Description
Read-only live witness of Tempo intrinsic name tag values (/tempo/api/v2/search/tag/name/values; truncation at the 1 MB max_bytes_per_tag_values_query cap) and whether Tempo overrides (span-metrics dimensions, intrinsic dimensions, dedicated columns, span_name_sanitization) are readable with a read token, across the staff stacks (D-LBL10). Park the overrides half on 401/403/404 unless D-LBL11 read scope resolves it.
Acceptance Criteria
- #1 Witness recorded in docs/traps.md naming the stack slug or slugs, including truncation behaviour
- #2 Route added to the AGENTS.md labelling section, GET only
- #3 Any read scope added under D-LBL11 is recorded with its object ID and reflected in CAPABILITIES.md, or the overrides route is Parked with the reason
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Resolve exact documented Tempo overrides GET path first, then ordered granted GET name-values/overrides probes with count/shape-only reduction; root status/scope complement, park unreadable overrides without blocking name-value extension.
Implementation Notes
loop14:read-only witness,0 implementation attempts. Exact status/scope complements and guarded witness docs accepted at072121c with composed gate and exact CI green. Admin-only write-scoped self-serve limits and unavailable Tempo overrides remain excluded; bounded/empty results are not completeness claims. No policy scope or credential change.