Make optional Grafana product lanes deployable and verifiable

Description

Give optional RUM, Fleet Management, Synthetic Monitoring, self-observability, profiling, Sigil, private Git, and synthetic-profile lanes an explicit supported/disabled/partial state. Remove Docker-host dependence on an unshipped Go-only SM provisioner.

Acceptance Criteria

• #1 Preflight reports every requested optional lane as enabled, partial with missing non-secret field names, intentionally disabled, or unsupported
• #2 Status exposes the same lane disposition without revealing credentials
• #3 Synthetic Monitoring can be provisioned with a version-matched published image/job from a Docker-only host, or the Go/source prerequisite is an explicit hard stop before deployment
• #4 Fleet Management metrics-only mode and API-registration mode are distinct and verified separately
• #5 RUM, self-observability, profiling, Sigil, private Git, and synthetic profiles each have exact activation and verification gates

Definition of Done

• #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
• #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
• #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/

Implementation Plan

Accepted v4 is authoritative. Root owns config/preflight/runner/status/control/UI/Compose/Docker/workflows/cmd/sm-provision/docs/skills/tracker/live systems. One leaf owns only a new internal/optionallane package and tests; it receives presence/count/enum inputs only and cannot expose values or identifiers.

1. RED/GREEN the complete fixed disposition table for RUM, Fleet metrics, Fleet registration, SM provisioning, self-observability, process profiling, Sigil, private Git and synthetic profiles. States are exactly enabled, partial, disabled and unsupported; return sorted closed missing-field enums and closed reason/verification codes.

2. Root derives presence-only configuration and post-resolution declaration/emitter facts, reports configuration dispositions in preflight, and exposes the same authenticated status projection without detailed public-readiness leakage. Wire Sigil delivery observation and keep Fleet metrics separate from registration.

3. Package /app/sm-provision in the same version-matched image and add an opt-in Compose profile. Implement the private snapshot/registration/journal lifecycle, explicit apply/adoption gates, fail-closed ownership/collision/crash recovery, and root-injected SM identities/config versions without construct coupling.

4. Update env guidance, operational skills and docs with exact activation/verification gates and the restart-based SM handoff.

5. Run focused evaluator/config/preflight/control/runner/Fleet/Sigil/SM/UI tests, fake-API collision/no-op/adoption/ambiguous-create/crash tests, Compose fake-input rendering and Docker-only provisioner proof. Then CodeRabbit, make gate, complete-catalog dry-run and truthful standing host disposition proof before finalization.

6. Add explicit target migration for credential or endpoint rotation: preview under the new target revalidates every recorded remote ID/key and managed spec, writes a short-lived private marker bound to old/new fingerprints, snapshot/source, resource evidence, and exact plan hash; apply requires the same marker, atomically retargets the ownership ledger, then executes the frozen plan. Expose only the non-secret SM_PROVISION_MIGRATE_TARGET flag through Compose/docs/skills and prove fail-closed, stale, missing/foreign, and successful preview/apply cases.

Implementation Notes

Research baseline: mandatory preflight does not cover optional products; authenticated status has no unified optional-lane projection; Sigil lacks pushstatus observation; Fleet metrics and API registration are distinct in code but not one explicit operator contract; Docker ships only /app/synthkit, so cmd/sm-provision is unavailable on source-free hosts. Security review accepted the v4 lifecycle and ownership contract before implementation.

Adversarial closeout review rejected credential rotation because the token-bound target fingerprint made existing ownership state unreadable. Implementing the explicit preview-bound migration path before final .13 gates.

Full gate exposed stale generated field docs and a race in the ambiguous-create fake API test; regenerated fielddocs and added a synchronization boundary. Fresh CodeRabbit found incomplete successful mutation responses were not explicitly classified ambiguous, plus four documentation/skill clarity gaps; fixed all five. Adversarial migration review then required comparison against the ledger’s authoritative remote revision/spec hash and a non-bypassable resumable post-retarget marker; implemented both with focused and race tests.

Final evidence: the integrated implementation passed focused Go/UI/fake-API tests, migration and crash-boundary tests, Compose rendering, Docker-only version-matched provisioner proof, CodeRabbit and adversarial security review, local make gate, and complete-catalog dry-run inventory comparison. Exact-SHA CI completed with aggregate success and the same revision was published as a signed, attested, scanned multi-arch image. A digest-pinned standing-host deployment then proved healthy readiness, writable persisted state, success with zero failures for all four configured sink lanes, exactly nine truthful optional-lane dispositions, and no configured-secret forms in authenticated status/readiness JSON. The deployment .env and state-tree hashes remained unchanged; unrelated external environment drift was preserved. Live Synthetic Monitoring mutation was intentionally not attempted because that lane is not configured there; the accepted fake-API/Docker proof is the bounded AC3 evidence.

Final Summary

Implemented and verified explicit dispositions for all nine optional lanes, separate Fleet metrics/registration gates, version-matched Docker Synthetic Monitoring provisioning with private ownership/migration state, authenticated status/UI projection, and secret-safe operational errors. Verified with focused and adversarial tests, CodeRabbit, make gate, complete-catalog dry-run, exact-SHA hosted CI/publication, and a digest-pinned standing-host deployment.