Description
The CLI can validate configuration and run an authenticated collection preflight, but it cannot prove that a Prometheus operator will get a usable scrape without starting the long-running service.
Acceptance Criteria
- #1 A bounded CLI check runs one collection cycle and verifies that the Prometheus registry contains a documented sentinel and valid exposition
- #2 Human and JSON output distinguish configuration, authentication, collection, gather, and access-posture failures
- #3 The check does not start a long-lived listener, persist checkpoints, mutate the control plane, or deliver OTLP unless explicitly requested
- #4 Command tests cover successful and failing results
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Add -prometheus-check on the frozen RunPrometheusOnce seam; classify configuration, authentication, collection, gather and access-posture failures in human and JSON output; prove bounded side-effect-free behavior.
Implementation Notes
Implemented and locally validated in bundled pause snapshot 2cf46446d5c6a7a30ea6f7d0c54d61ec9889d522, including zero-annotation and zero-OTLP side-effect tests. Resume with final security review, exact-head CI, and a live bounded check.
Final evidence: SECURITY CLEAN; integrated GATE passed; exact-head CI run 33047209645 succeeded. The deployed registry exposed the documented build-info sentinel as valid Prometheus exposition, and the Fleet scrape produced an up series in the backend.
Final Summary
The bounded classified Prometheus first-scrape check is committed in 2cf46446d5c6a7a30ea6f7d0c54d61ec9889d522; parked pending final security, CI, and live proof.
Completion: verified by side-effect tests, security review, exact-head CI, and live sentinel exposition.