Description
Turns the label inventory plus the registry into published output. The pillar that carries the coverage-depth reframe.
Coverage depth is the headline
For each observed service, how many of the four signals carry it, plus whether it has an alert rule, a dashboard and an on-call route (the last three from inputs the platform already collects). The estate distribution of that number is simultaneously “what we protect” and “the uncovered surface” - which is exactly the move from gaps to upside the origin question asks for.
Output split, forced by cardinality
- Mimir: estate-level technology enum counts (registry is bounded, so one series per entry); per-stack COUNTS only (observed services, observed technologies, observed clusters); the coverage-depth distribution as a bounded signals-present enum.
- S3 view: the named table - stack, technology, signals present, has alert, has dashboard, has on-call route, last seen. Top-N bound on services.
- Names never become labels. stack x technology at estate scale is five figures of series, so per BUDGET.md own rule that is a table, not a metric.
Rules already binding in this repo
- Every emitted metric declared in emit/budget.py CATALOGUE or tests/test_budget.py fails.
- A per-stack metric carries at most one other label with an enum of four or fewer.
- Label keys must be in emit/guard.py ALLOWED_LABELS.
- A metric the running tier cannot compute is ABSENT, never a structural zero - an hourly tier writing a zero overwrites the real value a slower tier published, and carry-forward correctly refuses to rescue it.
- A view with unsatisfied inputs is withheld so the last good S3 object stays visible with its older timestamp.
- Carry-forward drops carried series whose stack has left the org; an empty stack set means unknown, never an estate of zero.
- Empty-view schemas are re-derived by test, not asserted.
Acceptance Criteria
- #1 Every new metric is declared in the CATALOGUE and test_budget passes
- #2 Named detail is a view; only counts and bounded enums are metrics
- #3 Coverage-depth distribution is emitted as a bounded enum
- #4 A tier that cannot compute a metric emits nothing for it
- #5 Views with unsatisfied inputs are withheld, proven by test
- #6 Guard allow-list unchanged or extended only with bounded keys
Definition of Done
- #1 python3 -m pytest tests -q
- #2 tofu fmt -check -recursive terraform; tofu init -backend=false and tofu validate pass for terraform/ and terraform/examples/standalone/
- #3 customer-identifier and shipped-text gates from .github/workflows/ci.yml return clean
Implementation Notes
Implemented the Pillar K producer on 2026-08-25. Canonical service identity is service_name in Mimir, Loki and Pyroscope and resource.service.name in Tempo; matching trims whitespace and case-folds, then requires exact equality. Generic Mimir service values remain a separate legacy register and share. Dashboard relationships require service: tags retained through source-side minimization; alert relationships require labels.service_name. Titles and receiver names never infer a service. OnCall remains a live grafanacloud-usage panel concern because the external collector cannot inherit the provisioned datasource’s server-side access without widening the frozen per-stack reader scope.
The producer emits only bounded estate enums and per-stack counts. Service, metric, technology and cluster names stay in S3 views. Failed atomic signal reads yield no per-stack metric or row. The named service register is top-100 per stack, ordered by signal depth; its full discovered denominator is published separately. VIEW_INPUTS was re-derived exhaustively: the service register requires signal inventory, dashboard inventory and alert routing; the other Coverage views require signal inventory alone.
CodeRabbit findings fixed: every Mimir label-values request is explicitly bounded, a response reaching the limit is withheld as truncated because the standard response has no definitive truncation field, and Prometheus-compatible responses require status=success exactly. Final review returned zero findings. Full suite: 1379 passed, 2 skipped, 6612 subtests. Fresh-cache OpenTofu validation, recursive formatting, generated budget and shipped-text gates passed. The private identifier gate remains CI-only. GCI-0008.06 owns removal of the narrowly self-checking pending-dashboard consumer exemptions.
Final Summary
Shipped the Pillar K producer with bounded Mimir counts, identity-bearing S3 registers, unmatched shares, absent-versus-zero semantics and derived hydration dependencies. Full tests, generated budget, Terraform validation, CodeRabbit and the secret-backed identifier scan passed.