Description
375 of the 418 extra_metric coverage gaps are CloudWatch families that the live EKS readback publishes and synthkit does not emit at all. This is by far the largest genuine coverage gap in the catalogue, and CloudWatch is the area where a missing family is least forgivable, because a user building an AWS dashboard against synthkit finds the panel empty rather than wrong.
SKT-0010.06 already covers emitting the CloudWatch families a coverage audit verdicted should-emit. This task is the reconciliation between that verdict list and the 375 the comparator now reports: some of the 375 will be families that audit already accepted, some will be families synthkit deliberately does not model, and some will be new. Each needs a verdict, and a family declared out of scope needs its reason recorded where the next reader finds it.
Do not emit a family to close a finding. Every name, label and value comes from signals/cw.md or current vendor documentation, and an unconfirmed one becomes a cantfind.md PENDING rather than a guess. The five-stat expansion means one accepted family is five findings, so the count will move faster than the work does — attribute the movement rather than celebrating it.
Acceptance Criteria
- #1 Every one of the 375 carries a verdict: emit, deliberately out of scope with a reason, or unconfirmed and recorded as a cantfind PENDING
- #2 The verdict list is reconciled against SKT-0010.06 rather than produced independently
- #3 No family is emitted whose names and labels are not sourced from signals/cw.md or current vendor docs
- #4 Count movement is attributed to accepted families, accounting for five-stat expansion
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
Reconcile the measured 375 CloudWatch gaps against SKT-0010.06, assign one sourced verdict per source family, return unconfirmed rows for serialized cantfind append, and emit only any well-sourced subset that fits the lane without treating emission count as acceptance.
Implementation Notes
2026-09-01 unattended-run correction: removed the dependency on SKT-0010.06. The dependency direction was backward: this task produces the reconciled per-family verdict record that SKT-0010.06 later uses to emit the accepted subset. Narrow reversible choice taken under the overnight contract; question and choice will be reported.
2026-09-02 verdict evidence: all 375 findings are 75 CloudWatch source families times five statistics. The durable table records 56 emit candidates, 4 deliberate instance-store exclusions, and 15 PENDING families; it reconciles the emit set to SKT-0010.06. No family was emitted by this task. SK-104 records the one new unconfirmed root; existing PENDING records cover the other 14. Integrated just check and just dump passed; generation was not applicable.
Final Summary
2026-09-02: Verdicted all 375 CloudWatch findings without guessing or emitting: 56 source families are emit candidates, 4 are out of scope, and 15 remain sourced PENDINGs, with five-stat expansion explicitly attributed.