Description
GCI-0023 documented every declared reader scope’s breadth except two. traces:read and profiles:read are recorded in CAPABILITIES.md as explicitly unverified, with the necessary probe named rather than a narrow boundary asserted. This task runs that probe.
Authorised by the operator on 2026-09-11 for wave 2.
The probe
Mint an access policy carrying traces:read and nothing else, on a control organisation. Call content-bearing Tempo routes with it and record what returns 200 and what returns 403. Repeat for profiles:read against Pyroscope. Delete both policies. Verify no residual object remains.
Constraints
- Single-scope policies only. A policy carrying a second scope proves nothing about either one, because a 200 cannot be attributed.
- Never touch an access policy this project did not create. Surfacing the org’s own teams’ policies is the deliverable elsewhere; changing them is not.
- Record the object IDs at mint time and key the teardown on them, never on a name pattern. A name-matching teardown previously deleted a provisioning account and orphaned the custom role it was the only identity able to remove.
- Verify the delete, do not assume it. Re-read by ID and confirm absence. A 2xx on the delete call is not proof.
- Update
CAPABILITIES.mdfrom observed behaviour. Where a route’s status is still ambiguous, say so rather than generalising from one call. - Do not widen, narrow or remove any scope the collector actually declares as part of this task. The deliverable is documentation of what the scopes permit.
Acceptance Criteria
- #1 A single-scope traces:read policy is minted on a control organisation and content-bearing Tempo routes are probed with it
- #2 A single-scope profiles:read policy is minted and content-bearing Pyroscope routes are probed with it
- #3 Both policies are deleted by recorded object ID and absence is verified by re-reading, not assumed from the delete response
- #4 CAPABILITIES.md records observed behaviour per route, and states where a result remains ambiguous
- #5 No access policy this project did not create was read-modified or deleted, and no declared collector scope changed
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
loop3 R-0025: live inventory, isolated single-scope stack-realm policy per traces/profiles, bounded content read, recorded-ID policy delete and GET404; I-0025doc captures verified scope breadth without raw content.
Implementation Notes
Wave 2 attended probe did not run because the operator did not supply the control-organisation identity. No organisation was inferred and no access policy was minted, read, modified or deleted.
loop3 admitted 2026-09-30 under owner goal: root owns tracker; bounded lanes own implementation/discovery, evidence pending. No acceptance claimed yet.
loop3 R-0025 live proof on staff control org: two stack-realm single-scope policies, traces:read and profiles:read, minted separately; Tempo 24h search and fetched trace batches returned 200; Pyroscope ProfileTypes and SelectMergeStacktraces returned 200 with nonempty flamegraph. Both created policy IDs were deleted then re-read as 404. No preexisting policy modified and no collector scopes changed. Evidence is private codex/loop3-evidence/R-0025; documentation lane I-0025doc active. AC1/2/3/5 root evidence accepted, formal checks after documentation integration.
Final Summary
Parked without live mutation. The control organisation was not supplied, so traces:read and profiles:read remain explicitly unverified, no content-bearing route result was claimed, and CAPABILITIES.md was not changed.
SUPERSEDES the old parked outcome: loop3 completed the staff control-org single-scope probe. traces:read returned a 24h Tempo search and nonempty fetched trace; profiles:read returned types and a populated flamegraph. Both stack-realm policies were deleted by recorded IDs, then GET returned 404. No existing policy or collector scope changed. CAPABILITIES documents route results and untested org-realm/other-stack/label-policy boundaries at 1f5acd5e5fa84de06add8e0045c08bb3ad6b7783. Full just check green (1571 passed, 2 skipped), exact-SHA CI 36715056370 success; documentation-only CodeRabbit exemption. R-0025 and I-0025doc evidence retained privately; all live read content excluded from public docs.