Description
Pre-authorised by D-LBL7 once the released pillar has passed task K. Work happens in the consumer deployment repository per doc-0003; no customer identifier enters this repository.
Acceptance Criteria
- #1 label_inventory is enabled on the customer deployment pinned to the release digest and its first run is verified
- #2 Routes without a passing witness are listed as not covered
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Notes
loop16: GCI-0119.17 (enable labelling on the customer after accepted dev proof) dependency-parked, attempts0. Dev GCI-0119.15 (prove labelling live on dev) refused publication at17/20 signalcoverage85%; D-LBL7-16 condition false. Releasedv0.8.2 source applied withlabel-inventory OFF; AC1 remainsOPEN, no manual customerT2/T3/T1 or first-run claim. Routes NOT COVERED: Loki /loki/api/v1/config/limits/applied (reader401, requiresWRITE); Tempo /tempo/api/overrides?scope=merged and /tempo/status/overrides/{tenant} (404, no absence inference); unimplemented Loki OTLP/YAML subtree configuration. Existing approved bounded Mimir cardinality, Loki series/index/legacylimits, Tempo name-values and exact Pyroscope label RPC witnesses do not promise exhaustive coverage. No source07 ceiling reset, new query scope or credential. Resume only after accepted dev runtime/privacy/render proof and separately permitted source repair if needed.
loop17: attempts0. R-cust4 neverstarted: accepteddevAC1 prerequisite false becauseAWSauth expired and3prescribedprobesfailed255. Customer trackedmodule/manifest/image and live configuration untouched; lastobservedR-rel4consumer3d1,labelOFF,libraryOFF,schedulespreserved. EXACTONEmanualcustomerT2 allowance entirely unused; no customer/provisioner run or credential/policy/bucketwrite. AC1OPEN; existingAC2uncoveredroutes listunchanged. Resume onlyafter acceptedR-dev6runtime/privacy andfreshidentity/schedule/reader/privacy witnesses, then savedplan/exactapply/source-boundR-rel5consumer andoneoriginalARNmanualT2 safewindow; retainD-CUST17rollbackfence. Collectionmetadata isnotrendering.
loop18: attempts0. Customer rollout neverstarted because devAC1 remainsunaccepted after primarysource refusal from a newlydiscovered missing devreader. Existingcustomerconsumer3d1/labelOFF remaineduntouched; freshcustomerbaseline315observedreaders+1paused, rootcustomerwrites0. EXACTONEmanualcustomerT2 allowance entirelyunused; no customerT1/T3/provisioner, bucket/role/token/rule/dashboard writes. Resume onlyafter GCI-0119.15 (prove labelling live on dev) AC1 accepted, then currentfrozen/newownergrants and freshstate/safe-window/privacy/readers; no rollback.
loop19 R-cust5 under D-CUST19 (fix-forward from v0.9.0 to v0.9.1 source 45621a9): saved targeted plan, exact apply, post-apply readback with all five task definitions on sha256:83cd6aef… and every schedule state preserved, label-inventory enabled. First run verified by the one manual customer T2: exit 0, label_inventory 1240/1260 stack-signals available (0.984, above the D-LBL12 0.80 floor; the 20 unavailable are missing_input on traces and metrics), labelling_* and maturity views published at 17:57-17:58 UTC. Primary coverage 1.0. Privacy after-witness PASS; no-change plan PASS. Library-panels stays off; no other manual run.