Description
With live SM admission (SKT-0146) the SM private snapshot covers the boot set plus the persisted live set, and the registration must match that whole set. An uncovered live SM apply or a live SM DELETE therefore strips SM from every blueprint, boot ones included, at the next restart or HA leader failover until sm-provision runs again. Admit a blueprint when the stored registration validates against the stored snapshot and that snapshot’s checks for that blueprint (Source == blueprint, plus their probes) equal its declared specs, so one blueprint’s change cannot strip another’s SM. Changes the guarded fail-closed contract: needs its own security review.
Acceptance Criteria
- #1 A live SM apply or DELETE of one blueprint does not strip SM from other blueprints whose registered checks are unchanged, across restart and failover
- #2 Unregistered or mismatched SM for the changed blueprint still never emits; tests cover file and kubernetes backends
- #3 docs/synthetic-monitoring.md describes per-blueprint admission
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Notes
Landed e8c4a8e (loop50 BATCH12, rc v1.6.0-rc.205). Main CI green on e8c4a8e.