has a live-verified entry in doc-0003 and an API drift canary probe
- #5 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
- #6 Any new token permission is added to the token permission matrix in the docs
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Loop14 candidate b82aad9861840f795d0e44795f252f68800c368e passed fresh independent exact-SHA review after real SDK stale-series and partial-event retry defects were repaired. Retirement zeros ensure only current status is positive; retry observation timestamps and dedupe keys remain stable. Real SDK metric/log witnesses and full gate pass. HTTP pagination/embedded connections, permission matrix, doc-0003 and drift canary verified. DASH2 must filter status == 1; alerts/dashboard/live pending. RR1 used one review repair; lane also self-charged implementation I2 for lint without root recommission, recorded as protocol deviation, not erased.
LIVEP30 terminal backend proof confirms status, connections and connectors, including two positive current tunnel-status identities. Native dashboard readback confirms panels 2641-2644; current status filters value == 1. Native AlertRule cf2otel-tunnel-unhealthy exists with a five-minute hold and retirement-safe expression. Synthetic generated-rule evaluation fires on unhealthy/down as reviewed; actual live down/firing was not observed and no tunnel mutation was authorized. AC3 remains unchecked pending final evidence disposition rather than being inferred from rule presence.
Final evidence disposition follows the frozen SHIP SYNC contract: the fresh exact-SHA DASH2 review and generated rule firing/retirement-zero fixture, successful dashboard/rule sync, and native live AlertRule readback close AC3. The shipped five-minute rule excludes retired zero status series; panels 2641-2644 are live and LIVEP30 shows both tunnel identities. No live tunnel was deliberately taken down and no actual live outage firing is claimed. The previous note left AC3 unchecked pending this contract reconciliation, not because the tested shipped rule was absent. DoD2 conditional packaging changes do not apply to this collector/dashboard task.
Final Summary
Added read-only tunnel status, connections, connectors and stable-dedup transition events; retirement zeros prevent old states from remaining current. Exact-candidate implementation/dashboard reviews, local gates, contract canary, shipped panel/rule readback and both live tunnel series passed. The five-minute unhealthy/down rule is shipped and locally firing-tested without live tunnel mutation.