Description
D-NAT25 requires dev Container Insights remain enabled until the bounded capture exits by 2026-10-15T08:00Z, then disable and read back on dev only. Auth first-failure stops without login; never touch customer cluster.
Acceptance Criteria
- #1 After final authentic capture, fresh AWS identity succeeds, dev-only Container Insights is disabled and effective settings read back; failure leaves precise owner pending item.
Implementation Notes
loop25 actual dev Container Insights enabled and verified. Capture job exited3 on first identity-command timeout and is not running; CI remainsenabled under D-NAT25/D-AUTH18 hold. This is now an open owner obligation, not merely proposed work. No customer CI setting touched. Root did not retry identity/relaunch/login or disable early against the fixed capture instruction. Resume: owner-graded fresh AWS identity and explicit dev-only disable/readback at approved boundary.
2026-10-14 owner withdrew48h/three-day capture and accepted one fresh manual dev proof; actual measured execution-window sample was captured before disablement. Sourcev136 unchanged, devCI-onlymanifest flag and metadata image rebuilt/published exactbabc9da53c172150f50f3d1a3adc3819dedfb0bf8425a70e6e57dfc8012a71bb. Root exact17-change admission passes only enabled-to-disabled cluster flag plus six image/schedule revisions and frozen deferredIAM; planSHAe8504fd080d639328264880f505d8ca81a6a4943809311607e346f58685e993c. First apply refused before mutation because relative savedplanpath did not exist; same exact plan applied0 using absolutepath after freshactive/source/hash checks. Full physicalreadback all6defs/schedules/threeobserverroles/completeeffectiveIAM/filter/targetedretention/originalrolebirth passed; exactdev andcustomer clusters bothdisabled, customersettingunchanged. No source/runtime policy/schedule-cadence/IAMauthority expansion. Original three-day/full-lifecyclememoryverifier remainsunproved, not relabelledgreen. Final targetedno-change pending; evidence /Users/rob/repos/grafana-cloud-org-insights/codex/direct-20261014/tempo142/dev-ci-off/rollout-final/.
Final dev targetedno-change plan now verified: exit0 and allresource/outputactionsNOOP. Physicalshutdown and drift proof complete; source/image/observerprivacy/IAM boundaries retained.