Description
Loop14 independent certificate review found that status is part of a synchronous gauge attribute set. The cumulative SDK can keep exporting earlier status series and their old seconds-to-expiry values after a later snapshot changes the pack. Current-status and expiry alert interpretation cannot be claimed solely from an emitted series or a green generator; the owned collector tests do not yet prove retirement across real SDK exports.
Acceptance Criteria
- #1 A real SDK/export-boundary reproduction distinguishes current certificate pack state from retained prior status series
- #2 Successful changed and empty snapshots do not leave stale positive expiry or status evidence usable as current state
- #3 Certificate dashboard and alert queries are verified against the corrected snapshot semantics
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Loop15 implementation follows the frozen lane packet; assertion-based red witness, local just check and CodeRabbit, independent REV where required, root linear landing and sustained live evidence where applicable.
Implementation Notes
Loop16 RECON-M1 checked source criteria 1,2,3 against landed tests at ced4edfbfb66f1b9ee45037bdb425b69820a8ebe. Evidence: codex/evidence-loop16/RECON-return.txt. No new live or browser observation is claimed.
Final Summary
Loop16 reconciled all acceptance criteria on the landed source and cited test evidence.