testdata(prometheus): add runtime semantic evidence

.gitattributes

@@ -1,6 +1,6 @@
 .gitattributes text eol=lf
 /prometheus/README.md text eol=lf
 /prometheus/ATTRIBUTION.md text eol=lf
-/prometheus/profiles/**/manifest.yaml text eol=lf
-/prometheus/profiles/**/SOURCE-INVENTORY.tsv text eol=lf linguist-generated=true
+/prometheus/profiles/** text eol=lf
+/prometheus/profiles/**/SOURCE-REGISTRY.yaml linguist-generated=true
 /prometheus/profiles/**/fixtures/*.prom text eol=lf linguist-generated=true

.github/workflows/prometheus-source-registries.yml

@@ -0,0 +1,32 @@
+name: Prometheus source registries
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/prometheus-source-registries.yml'
+      - 'prometheus/profiles/**/SOURCE-REGISTRY.generator.yaml'
+      - 'prometheus/profiles/**/SOURCE-REGISTRY.yaml'
+      - 'prometheus/profiles/**/generator/**'
+      - 'prometheus/tools/**'
+  push:
+    branches: [master]
+    paths:
+      - '.github/workflows/prometheus-source-registries.yml'
+      - 'prometheus/profiles/**/SOURCE-REGISTRY.generator.yaml'
+      - 'prometheus/profiles/**/SOURCE-REGISTRY.yaml'
+      - 'prometheus/profiles/**/generator/**'
+      - 'prometheus/tools/**'
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test shared generator runtime
+        run: python3 -m unittest discover -s prometheus/tools -p 'test_*.py'
+      - name: Reproduce generated registries
+        run: python3 prometheus/tools/source_registry_runner.py

prometheus/ATTRIBUTION.md

@@ -32,6 +32,21 @@ remain in the corresponding `netdata/netdata` profile proof.
   - <https://github.com/BerriAI/litellm/blob/23de7a15d9d40006ee596e617475ba101d60c5e9/LICENSE>
   - <https://github.com/prometheus/client_python/blob/f417f6ea8f058165a1934e368fed245e91aafc14/LICENSE>
 
+## FastAPI instrumentator
+
+- `trallnag/prometheus-fastapi-instrumentator` at `2f841527277a21ac9ea622a9f923a5f9078234c4`.
+- `prometheus/client_python` at `f417f6ea8f058165a1934e368fed245e91aafc14`.
+- Licenses:
+  - <https://github.com/trallnag/prometheus-fastapi-instrumentator/blob/2f841527277a21ac9ea622a9f923a5f9078234c4/LICENSE>
+  - <https://github.com/prometheus/client_python/blob/f417f6ea8f058165a1934e368fed245e91aafc14/LICENSE>
+
+## Shared Python runtime collectors
+
+- The `process_runtime` and `python_gc` source packs use `prometheus/client_python` 0.24.1 at
+  `f417f6ea8f058165a1934e368fed245e91aafc14`.
+- License:
+  <https://github.com/prometheus/client_python/blob/f417f6ea8f058165a1934e368fed245e91aafc14/LICENSE>
+
 ## vLLM
 
 - `vllm-project/vllm` at:

prometheus/README.md

@@ -1,32 +1,38 @@
-# Prometheus profile evidence
+# Prometheus profile proof data
 
 This directory stores the bulky, machine-readable evidence used to validate
 stock Prometheus profiles in `netdata/netdata`.
 
 ## Data boundary
 
-- `profiles/<profile>/fixtures/` contains sanitized, source-derived synthetic
-  Prometheus exposition.
-- `profiles/<profile>/SOURCE-INVENTORY.tsv` contains the generated
-  source-family-to-profile reconciliation ledger.
+- `profiles/<profile>/fixtures/` contains sanitized, source-derived synthetic Prometheus exposition.
+- `profiles/<profile>/SOURCE-SEMANTICS.yaml` records source-owned metric semantics and exact upstream revisions.
+- Optional `SOURCE-REGISTRY.yaml` contains generated mechanical registration truth. Its sibling
+  `SOURCE-REGISTRY.generator.yaml` and `generator/` directory reproduce it from the declared upstream source closure.
 
-These fixtures are structural unions assembled from public exporter source and
-documentation. Mutually exclusive releases, roles, features, and exporter
-modes may coexist to exercise the complete declared profile surface. They are
-not recordings of one realizable deployment.
+Each proof case is a realizable deployment state. Separate fixtures represent mutually exclusive releases, roles,
+features, and exporter modes.
 
-Operational dumps, credentials, private endpoints, and real deployment label
-values must not be committed here. The compact operator model, validation job,
-validation summary, source revisions, and detailed provenance remain in the
-matching `src/go/plugin/go.d/collector/prometheus/profile-proofs/<profile>/`
-directory in `netdata/netdata`.
+Operational dumps, credentials, private endpoints, and real deployment label values must not be committed here. Profile
+design, replay cases, and operator rationale remain in the matching
+`src/go/plugin/go.d/collector/prometheus/profile-proofs/<profile>/` directory in `netdata/netdata`.
+
+## Generated registries
+
+Run all generated-registry checks from the repository root:
+
+```sh
+python3 prometheus/tools/source_registry_runner.py
+```
+
+The fixed runner fetches each declared full upstream commit, exposes only declared source files, the reviewed generator
+directory, and its shared `prometheus_client` source parser, runs conventionally discovered fail-closed tests with network
+and writes disabled, and compares generated stdout byte-for-byte with the committed registry. Generators use only the
+Python standard library.
 
 ## Consumer contract
 
-Prometheus profile validation uses the latest `netdata/testdata` `master`. Each
-profile has one stable directory; evidence and the matching validator proof are
-updated together when exporter coverage or validation behavior changes.
+Prometheus profile validation uses the latest `netdata/testdata` `master`. Each profile has one stable directory; proof
+data and the matching Netdata profile proof are updated together when exporter coverage or validation behavior changes.
 
-The Netdata proof descriptor owns expected counts, findings, and exact source
-inventory reconciliation. Git owns transport integrity; this repository does
-not preserve historical evidence revisions for old Netdata checkouts.
+Git owns transport integrity; this repository does not preserve historical proof revisions for old Netdata checkouts.