Description
D-PROV25 adopts metadata plus separately scoped outcome observer. Surface2 is not admitted in loop25; approved contract questions require bounded writer identity, IAM/storage/retention and reader audience before implementation. Collector failed inventory must still refuse all publication and preserve last good.
Acceptance Criteria
- #1 Frozen design questions for separate observer writer identity, IAM, finite retention, minimized payload and reader audience, source/clock/storage fidelity and compatibility are recorded and owner-graded.
- #2 Separate bounded outcome projection distinguishes newer failed or unknown inventory observations from dated successful inventory observations and counts, preserving collector refusal and historical last-good views and adding no product series; it does not claim authoritative membership or departure.
Implementation Plan
2026-10-13 direct-main preparation: concrete default-off observer design at /Users/rob/repos/grafana-cloud-org-insights/codex/direct-20261013/observer-design.md, revision2 review corrections. Separate scheduled observer uses existing image, no Grafana secrets, exact four outcome keys, finite retention, typed source task/stream binding, bounded conflict-aware state and conditional writes; current membership remains unknown. Independent design review identified six corrections now recorded. Exact event/projection schema and privacy registry must freeze before dispatch. Owner scope choice still pending; no source/IAM/runtime implementation or live apply performed.
2026-10-13 renewed direct-work instruction: implement complete default-off source/module product under independently reviewed revision4 packet, including safe bootstrap and conflict-revoked success caches. Producer, observer, infrastructure and dashboard ownership isolated in ignored candidate worktree; no live observer activation/customer grant. Root integrates and exercises real CLI plus rendered policy/dashboard boundaries, security review and CodeRabbit before main landing.
Implementation Notes
Frozen design questions: separate outcome writer identity and bounded IAM/storage; targeted retention and dashboard-reader audience; minimized identity/current-membership freshness; source/collector clock versus upload/object receipt identity; caps/versioned optional schema and strict consumer compatibility; failed inventory remains unknown and historical rows survive. Source contract /Users/rob/repos/grafana-cloud-org-insights/codex/scratch/loop24-gci0134-contract.md sections7/8. Not admitted in loop25.
Default-off complete candidate prepared at /Users/rob/repos/grafana-cloud-org-insights/codex/direct-20261013/observer-candidate. Producer/runtime/infra/dashboard integrated. Guarded root review corrected Firehose audience leakage (plan test fail-first then pass) and an admitted-future-prior clock merge producing unreadable state (publicCLI reproduction and existing test extension fail-first then16pass). CodeRabbit initialcomplete0/all28files; integrationdelta complete0/all7files. Final semantic checks unchanged-source pass2783tests/27921subtests/2existing skips and41Tofumocks; full published-history gate explicitly blocked by two incoming customer-bearing task commits, so not landed/Done and no live observer enablement. Parent whole-org/current-membership claims remain unknown.
Owner explicitly approved enabling separate outcome observer in both dev and customer on 2026-10-13. Prior default-off source/IAM/retention design accepted. Both currently forward all task logs to Loki; root chose preserve ordinary forwarding with an exact tested negative discriminator filter before recording task definitions become schedulable, without widening digest audience. Actual AWS TestMetricFilter passes ordinary text/JSON and rejects real recorder outcome plus prefixed outcome. Live source/filter/retention/IAM/outcome proof still pending.
Owner selected retain ordinary forwarding with private-record exclusion explicitly. Final unchanged source gate passed including required current and published-history identifier checks; CodeRabbit complete1minor, obsolete documentation corrected. AWS TestMetricFilter exactnegative literal excludes actual recorder and prefixed JSON while preserving ordinary text/JSON. Collector/observer definitions depend on subscription update. Source release and live observer plan/readback/task/object/dashboard proof continue; no authoritative current-membership claim follows.
2026-10-13 owner withdrew the broader authoritative membership/departure requirement explicitly. AC2 now states the accepted bounded outcome/count contract without that withdrawn claim; original semantics remain in git/task history. Live observer activation/projection verification is still pending and is not marked proved by scope retirement.
Source v0.13.2 at7c323680029325de76289703a66ab1da68e5b4fa is released, twoarches/index/Cosign binding verified; finalsourcegate2784tests/27922subtests/2existing skips/45Tofu, CodeRabbitminor docs fixed. Both consumer source/flag1 pairs committed/pushed infra c03ee7a, allotherconfig preserved, ARM64 startup/all4projections pass. AWS GetCallerIdentity preflight failed before dev ECRpublish: source-local SSOexpiry22:47:56UTC/no refresh, no STSsuccess/publicationreceipt, no observerapply. AllAWSoperations stopped pending owner authentication renewal. Live deployments remain verified13.1/querysuppression with observeroff; desired13.2 flags are not live proof. Authentication failure is retained, not retried; fresh attempt journal needed after authrenewal.
Dev observer infrastructure applied only after independent exact-plan security PASS and fresh lock/review lineage; all6definitions/schedules/3roles/effectiveIAM/filter/retention/CI readbacks match, targeted no-change verified. First natural observer failed all4prior_read_failed because actualAWSCLIerror suffix was not recognized; GCI-0139 (bounded AWS CLI retry annotation parser) repair underway, customer observer held. Natural devT1 at23:15 scheduled definition34 completedexit0,8validtyped events incl inventorysuccess/fiveacknowledgements/finish. Root read actual fiveS3summaryobjects and all exactbyteSHA256 match recordedreceipt digests. This proves native producer/event-to-object binding, not successful observer projection yet. Exact task descriptor/logs captured promptly, no manualduplicate.
Dev13.3 parser correction now conditionally bootstraps/readbacks4schema-valid objects and subsequent CASpoll completes publication; bounded72hour query still hits20pagecap before new native records, so projections correctly partial/notobserved. Separate GCI-0140 (recording-lifetime acquisition boundary) independently reviewed/fail-first tested actualquery reads8native records complete within samecaps, awaiting immutable14release andbothdeploymentproof. Observer not Done; customer not applied.
Final Summary
Separatedefault-offobserver shippedandexplicitlyenabledbothdev/customer. Final15immutabledeployments verifiedall6TDs/schedules/isolated3roles/exacteffective4objectS3+onegroupFilterLogEvents/noSSMsecretsListBucket/standardECR-logexecutionpolicy/conditionalbootstrapCAS/target90global7/ordinaryforwardingprivateoutcomeexclusion/nochange. Native14devandcustomerT1originaltasks exit0/eighttypedrecords/fiveexactversionedS3bytes; fourcompleteprojections preservecounts/Sourceacktimes/digests/olddevnative8support andunknownmembershipauthority. Actual15scheduledobserversboth exit0/fourstrictcompleteversionedobjects/originalrolebirthwindow. Operations savedcontractsANDrealbackendfourqueryexecutionsboth200/7rows12minimizedfields/accurateages/passprivacy. Separate141Infinitynullable/UTCpresentationfixacceptedanddeployed15. FunctionalCLInegative/conflict/deadline/cap/refusal tests retained; no privacy/floor/reader grant expansion or productseries. Broadermembershiprequirementwasexplicitlywithdrawnseparately,neverclaimedproved.