Description
Certificate validation failures and expiry are among the most common avoidable outages. The read-only zone certificate packs endpoint works on every plan.
Acceptance Criteria
- #1 Per certificate pack: status, type, issuer and seconds-to-expiry are exported
- #2 A shipped alert rule fires before expiry and on a non-active status
- #3 A new dataset or endpoint has a live-verified entry in doc-0003 and an API drift canary probe
- #4 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
- #5 Any new token permission is added to the token permission matrix in the docs
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Loop14 candidate e586bdd5f9b9cb56cfa7586cc2de5acd17df3e28 passed fresh exact-SHA review after null-list false success and HTTP-200 permission-error accounting gaps were repaired. Registered actual HTTP observer tests prove logical envelope counter without fake statuses or duplicate requests; empty arrays valid/null invalid. Full gate/CodeRabbit all seven paths, doc-0003, drift and permission matrix verified. Current certificate-status/expiry alert interpretation under retained SDK series remains unproven and is tracked by CFO-0063; AC2 and dashboard/live proof not claimed.
DASH2 generated-alert fixture confirms stale old pending/600-second series beside current active/2592000-second series can trigger a false certificate alarm. Root explicitly parks AC2 unchanged; no unsafe certificate rule shipped. Table labels observations, not guaranteed current inventory. Resume through CFO-0063 current-snapshot and expiry-freshness proof; other independently verified code/documentation criteria remain checked.
LIVEP70 terminal backend proof confirms certificate expiry series after the first post-deploy snapshot. Native dashboard readback confirms panel 2640 using cloudflare_certificate_expiry_seconds and explicitly titled expiry observations, not current inventory. Declared names/docs and generated-dashboard gate passed. AC2 remains unchecked and unshipped because retained old status/expiry observations can cause a false alert; this task is not Done.
Loop16 RECON-M1 checked source criteria 2 against landed tests at ced4edfbfb66f1b9ee45037bdb425b69820a8ebe. Evidence: codex/evidence-loop16/RECON-return.txt. No new live or browser observation is claimed.
Final Summary
Loop16 reconciled all acceptance criteria on the landed source and cited test evidence.