Validate the Loki retention surface against an authorised development deployment

Description

GCI-0022 shipped the Loki retention surface with every acceptance criterion met against source and CI, and explicitly did not claim a populated live render or a live collector run. This task closes that gap.

Authorised by the operator on 2026-09-11 for wave 2.

What to observe

• One read-only collector execution against an authorised development deployment. Read-only: collector/httpclient.py refuses any method other than GET, and that property is what makes this safe to run.
• The three retention view artifacts retained on the bucket: risk_retention_change_requests, risk_retention_stream and risk_retention_policy_gaps.
• One fixed-label Loki event confirmed present, with stream labels exactly tier, pillar=E and event=change, and the change author and message in the line body rather than in a label.
• A populated render of the five Operations retention elements: measured denominator, modal global retention, candidate divergence count, divergent-stack table and trend.

Constraints

• A limited run cannot publish. --limit and --stack compose estate rollups over a subset, so scan.py refuses every S3, Mimir and Loki write unless --dry-run is also set. Run the full estate or accept that nothing is written.
• Confirm the identity-bearing detail landed where it was designed to land and nowhere else. Author and message belong in the Loki line body and the S3 view. Neither may appear in a metric label.
• An empty change-request list is not a finding of no override. It means no self-serve request exists. Record it as that.
• A failed plugin or dataplane read is unreadable, never zero. Check that an unreadable stack is excluded from the policy comparison and still visible in the measured denominator.
• This repository is public. No stack slug, account identifier, log-group name or other deployment-specific detail enters any file, the gitignored codex/ directory included - the customer-identifier gate scans the working tree, not the index.
• Report what was observed. A render that shows no rows because the estate genuinely has no divergence is a valid result and must not be reported as a defect.

Acceptance Criteria

• #1 One read-only full-estate collector execution completes against an authorised development deployment
• #2 All three retention view artifacts are observed retained on the bucket
• #3 One Loki change event is observed with stream labels exactly tier, pillar=E and event=change, and identity detail only in the line body
• #4 The five Operations retention elements are observed rendering against populated data
• #5 No identity-bearing content is found in any metric label, and no deployment-specific detail reaches any file

Definition of Done

• #1 just test
• #2 just tf-validate
• #3 just check-identifiers and just no-em-dashes both return clean

Implementation Notes

Wave 2 attended validation did not run because the operator did not supply the development-deployment identity. No deployment or bucket was inferred, and no collector, S3, Loki, metric-label or dashboard observation was made.

loop4 V-ret observed all three retained retention view objects (AC2 evidence); fresh measured/populated render and natural fixed-label Loki change event remain gaps, latest scan manifest healthy5/5 but full execution/image binding separate. Metric-label audit bounded to six retention families, not an exhaustive identity/pixel audit. No fabricated event or zero.

loop4 root bound archived T2 STOPPED exit0 task588c176e08c549aa920731652a6b1299 to definition17, source6ebedd3 and deployed immutable ECR digestbc024b60; V-ret latest healthy manifest corresponds17:39:34Z within that execution. Current daily schedule04:35UTC witnessed, 26h lookback sufficient. AC2 all three retained objects proven, though stream/gap copies explicitly stale. Natural change event/populated render remain unproved.

loop4 freshfullestateT2 healthy5/5/no failures tiedSTOPPED0/imageCD/source9ba andscan_complete; all3retentionobjectsretained. VdevliveOperations5retentionpanelsPNG rendered (no divergentcandidate genuineemptyaccepted), datasourceexpressionshavepositiveglobaldenominator/modal samples, notfabricatedgapzero. NaturalLokiEchangeeventabsentin30dread soAC3stillopen; AC5boundedfixedlabels/sourceprivacyonly, no exhaustivewholefilesystemnegative. Unreadablepolicy/absentgapgaugescorrect-by-design; stream/gaplastgoodstale16:16 retainedexplicitly. TaskremainsParked.

Owner decision (Rob, 2026-10-01, loop5 preparation): the retention surface is receiving data, so close the task. Evidence of receipt from loop4: a fresh full-estate T2 (healthy 5/5) retained all three retention view objects, and the five Operations retention panels rendered over populated data with a positive measured denominator. AC3 is accepted on the owner’s instruction without a natural fixed-label change event; none occurred in loop4’s 30-day Loki read and none was fabricated. AC5 is accepted on the owner’s instruction on the bounded loop4 check (six retention metric families and source privacy); this is not an exhaustive identity or pixel audit.

Final Summary

Parked without a live collector run. The development deployment was not supplied, so the three retention artifacts, fixed-label Loki change event, identity placement and five populated Operations elements remain unproved.