Prompt & Configuration Registry  ·  View 19 of 21  ·  Operations

Observability

Five signal families across six planes, and the two cells that are empty on purpose.

Editable source SVG draw.io All views
Authoring Build Release Distribution Resolution Evidence Metrics review age gate pass rate promotions/day convergence p99 resolve p99 drop rate Logs who edited what validation fails gate verdicts pull, verify, reject sampled resolves back-pressure Traces build span promote → notice pull → serving digest on the span Audit confidential reads signature issued promotion, approval override, rollback trust bundle change evidence export Alerts gate blocked > 24 h guardrail breach not 100% at 60 s signature rejected staleness > 15 min drop rate > 1% Observability — Signals by Plane Two empty cells in Traces are deliberate: authoring is human-paced and evidence is a stream, neither has a span worth keeping. v 1.0 · owner Platform Architecture · d 2026-09

The signals that matter most

  • Convergence p99 and staleness age are the two numbers that say whether the propagation design is working. Everything else is ordinary platform telemetry.
  • Audit is a distinct family from Logs, with a different store and a different retention, because one is operational and droppable and the other is evidence and is not.
  • Every alert in the bottom row names a specific designed behaviour — 100% convergence at 60 s, signature rejection, 15-minute staleness — rather than a generic threshold on a resource.

The empty cells

  • Authoring has no trace: it is human-paced and a span across a review that takes two days measures nothing.
  • Evidence has no trace: it is a stream, and a per-event span at 500 M events/day would cost more than the events.
  • Resolution has no audit row, because auditing every resolution would mean writing 40,000 durable records a second to prove something the digest on the answer already proves.

Risks

  • A guardrail breach alert on a prompt-quality metric will be noisy, because the metric is noisy. Routing it to a human rather than to an automatic rollback is ADR-15, and it is a choice, not an oversight.
  • Staleness is per-resolver and the fleet is large; the alert has to fire on a population statistic, not on any single pod, or it becomes background.