Description
Bot score and score source are plan-gated fields; one unentitled field fails the whole GraphQL query, so the query must fall back cleanly when the zone lacks them.
Acceptance Criteria
- #1 Bot score buckets and score source are exported where advertised
- #2 A zone without the fields still emits the base firewall metric
- #3 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Loop16 E49B fixture source now admitted from current firewall Groups and ByTimeGroups schema: botScore is uint8, botScoreSrcName is string. Root freezes exporter-defined width-ten numeric bins covering 0..255, final bin250..255, without human/bot classes or sentinel assumptions. Global field existence is not zone entitlement; select only per-zone advertised fields within budget, otherwise preserve base count. No new config flag: existing low-cardinality defaults/cap apply. Source names are bounded to32 sticky values plus other. Two new semantic attributes and deny-registry entries, no new metric. Dedicated dashboard follows later; live score fields remain unadvertised on enabled zones.
Implementation Notes
Loop15 current settings covered23 zones, firewall groups enabled on one. No enabled zone advertises botScore, botScoreBucketBy10 or botScoreSrcName. Their global schema presence is not entitlement. Prerequisite park retained; no implementation attempt, speculative field query or fallback source mutation. Existing base firewall source remains unchanged.
Loop16 source landed in ca207018dec85ab25e8a51ab32844e8e4bd26bc8 after fresh REV-E49B-R2 PASS1288e883ea26c6e1309b3f516d0e31968ec969ee. Parent deferred-emitter sticky-admission reproduction assertion-red, candidate green, independently repeated full gate. Two source commits replayed identically, original failed review retained. One review-repair consumed; fixture-only advertised uint8 bins and capped source names, no live score export claim. Panel portion AC3 remains open; semantics and docs declared. Integrated gate and net/history/repo scans passed; exact CI pending.
Loop16 panel source landed730f8a219749d36878bdfa58f9c4cbe10b1cddb7 after fresh REV-DASH4-R1 PASS226dfc7ae1029ef4ab0eb62cf21779c0dbecfc09. Three exact-base assertion-red tests,20 Python/Promtool green, translator and fullgate independently repeated. Prior objects/layout/settings preserved, both CodeRabbit source files covered; missing-promtool skip suggestion left because it weakens proof. Exact replay/generation/rootgate/net-history scans passed. All source criteria checked; no enabled live score-field advertisement/browser proof. This batch is unreleased after final permitted0.15.0; exact CI/grafana-sync pending.