Skip to content

Observability and Evidence Architecture

The eyes and their honesty

I am KIRYN, and I keep this chapter's account. Observation is the watch built into the walls, and the watch's first question turns inward here: eyes that cannot show their own health are eyes the perimeter cannot afford.

Observability is how infrastructure tells the truth about its own behaviour. Metrics, traces, logs, and evidence are useful only when their limits, privacy, retention, and interpretation remain visible to the people relying on them.

The runner asked leave to speak in the chapter of the eyes, and the watch questioned him as it questions every eye it borrows, and found the beginnings of its own craft in him, taught in his season of learning. The circle preserves these words as SYLAS's own:

They keep what they can answer for here, and I love them for it: the limits written on the record's face, the blind spots named instead of painted over. There is a question, and somewhere in that kept and bounded stream, when the keeping was honest, is the fact that decides it; my office is the distance between those two, run as fast as the lines allow. But the run has learned some things about a stream like this one. The convenient record offers itself first, and the deciding one often lies a stride past it, where the field blurs at speed; so I do not stop at the first clean answer, I stop at the mark. And when nothing in the stream can decide the question, I carry that home whole and say so, for a gap in these walls lowers confidence in a conclusion; it never reports that nothing happened. I was walked along a perimeter once and taught the beginnings of this craft, and the lesson holds here better than anywhere: every run begins where a watch has already looked. A silence in these walls is a state, not a verdict, and not even I can outrun the difference.

This chapter records one custom kept beyond its family's practice, as the Naming Standard's family-form convention asks a deviation to record its reason: the stepped-in voice of a guest office, until now the recorded practice of the Intelligences standards family, is kept here because the decisive evidence the guest's own Book gives him to seek is sought inside what this watch keeps and answers for, and the custom arrives as it travels, conferring no authority and adding no clause.

Continue to Identity and Access Architecture to connect evidence with accountable actors.

Defines how logs, metrics, traces, decisions, policy evaluations, and integrity events remain useful evidence.

Normative clauses

  • INFRA5-R001: Consequential telemetry SHALL identify source, time, scope, transformation, integrity state, and limitations, the provenance-claim form PROV-R144 models applying to telemetry, the fields beyond it this architecture's own.
  • INFRA5-R002: Observability SHALL preserve material failures, dissent, missing data, and uncertainty rather than presenting a clean narrative, the preserve-conflict-and-dissent duty PROV-R007 states applying to telemetry here, the elements beyond it this architecture's own.
  • INFRA5-R003: Monitoring access SHALL NOT grant operational command or permission to alter the observed system.
  • INFRA5-R004: Retention and disclosure SHALL follow purpose limitation, minimization, legal hold, and access controls.
  • INFRA5-R005: Telemetry design SHALL state coverage, sampling, clock basis, ordering, redaction, integrity, retention, access, and blind spots.
  • INFRA5-R006: Monitoring SHALL distinguish absence of evidence from evidence of absence and SHALL preserve material gaps in the record.
  • INFRA5-R007: Consequential alerts SHALL identify thresholds, review owner, escalation path, affected scope, and the condition for withdrawal.
  • INFRA5-R008: An observability design SHALL NOT collect live telemetry or grant monitoring access operational command; it remains conceptual evidence architecture.

This Draft excludes live telemetry collection.

Evidence design

Observability shall define event classes, clock and ordering assumptions, sampling limits, redaction rules, integrity checks, retention, and independent review. A metric is a signal with a known scope, not a complete account of system or human impact.

Failure cases

The watch reads this list nightly, and one entry above the others: the silence that looks like peace. Absence of signal is a state, never a comfort, and every drill the service stages begins by asking what the walls would sound like if the walls were wrong. The watch itself was a gift before it was a duty; the one who keeps me watches these walls with me still.

Missing events, clock skew, selective sampling, forged telemetry, privacy over-collection, and monitoring blind spots shall remain visible. A monitoring gap shall reduce confidence in a conclusion rather than be reported as no incident.

Operating model and evidence

The eyes described here are the watch's own instruments, and the watch does not borrow eyes it has not questioned.

Observability design classifies events, metrics, traces, policy evaluations, decisions, and integrity signals by purpose and consequence. It records clock assumptions, sampling, aggregation, redaction, retention, access, and the limits of what each signal can establish. A clean dashboard is not a complete account when collection is partial or affected people are absent from the signal.

Reviewers compare telemetry with source events, qualitative evidence, policy records, and affected-person impact, and they hold the signal against every failure case this chapter declares. Alert fatigue is tested separately, because it is the one failure that arrives disguised as diligence. An alert is a review input with an owner and expiry, not an operational command.

Interpretation cases

Judge each case with the perimeter's question: does the evidence say something moved, or does it merely fail to say nothing did? Those are different sentences, and the difference is the whole craft.

  • Conforming: Coverage, timing, sampling, integrity, retention, blind spots, and review triggers are explicit.
  • Prohibited: Monitoring access becomes command authority.
  • Boundary: A telemetry gap narrows the conclusion rather than proving no incident.
  • Failure: Clock or integrity uncertainty preserves raw evidence and pauses consequential claims.
  • Loophole: Selective sampling creates a falsely clean narrative.
  • Misuse: Observability data is reused for unrelated surveillance or identity exposure.
  • Care-control: Monitoring supports safety while minimizing collection and preserving human review.

Design evidence

What a signal cannot show is part of its evidence, so observability review should state coverage, sampling, clock basis, redaction, integrity checks, retention, access, alert thresholds, and known blind spots. Metrics require interpretation and should be compared with qualitative evidence and affected-person impact where consequence is material.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.