Description
The emission work SKT-0010.04 justified. 57 families across five CloudWatch groups carry a should_emit verdict in reality-corpus/verdicts/coverage-verdicts.json — each is a family a real collector ships for something synthkit already claims to model, so its absence is a hole in a claim the project makes.
Ranked by how much each matters, which is not the same as how many families it has:
1. NAT Gateway — 9 families, highest value despite being small. synthkit emits ONE of the four directional byte counters (bytes_out_to_destination) and NONE of the four packet counters. Any ingress/egress split or drop-ratio panel over the modelled estate is arithmetically incomplete today — the numbers are not merely sparse, they are wrong. Missing: bytes_in_from_source, bytes_in_from_destination, bytes_out_to_source, the four packets_* roots, peak_bytes_per_second, peak_packets_per_second. One dimension, five stat suffixes each.
2. EC2 — 11 families. network_packets_in/_out are the packet counterparts of byte counters already emitted; cpucredit_usage, cpusurplus_credit_balance, cpusurplus_credits_charged complete the cpucredit_balance root already emitted. Also ebsbyte_balance_percent, ebsiobalance_percent, instance_ebsiopsexceeded_check, instance_ebsthroughput_exceeded_check, metadata_no_token, metadata_no_token_rejected. Note the capture recorded instance_ebs*_check and metadata_no_token_rejected with dimension_InstanceId ONLY — no ASG-level rollup was observed, so do not add one.
3. ALB — 10 families. request_count_per_target, httpcode_elb_3_xx_count, httpcode_elb_4_xx_count are the target-level and ELB-side response views, plus client_tlsnegotiation_error_count, desync_mitigation_mode_non_compliant_request_count, http_redirect_count, http_fixed_response_count, rule_evaluations, consumed_lcus, peak_lcus.
4. Firehose — 20 families, worth splitting. The four delivery_to_http_endpoint_* roots extend the delivery path synthkit already models and are the high-value half; the source side and the three *_limit roots are the bulk. signals/cw.md already records that only two are emitted and the namespace has more, so this widens a documented narrowing rather than fixing a surprise.
5. EBS — 6 families. volume_avg_iops, volume_avg_throughput, volume_idle_time, volume_iopsexceeded_check, volume_stalled_iocheck, volume_throughput_exceeded_check.
Every name here is live-captured and authoritative. The five-stat expansion and the _sum-is-a-per-period-gauge rule go through internal/cw as always; no construct re-derives them. A should_emit verdict is self-retiring — once the family is emitted the comparator stops reporting it.
Acceptance Criteria
- #1 Every family carrying a should_emit verdict is emitted, or its verdict is corrected with evidence
- #2 Names and dimensions match the captured corpus exactly, including where a family was observed with fewer dimensions than its siblings
- #3 Five-stat expansion and the per-period-gauge rule are delegated to internal/cw, not re-derived per construct
- #4 signals/cw.md grows to document every added family with provenance and date
- #5 make signal-fidelity reports no remaining should-emit coverage gap for these groups
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
2026-09-02 fallback plan: 1. Add failing inventory and exact-dimension regressions for the 56 CloudWatch should_emit roots, grouped by cwinfra and ec2. 2. Implement plausible flow-derived values in the owning constructs while delegating all five-stat expansion to internal/cw and preserving instance-only exceptions. 3. Update signals/cw.md with the live-capture provenance/date and added family contracts. 4. Run focused tests, just check, just dump, and the safe non-agent just e2e; finalize the tracker only from observed evidence. 5. Commit and push the completed fallback item, require exact-head hosted ci-success, then rewrite the overnight report as the terminal filesystem action.
Implementation Notes
Completed 2026-09-02 fallback item. Tests first failed on the missing families and captured dimension exceptions, then passed. Final evidence: just check exited 0; the safe 27-blueprint just signal-fidelity run excluded grafana-ai-o11y and exited 0 with only the two pre-existing exempted contradictions; the safe dump verifier reported CLOUDWATCH_SHOULD_EMIT_ROOTS_PRESENT=56, CLOUDWATCH_SHOULD_EMIT_ROOTS_MISSING=0, and KUBELET_STORAGE_ROOT_PRESENT=1. The 56 CloudWatch roots cover ALB 10, EBS 6, NAT Gateway 9, Firehose 20, and EC2 11; the 57th historical verdict is the already-emitted storage_operation_duration_seconds root. Five-stat expansion remains exclusively in internal/cw. No blueprint field or config struct changed, so just gen was not required. Local e2e evidence is explicitly invalid because an unqualified run selected the prohibited agent fixture; the deployment was contained and hosted CI must supply the final Docker proof. The declarative justfile guard was validated with just –fmt –check and a fidelity run selecting exactly 27 non-agent blueprints; no dedicated unit test was added.
Final Summary
Emitted all 56 missing CloudWatch should-emit roots with captured dimensions and documented provenance, preserving internal/cw five-stat semantics. Focused regressions, just check, safe dump inventory, and safe signal fidelity passed; the historical k8s storage root was already present. Added explicit opt-in containment for agent e2e and unattended fidelity selection after the local safety incident; this does not claim SKT-0043 fixed.