Gitea's package API wants a token, so the tag timestamps come from the registry
itself: manifest, then config blob, then the created field, anonymously, about
ninety requests a round. The constraint of no new credentials survives.
The derivation is cached rather than run per scrape; at a fifteen second scrape
interval it would otherwise make some twenty-one thousand registry requests a
day.
Two assertions carry the design. A source that fails must leave its own share
empty while the others keep delivering, and when every source fails the target
file is not overwritten at all. Deleting reports follows the same rule: no
target file, no deletion, or a restart during a Prometheus outage would clear
the whole estate.
The shakiest call is written down as such: cAdvisor only sees containers that
run, so a service that happens to be down is missing from the desired set and
coverage still reads a hundred percent. That is the hole ADR-0026 warns about,
and Gate 4 has to check it against docker compose config before criterion 2
counts as met.
Thore Cimbal
a0cd02afd9