Description
When something breaks, the first question is whether it is Cloudflare. The public status page API gives component and region status without credentials; an opt-in collector turns it into a gauge and incident log events.
Acceptance Criteria
- #1 Opt-in collector exports component status as a gauge and emits a log event per incident update
- #2 It uses no Cloudflare credentials and is isolated from the read-only API client
- #3 Every new signal and attribute is declared in internal/semconv, listed in docs/signals.md, and has a panel in grafana/build_dashboard.py
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Loop15 E50D: doc- and live-verified public status API, opt-in statuspage.status collector using its own bounded HTTP client and no credentials. Summary supplies components; all-incidents endpoint retains resolved updates absent from summary. Bounded component gauge snapshots, incident-update log events filtered by scheduler windows; no full-history/backfill guarantee beyond the vendor latest-50 endpoint. New names/config freeze recorded privately by root. Source slice owns package and append-only registries; dashboard panel follows in the dedicated DASH chain before AC3 closes.
Root amendment after independent local seam mapping: supersede the unimplemented statuspage.status registration with independently opt-in statuspage.components (SnapshotCollector) and statuspage.incidents (WindowCollector), both default off with five-minute intervals. Components publish a complete validated current-state summary through the existing expiring snapshot emitter; incident logs remain buffered and checkpointed after successful commit. No all-channel atomicity is promised or required by AC1/2. No shared buffer/scheduler/emitter changes. Earlier string truncation attribute remains explicit. Root vendor documentation and all captured component/update field types were reverified; dashboard remains a later dedicated slice.
Loop16 E50D recommission: latest-page coverage and unbounded publication latency were the two prior majors. Use the existing updated_at checkpoint as the ledger, emit each update once, explicitly scope incidents beyond the latest page out, and prove older-window delayed publication and already-emitted updates. Keep existing names, opt-in component and incident collectors, no new storage. I2 reserved from three implementation attempts remaining; two review-repairs remain.
Loop24 best-effort contract: latest incident page updated_at newer than persisted checkpoint only; document late/older/off-page omissions. Preserve stale draft, integrate fresh current main; own bounded credential-free HTTP client; FileStore restart no-reemit/newer-emission tests; all signals, deny registry and generated panel.
Implementation Notes
Loop15 source slice parked before implementation: existing scheduler buffer lacks snapshot TTL/replace/clear publication support, so the frozen expiry/retirement and after-commit publication contract cannot be met within package ownership. No code, candidate, gate or deployment produced; implementation repair allowance unspent. Earlier truncation-attribute mismatch resolved by using the existing string-attribute seam, but this second gap needs an authorized shared buffered-snapshot seam in a later packet, not a silent fallback or direct-emitter bypass. Dashboard AC remains open.
Source remains uncommitted and parked after RR1. Fixed five-minute incident lag passed a meaningful delayed-publication scheduler regression and the complete required gate, but second complete CodeRabbit review found two unresolved majors: requested-window coverage unknown from latest 50 incidents, and no vendor publication-latency bound despite fixed lag. Frozen source/response-local dedup/window contract supplies neither covering history nor persistent replay ledger. No third review or waiver; staged work and logs retained. I1 complete, RR1 used, two review-repairs remain; scope/review-ceiling park rather than exhausted balances. Component snapshots remain undelayed; no source or dashboard AC closed.
Loop16 E50D-I2 blocked on observed public-boundary reproduction: delayed update count zero while already emitted control count one after FileStore restart. Scalar last-seen updated_at cannot distinguish an arbitrarily delayed older update from one already emitted; empty polls also cannot retain a nonadvancing mark. No new ledger and once-only arbitrary-latency coverage cannot both hold. Source is uncommitted and retained; no gate, CodeRabbit or landing. Cumulative implementation count 2 and review-repair count 1, infrastructure retries 0; two implementation and two review-repair slots remain but require an owner-authorised contract change. Resume at explicit best-effort coverage or separately authorised durable per-update state, not another unchanged attempt.
Loop24 starts cumulative attempt3 with two historical implementation attempts and one review-repair spent. Pre-final-verification ownership blocker resolved by admitting append-only status attributes to deny registry. Existing checkpoint/storage seam unchanged; old arbitrary-latency once-only contract superseded by explicit owner best-effort decision.
Loop24 final attempt4 rescue produced immutable candidate e0e98dfc4455b0d2c46bdad44cbd2ac4e8b18515; just check green, fresh statuspage runtime fixtures and rendered Helm defaults passed, CodeRabbit complete20files zero findings. Root security review and push-agent landing/CI/composed gate pending. Ownership amendments added deny-registry status attributes and existing Helm values published defaults only; no live Helm operation or credential changes.
Loop24: cumulative4 implementation attempts and2 review-repair rounds used. Unpushed candidatee0e98dfc4455b0d2c46bdad44cbd2ac4e8b18515 has green immutable gate, default FileStore/credential fixtures, rendered Helm and complete20-file CodeRabbit zero findings, but independent security review found major supported-config replay: positive max_window=500ms permits fractional persisted mark, existing scheduler truncates it backward at restart and can reemit a committed fractional updated_at. Root confirmed source trace, not a new runtime reproduction. AC1-3 remain unchecked, no landing or CI. Resume needs owner-raised implementation ceiling, then config-boundary repair for whole-second statuspage initial_lookback/max_window and deterministic restart regression; older shared scheduler seam not silently changed. Best-effort late/older/off-page omission decision remains valid.
Loop25 R1: 0 implementation attempts for reconciliation. Statuspage source landed 6e7e046e90d6cfb7f24032bb0ffd6b4203d80d9c with whole-second validation, actual CLI and regression red-green, FileStore restart no-replay, CodeRabbit complete with zero findings and SP-SEC PASS. Exact CI and composed G-SP pending definitive root verdict. AC1–3 remain unchecked and status Parked until that supplied verdict; historical attempts retained.
Loop25 final acceptance supersedes earlier pending note: root verified exact CI run 37424290375, headSha 6e7e046e90d6cfb7f24032bb0ffd6b4203d80d9c, completed success with all jobs including ci-success successful. Composed G-SP just check exit0 on the same SHA; root-retained private composed gate evidence. Root reviewer/gate/security acceptance granted. Whole-second validation, actual CLI/regression red-green and FileStore restart no-replay prove the repaired best-effort contract. Loop25 SP consumes 1 implementation attempt and 1 delta security repair round; historical 4 implementation attempts and 2 review-repair rounds preserved. R1 reconciliation consumes 0. Image DoD not applicable: no Dockerfile, goreleaser or image changes. Late/older/off-page omissions remain explicit, no new live proof.
Final Summary
Delivered opt-in credential-free component gauges and incident-update logs at 6e7e046e90d6cfb7f24032bb0ffd6b4203d80d9c under the accepted latest-page/checkpoint best-effort contract. Whole-second config validation, CLI/regression red-green and persisted FileStore restart no-replay, signal declarations/docs/panel, complete CodeRabbit zero findings and SP-SEC PASS accepted by root. Exact CI 37424290375 and composed G-SP passed on that SHA; AC1–3 and applicable DoD checked.