Description
loop18 signed v0.8.4 dev rollout is retained under fix-forward. Its single exact measured T2 stopped exit1 because a newly discovered sixth active dev stack lacks a reader credential; existing five basic-None readers, action/scope pairs, token IDs and SSM versions stayed unchanged. Non-label sources available5/6 fail the unchanged primary publication floor; label inventory20/24 passes its independent0.80 floor. No T2 publication occurred. Current goal declares credential creation none and root will not turn that missing prerequisite into an implicit mint, working-token replacement, floor reduction or estate opt-out. No source implementation defect is established.
Acceptance Criteria
- #1 Fresh live inventory and missing-reader witnesses are recorded, and explicit owner authority for any required new managed reader credential is present, or an already-authorized natural reconciliation has supplied it.
- #2 Only missing reader state is reconciled under that authority; existing working reader identities, tokens, SSM versions and approved action/scope pairs are preserved, with no wildcard query, scope widening, rotation or policy opt-out to hide coverage.
- #3 The retained signed-source dev consumer passes a new exact-ARN full T2 with immutable publication and the remaining runtime, measured-memory, raw-value-absence and live-render evidence before customer rollout or maturity replacement is unblocked.
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Notes
loop18: attempts0, review-repair rounds0. Raised under D-CUST18 after exact failed devT2; parked authority because current goal permits no credential creation. Resume on explicit missing-reader-only authority or fresh evidence normal scheduled reconciliation supplied the missing reader. Do not re-mint working five, change floor/optouts, reset source implementation allowance, roll back or treat labelling availability as primary-source health.
loop19 (main-thread run, D-PROV19): fresh witness 2026-10-08 showed dev stack elevatedeveu active with no reader, five others observed. One manual dev provisioner run, task ARN ending 179ed75609734f21aea19141f1727a05 on provisioner:27, exit 0, descriptor captured; log create_sa for elevatedeveu only, summary provisionable/ok=6, gcom 5 writes. After-witness: new basic-None reader, 56 pairs, none outside the pairs held by other non-write readers, query pinned to usage-insights; elevatedeveu has no Synthetic datasource (complete list, not applicable). Five existing readers identical: sa_id, role_uid, token ids, role and effective pairs, role version, SSM versions. Evidence /Users/rob/repos/grafana-cloud-org-insights/codex/loop19-evidence/GCI-0119.15.01/ and /Users/rob/repos/grafana-cloud-org-insights/codex/loop19-evidence/R-pre/. AC #3 closes with R-dev7.
AC #3 via R-dev8 on v0.9.1 (45621a9, cosign verified): exact-ARN measured dev T2 ending b9191dd383524a6dbc66a39fb13b3964 exit 0, immutable publication, primary 6/6. Evidence /Users/rob/repos/grafana-cloud-org-insights/codex/loop19-evidence/R-dev8/.