Operations
Observability and audit
Telemetry, correlation context, redaction, append-only audit, and proposed retention defaults.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
Telemetry classes
Platform metrics
- Control-plane latency/errors
- Queue depth
- Runtime-cluster health
- Build capacity
- Gateway throughput
- Authentication failures
- Policy decisions
- DB latency/errors
- Backup age
- KV usage
- Egress denials
Application telemetry
- Request count
- Status codes
- Latency
- CPU/memory
- DB statements
- KV operations
- Egress calls
- Console logs
- Unhandled exceptions
Build telemetry
- Queue time
- Step duration
- Dependency volume
- Scan findings
- Build failures
- Artifact size
Audit
- Identity changes
- Membership and role changes
- SSO configuration
- AI grants
- Source mutations
- Builds
- Approvals
- Deployments
- Policy/IP-list changes
- Secret/integration changes
- Backups/restores
- Exports
- Administrative access
Correlation fields
Every request/event should carry:
trace_id
request_id
organization_id
application_id
environment_id
deployment_id
actor_id
agent_id where relevant
runtime_cluster_id
OpenTelemetry
Use OpenTelemetry-compatible traces, metrics, and logs so the observability backend remains replaceable.
Logging rules
Do not log by default:
- Request bodies
- Authorization headers
- Session cookies
- OIDC tokens
- Raw secrets
- Full integration responses
- Full AI prompts
- Database result rows
Apply structured redaction before logs leave the workload.
Audit immutability
Audit records are append-only.
Administrative correction creates another event rather than modifying the original.
For higher assurance, periodically hash/sign audit batches and write the digest to immutable storage.
Pilot retention defaults
Audit: 1 year
Application logs: 30 days
Build logs: 90 days
Security events: 1 year
Preview environments: 7 days unless extended
Deleted app recovery: 30 days
These are contract-configurable.