Description
The v0.6.0 dev T2 rollout read five live stacks but cloud_accounts was available on only 2/5 (three invalid_response) and pdc_networks on 0/5 (five invalid_response). The source-owner publication floor refused all S3, Mimir and Loki writes; task exited 1. Dev rolled back to its saved v0.4.4 deployment and old reader selection; only the 61 recorded permission additions were removed, no reader token or SSM version changed. The customer deployment was not upgraded. Root cause is not established; do not infer absence/zero, loosen completeness, change Response.ok globally or widen permissions. This follow-up is outside the closed loop scope.
Acceptance Criteria
- #1 Reproduce each schema failure through its real guarded GET source with a red check derived from minimized non-secret live response shape; preserve fail-closed publication and last-good semantics.
- #2 Fix only witnessed contracts within approved route/pair scope, retaining fresh inventory-led joins and strict completeness; pass repository gate and independent review.
- #3 A separately authorized dev rerun proves both readers before any customer rollout; use saved manifests, immutable image identity and unchanged working reader credentials.
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Loop13: red-first exact-200 exact data:null repair in isolated candidate, CodeRabbit and independent review before land, composed gate and exact-SHA CI; dev reader proof remains AC3.
Implementation Notes
Loop12: 1 implementation attempt,0 review-repair rounds. Bounded PDC metadata repair landed bbb9668dd89b5733d6817b6cfb1fdaaf1d05cb57 with real guarded GET four-shape red-first proofs, complete CodeRabbit zero findings, independent review PASS, clean integrated/composed gates and CI37329484807 success. AWS exact200 data:null on3/5 remains unavailable, never zero. Official CSP3.39.0 UI consumer normalizes null but discards query errors; independent high review rejects that as complete-empty API proof. Needs endpoint-specific authoritative backend contract distinguishing complete empty from unreadable, visibility-filtered or partial. AC2 full repair and AC3 live dev proof not satisfied. Stable0.7.0 release/dev/customer parked on this dependency; no deployment writes. Evidence /Users/rob/repos/grafana-cloud-org-insights/codex/loop12-evidence/R-shape/ and /Users/rob/repos/grafana-cloud-org-insights/codex/loop12-evidence/R-null-frontend/.
Owner decision D-AWS13 (Rob, 2026-10-06): exact HTTP 200 with body exactly {“data”: null} from the AWS cloud-accounts route means zero accounts (complete empty), witnessed by owner ground truth that m7kni, portinapushtests and rkaidev have no AWS accounts configured, with robk and portina returning arrays under the same reader scope as positive controls. Any other null placement, extra key, non-200 or error body stays unavailable. Release, dev and customer may proceed on this repair.
Loop13: total 2 implementation attempts including loop12 PDC cycle, 0 repair rounds in loop13. AWS exact-200 exact data:null repair accepted and landed9a76608afdf7aba22e7891b238e7ffe3af6cf1c0; integrated composed gate and CI37453753883 success at4b4a6b8060e08de78c5049dc2a0c2033079bc4f4; independently verified real GET/publication boundary, CodeRabbit clean. Shipped v0.7.0. AC3 remains parked: original infra checkout preflight refused retained untracked backups. Resume after approved clean preflight and separately completed dev live proof; no deployment writes.
loop14 live proof only; total2 historical implementation attempts unchanged, no new code cycle. Signed v0.7.1 dev source7eed31f, immutable consumer03cd35e5, one provisioner plus T3/T2/T1 exact-ARN runs exited0/published. Fresh T2 AWS/PDC availability5/5, account counts0/1/0/0/1 under owner complete-empty witness and network counts1/0/0/1/1. Reader IDs/tokens/SSM versions unchanged, only exact approved pairs added. Evidence /Users/rob/repos/grafana-cloud-org-insights/codex/loop14-evidence/R-dev/; customer rollout remains held on complete dev acceptance.