Description
cloudflare.access.allowed is the string allowed on cloudflare_access_logins_total (GraphQL dimension passed through raw) but true/false on the identity-login and request metrics, and cloudflare.access.country is lowercase on login logs while every other country attribute is an uppercase ISO code. Queries have to special-case both.
Acceptance Criteria
- #1 allowed is a boolean-valued true/false on every Access signal
- #2 Access country values are uppercase ISO 3166-1 alpha-2
- #3 docs/signals.md and the dashboard queries match
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Loop14 candidate 1b5bc66e581077577e8da46454526c5f5a3e8407: registered Access collector regression fails by assertion on base e3c9160 and passes candidate; just check and CodeRabbit complete, zero findings, all four changed files reviewed. Landing d1e5f779ce2ee028e2dfb9bfd0c2780f3a9695dc passed root gen-check/check and was pushed. AC3 dashboard remains pending.
Final Summary
Access allowed decisions now consistently emit true/false and countries uppercase through public registered-collector tests with assertion-red base and passing candidate. Candidate 1b5bc66e581077577e8da46454526c5f5a3e8407 and root gates passed, CodeRabbit complete zero findings/all four files. Dashboard queries independently reviewed already use false and true/false grouping; DASH1 exact landing 317fa318400f086919742221a6cc85a4c0ba1b0d CI 36830726236 and grafana-sync 36830726196 succeeded. Read-only live v2 dashboard readback confirms the queries and non-JSON body panel. Documentation matches. No packaging change; currently deployed exporter proof is not claimed because DEP1 reverted.