Description
Read-only live witness of GET /loki/api/v1/series over a bounded window, /loki/api/v1/index/stats and /loki/api/v1/index/volume across the staff stacks (D-LBL10). Record org-CAP reachability, response shapes and size bounds, and confirm no log lines are returned. Relates to GCI-0101 (top log producers per stack), whose stream-dimension decision stays separate.
Acceptance Criteria
- #1 Witness recorded in docs/traps.md naming the stack slug or slugs and confirming no log content is returned
- #2 Route added to the AGENTS.md labelling section, GET only
- #3 Any read scope added under D-LBL11 is recorded with its object ID and reflected in CAPABILITIES.md, or the route is Parked with the reason
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Ordered allowed GET commands for bounded Loki series/stats/volume, privacy reducer, then root exact-status and project-reader scope complement; later witness-document lane handles tracked docs.
Implementation Notes
loop14:read-only witness,0 implementation attempts. Exact status/scope complements and guarded witness docs accepted at072121c with composed gate and exact CI green. Admin-only write-scoped self-serve limits and unavailable Tempo overrides remain excluded; bounded/empty results are not completeness claims. No policy scope or credential change.