Description
Generalize the policy-snapshot pattern (TSO-0044): a shared snapshot-emitter helper that any collector can opt into, emitting a JSON snapshot log record on change (plus periodic heartbeat) for DNS configuration, tailnet settings, webhook configs and posture integrations. Each Grafana tab then shows current config + change history alongside its metrics. Per-source opt-in config keys; consistent attribute marking so dashboards query snapshots uniformly.
Acceptance Criteria
- #1 One shared emitter with per-collector opt-in produces on-change JSON snapshot records for at least DNS config and tailnet settings
- #2 Snapshot records share a uniform attribute shape usable by one dashboard query pattern
- #3 Webhooks and posture integrations covered or explicitly parked with a note
Definition of Done
- #1 just check passes (the full gate; it is what CI enforces)
- #2 just gen leaves no diff (only if a generated artifact’s inputs changed)
- #3 just –fmt –check passes and every new recipe has a # doc comment and a [group(…)]
Implementation Plan
Wave 2 root freeze plan: add behavior-preserving per-source snapshot opt-ins for DNS, settings, webhooks, and posture integrations, all default off, plus the shared snapshot emitter.
Implementation Notes
Latitude deviation: the goal described six hand-maintained config files, but the live TestDocsConfigurationMentionsEveryKey gate proved docs/configuration.md is a seventh required config surface. Added the affected reference entries rather than weakening or bypassing the guard.
Latitude deviation: the run contract called for one commit per feature, but root retained the already-integrated shared-tree feature commit fa6a465 plus review-fix commit a18a5dd rather than performing prohibited destructive history surgery after integration and push. All task evidence is tied to the verified implementation head a18a5dd06f9ac9c8b84fda73bba653ded2398d5a.
Final Summary
Implemented uniform opt-in DNS, settings, webhook, and posture-integration snapshots through the shared emitter, with secrets excluded and common query attributes. Verified by per-family telemetry tests, generated catalog guards, final just check, and exact-head CI run 33322449434 at a18a5dd06f9ac9c8b84fda73bba653ded2398d5a (success).