Task · TSO-0047

Device inventory change-log to Loki

Description

Emit a per-device change record (name, os, client version, tags, routes, key-expiry deltas; device added/removed) whenever the devices poll observes a difference, answering “when did this device change” without audit-log archaeology. The enrich/devices path already sees successive polls; needs a bounded prior-state snapshot (disk-persisted like checkpoints, or accept per-restart re-baseline without emitting a storm on startup). Cardinality-safe by construction (logs, not series). Respect pii_filter for names/users.

Acceptance Criteria

Definition of Done

Implementation Plan

Wave 2 root freeze plan: add the devices change-log opt-in default off; lane implementation must consume it or the key will be reverted at run end.

Implementation Notes

Latitude deviation: the goal described six hand-maintained config files, but the live TestDocsConfigurationMentionsEveryKey gate proved docs/configuration.md is a seventh required config surface. Added the affected reference entries rather than weakening or bypassing the guard.

Latitude deviation: the run contract called for one commit per feature, but root retained the already-integrated shared-tree feature commit fa6a465 plus review-fix commit a18a5dd rather than performing prohibited destructive history surgery after integration and push. All task evidence is tied to the verified implementation head a18a5dd06f9ac9c8b84fda73bba653ded2398d5a.

Final Summary

Added field-level device inventory change logs with synthesized fixtures and restart-stable state that avoids startup storms, plus generated dashboard coverage. Verified by transition and restart telemetry tests, final just check, and exact-head CI run 33322449434 at a18a5dd06f9ac9c8b84fda73bba653ded2398d5a (success).

View the source file on GitHub