Description
Read-only live witness of GET {prom}/api/prom/api/v1/cardinality/label_names with limit=500 and a selector, and cardinality/label_values with label_names[], across the staff stacks (D-LBL10: query any or all five and combine evidence). Record response shape, head-only window, count_method behaviour and limit behaviour. A missing read scope is handled under D-LBL11 or the route parks.
Acceptance Criteria
- #1 Witness recorded in docs/traps.md naming the stack slug or slugs
- #2 Route added to the AGENTS.md labelling section, GET only
- #3 Any read scope added under D-LBL11 is recorded with its object ID and reflected in CAPABILITIES.md, or the route is Parked with the reason
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Witness bounded cardinality label-name/value GET routes on fresh-discovered staff inventory with counts/shapes only; root handles exact-status or project-reader scope follow-up and later witness-document writes.
Implementation Notes
loop14:read-only witness,0 implementation attempts. Exact status/scope complements and guarded witness docs accepted at072121c with composed gate and exact CI green. Admin-only write-scoped self-serve limits and unavailable Tempo overrides remain excluded; bounded/empty results are not completeness claims. No policy scope or credential change.