Description
Users paying per series need to drop individual metrics or attributes without disabling a whole collector.
Acceptance Criteria
- #1 Config can drop metrics by name and attributes by key, validated against internal/semconv at load (unknown names fail fast)
- #2 Dropping applies before export with tests
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Loop15 E51B: core predecessor is terminal parked, so the serialized core mutex is released without landing its code. Add empty-default metric and attribute deny lists under OTLP, validated exactly against semconv names at config load. Filter before SDK emission, including buffered replay and nested span data, preserving snapshot TTL and atomic batch behavior and dry-run accounting. No log/span-name deny lists, new signals, resource filtering or runtime reload. Root freezes registry validation and collision semantics before source dispatch; fresh review required.
Loop16 E51B-R rebases the retained reviewed deny-list candidate onto the ZERO landing SHA, retaining both sides of registry additions. Rebase charges no implementation attempt. Lane reruns gate and CodeRabbit and returns local commits, then fresh exact-SHA REV. Prior hold on an allowed loopback hit is not a source defect and never blocks publication.
Implementation Notes
Publication parked, not a source defect or leaked identifier: reviewed source passed the exact integrated gate, but unchanged required net/history scripts each report one allowed loopback IPv4 hit in the candidate additions. The frozen run requires literal zero hits. A forward same-branch repair cannot remove an already-recorded history hit without rewriting history, which is forbidden. Original candidate and integrated landing are retained; no scanner waiver, history rewrite or push. Implementation I1 completed; repair balances are not reset or described as exhausted.
Loop16 E51B source accepted on fresh REV PASS e547d0159fe587903f420f5c62110d8fe31165c3 after one inference-qualification review repair. Rebase charges no implementation; cumulative review-repair used one, infrastructure zero. Preserved two reviewed commits cherry-picked as 1b21a88 and dd7fd00, only allowed documentation append context shifted. Integrated gate, net/history/public scans passed and source pushed 668b0c5358adfb898154f6bb627034a64a48a5e7. Landing CI is watched, not yet claimed green. Direct and false-marker identities retain explicit-deny semantics, true inferred identities cannot lose required qualification while retaining dependent identity.