Description
Rule IDs mean nothing on a dashboard; the read-only zone rulesets endpoint (custom and managed firewall phases) maps them to descriptions.
Acceptance Criteria
- #1 Firewall event metrics carry rule ID, rule description, host and country when advertised, under a series cap
- #2 Ruleset lookups are cached per zone and read-only
- #3 A new dataset or endpoint has a live-verified entry in doc-0003 and an API drift canary probe
- #4 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
- #5 Any new token permission is added to the token permission matrix in the docs
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Loop15 implementation follows the frozen lane packet; assertion-based red witness, local just check and CodeRabbit, independent REV where required, root linear landing and sustained live evidence where applicable.
Loop18 root eligibility-first firewall schema query accepted on advertised dataset, zero rows recorded honestly; lane adds eligible canary and test in probe.go/firewall_test.go, guarded review before landing, root one canary and doc-0003 entry.
Implementation Notes
Loop16 RECON-M1 checked source criteria 1,2,5 against landed tests at ced4edfbfb66f1b9ee45037bdb425b69820a8ebe. Evidence: codex/evidence-loop16/RECON-return.txt. No new live or browser observation is claimed.
Loop16 DASH-1 enriched firewall METRIC panel landed on exact reviewed patch at d997015, preserving rule description, host, country and source dimensions with honest optional absence. Source panel criterion checked; missing root live-reference entry remains AC3 open, live dashboard sync read pending.
Loop18: implementation attempts2, review-repair rounds1 plus brief-only retry disposition. Eligible root sixfield selection accepted with zero rows; one task-scoped real drift canary matched with saturation, explicitly populated shape unproven. Strict canary prevents entitlement field downgrade; documented via doc-0003. Landed78f4d46 atop594ce5c; changedbase gate, security/CodeRabbit, CI37204786485 ci-success, composed gate and integrated review green. Four lint-lock conflicts across original and new bases disclosed, resolved after observed release; not implementation defects. No image/package changes or new signals; packaging gate not applicable. Parent remains open.
Final Summary
Added eligible strict firewall rule/host/country canary and authentic entitlement-downgrade regression; recorded current selection acceptance and its empty/saturated limitations in live reference. Source, targeted live canary, reviews, exact CI and composed gate pass.