Description
Land doc-0008 Part 1 decisions D-LBL1..11 and hard-rule amendments (a) to (d) before any labelling code. (a) Pyroscope POST exception extended to collector/sources/label_inventory.py only through label_risk.profile_read; httpclient stays GET-only. (b) Identity-bearing bullet appended with D-LBL1 retention text. (c) doc-0002:45 ‘calls label endpoints only’ replaced with the enumerated Loki label, /series, index/stats, index/volume and limits/config routes, never query, query_range, tail or any route returning log lines. (d) New AGENTS.md section ‘Labelling inventory (D-LBL1..11)’ listing each route by exact path with its witness-first rule, the D-LBL7 customer-deployment grant and the D-LBL11 read-scope rule. Not amended: MAX_PER_STACK_FANOUT, one-extra-label rule, gap-is-absent, limited-run guard, own-input hydration, derived VIEW_INPUTS.
Acceptance Criteria
- #1 Amendments (a) to (d) are landed verbatim in AGENTS.md and doc-0002
- #2 D-LBL1..11 are recorded in doc-0002 standing decisions, with D-LBL7 and D-LBL11 written as conditional grants and no customer name
- #3 GCI-0101 carries an appended note that D-LBL6 covers its route for labelling purposes while its top-producers dimension stays open
- #4 just check passes including check-identifiers
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Implement AGENTS hard-rule amendments; root owns decision-document and task-note updates; independent guarded review before land, after release readback.
Implementation Notes
loop14: one worker implementation plus root bounded path/authority correction; guarded review passed. Exact integrated SHA 9fb033bdfff72765188b5427469e786005292438 just check exit0; all required exact-SHA CI leaves successful. Tempo overrides exact path remains witness-first, recorded by the later witness-document task; no wildcard grant. CodeRabbit skipped for documentation.