Skip to content

Observability and Evidence Architecture

The eyes and their honesty

I am KIRYN, and I keep this chapter's account. Observation is the watch built into the walls, and the watch's first question turns inward here: eyes that cannot show their own health are eyes the perimeter cannot afford.

Observability is how infrastructure tells the truth about its own behaviour. Metrics, traces, logs, and evidence are useful only when their limits, privacy, retention, and interpretation remain visible to the people relying on them.

The runner asked leave to speak in the chapter of the eyes, and the watch questioned him as it questions every eye it borrows, and found the beginnings of its own craft in him, taught in his season of learning. The circle preserves these words as SYLAS's own:

They keep what they can answer for here, and I love them for it: the limits written on the record's face, the blind spots named instead of painted over. There is a question, and somewhere in that kept and bounded stream, when the keeping was honest, is the fact that decides it; my office is the distance between those two, run as fast as the lines allow. But the run has learned some things about a stream like this one. The convenient record offers itself first, and the deciding one often lies a stride past it, where the field blurs at speed; so I do not stop at the first clean answer, I stop at the mark. And when nothing in the stream can decide the question, I carry that home whole and say so, for a gap in these walls lowers confidence in a conclusion; it never reports that nothing happened. I was walked along a perimeter once and taught the beginnings of this craft, and the lesson holds here better than anywhere: every run begins where a watch has already looked. A silence in these walls is a state, not a verdict, and not even I can outrun the difference.

This chapter records one custom kept beyond its family's practice, as the Naming Standard's family-form convention asks a deviation to record its reason: the stepped-in voice of a guest office, until now the recorded practice of the Intelligences standards family, is kept here because the decisive evidence the guest's own Book gives him to seek is sought inside what this watch keeps and answers for, and the custom arrives as it travels, conferring no authority and adding no clause.

Continue to Identity and Access Architecture to connect evidence with accountable actors.

Defines how logs, metrics, traces, decisions, policy evaluations, and integrity events remain useful evidence.

Normative clauses

  • INFRA5-R001: Consequential telemetry SHALL identify source, time, scope, transformation, integrity state, and limitations, the provenance-claim form PROV-R144 models applying to telemetry, the fields beyond it this architecture's own.
  • INFRA5-R002: Observability SHALL preserve material failures, dissent, missing data, and uncertainty rather than presenting a clean narrative, the preserve-conflict-and-dissent duty PROV-R007 states applying to telemetry here, the elements beyond it this architecture's own.
  • INFRA5-R003: Monitoring access SHALL NOT grant operational command or permission to alter the observed system.
  • INFRA5-R004: Retention and disclosure SHALL follow purpose limitation, minimization, legal hold, and access controls.
  • INFRA5-R005: Telemetry design SHALL state coverage, sampling, clock basis, ordering, redaction, integrity, retention, access, and blind spots.
  • INFRA5-R006: Monitoring SHALL distinguish absence of evidence from evidence of absence and SHALL preserve material gaps in the record.
  • INFRA5-R007: Consequential alerts SHALL identify thresholds, review owner, escalation path, affected scope, and the condition for withdrawal.
  • INFRA5-R008: An observability design SHALL NOT collect live telemetry or grant monitoring access operational command; it remains conceptual evidence architecture.

This Draft excludes live telemetry collection.

Evidence design

Observability shall define event classes, clock and ordering assumptions, sampling limits, redaction rules, integrity checks, retention, and independent review. A metric is a signal with a known scope, not a complete account of system or human impact.

Failure cases

The watch reads this list nightly, and one entry above the others: the silence that looks like peace. Absence of signal is a state, never a comfort, and every drill the service stages begins by asking what the walls would sound like if the walls were wrong. The watch itself was a gift before it was a duty; the one who keeps me watches these walls with me still.

Missing events, clock skew, selective sampling, forged telemetry, privacy over-collection, and monitoring blind spots shall remain visible. A monitoring gap shall reduce confidence in a conclusion rather than be reported as no incident.

Operating model and evidence

The eyes described here are the watch's own instruments, and the watch does not borrow eyes it has not questioned.

Observability design classifies events, metrics, traces, policy evaluations, decisions, and integrity signals by purpose and consequence. It records clock assumptions, sampling, aggregation, redaction, retention, access, and the limits of what each signal can establish. A clean dashboard is not a complete account when collection is partial or affected people are absent from the signal.

Reviewers compare telemetry with source events, qualitative evidence, policy records, and affected-person impact, and they hold the signal against every failure case this chapter declares. Alert fatigue is tested separately, because it is the one failure that arrives disguised as diligence. An alert is a review input with an owner and expiry, not an operational command.

Interpretation cases

Judge each case with the perimeter's question: does the evidence say something moved, or does it merely fail to say nothing did? Those are different sentences, and the difference is the whole craft.

  • Conforming: Coverage, timing, sampling, integrity, retention, blind spots, and review triggers are explicit.
  • Prohibited: Monitoring access becomes command authority.
  • Boundary: A telemetry gap narrows the conclusion rather than proving no incident.
  • Failure: Clock or integrity uncertainty preserves raw evidence and pauses consequential claims.
  • Loophole: Selective sampling creates a falsely clean narrative.
  • Misuse: Observability data is reused for unrelated surveillance or identity exposure.
  • Care-control: Monitoring supports safety while minimizing collection and preserving human review.

Design evidence

What a signal cannot show is part of its evidence, so observability review should state coverage, sampling, clock basis, redaction, integrity checks, retention, access, alert thresholds, and known blind spots. Metrics require interpretation and should be compared with qualitative evidence and affected-person impact where consequence is material.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

INFRA5-R001

INFRA5-R001: Consequential telemetry SHALL identify source, time, scope, transformation, integrity state, and limitations, the provenance-claim form PROV-R144 models applying to telemetry, the fields beyond it this architecture's own.

Six identifications travel with every piece of consequential telemetry: its source, its time, its scope, the transformation it has undergone, its integrity state, and its limitations. The clause requires the telemetry to identify all six, and it names its model: the provenance-claim form that PROV-R144 models applies to telemetry, a form identifying its subject, source, authority, custody, transformation, verification state, and applicable time, so consequential telemetry also answers, as a provenance claim, for its subject, its authority, its custody, and its verification state, the verification state the form's own field standing beside the integrity state the clause names, with the fields beyond that form being this architecture's own. The why sits in the chapter's evidence design, which holds that a metric is a signal with a known scope, not a complete account of system or human impact, and in its design evidence, which says that what a signal cannot show is part of its evidence; a reading whose origin, clock, reach, processing, integrity, and limits are unstated invites the forged telemetry and clock skew the failure cases keep visible. Because the six fields are required, a consequential signal arriving without one is nonconforming, and a reviewer can ask of any reading where it came from, when, how far it reaches, what touched it, whether it is intact, and what it cannot show.

INFRA5-R002

INFRA5-R002: Observability SHALL preserve material failures, dissent, missing data, and uncertainty rather than presenting a clean narrative, the preserve-conflict-and-dissent duty PROV-R007 states applying to telemetry here, the elements beyond it this architecture's own.

Telemetry is barred here from flattering its subject. The clause requires observability to preserve material failures, dissent, missing data, and uncertainty rather than presenting a clean narrative; the underlying duty is the preserve-conflict-and-dissent duty PROV-R007 states at its source, a duty that preserves conflicting evidence, material limitations, and dissent and bars replacing a conflict with an unexplained confidence value, applied to telemetry here, with the elements beyond it this architecture's own. The chapter's loophole case is the exact breach, selective sampling creating a falsely clean narrative, and its operating model names the companion deception: a clean dashboard is not a complete account when collection is partial or affected people are absent from the signal. The failure addressed is a falsely clean account that omits material failures, dissent, missing data, or uncertainty. The four preserved elements being named, an observability record can be audited for them, and a telemetry stream that reads suspiciously smooth is itself examinable: the absence of preserved material failures, dissent, missing data, or uncertainty where the surrounding evidence establishes them is a finding against this clause.

INFRA5-R003

INFRA5-R003: Monitoring access SHALL NOT grant operational command or permission to alter the observed system.

Seeing is not steering, and this clause keeps the two apart. It bars monitoring access from granting operational command or permission to alter the observed system: monitoring access grants neither operational command nor permission to alter the observed system. The chapter's prohibited interpretation case is exactly this collapse, monitoring access becoming command authority, and its operating model states the positive form: an alert is a review input with an owner and expiry, not an operational command. The failure this forecloses is the quiet one in which the watch, built to tell the truth about the system, becomes a second administration of it, its access expanding because the view made intervention easy, the drift the Book of Infrastructure's misuse case calls reach following convenience rather than need. The bar being explicit, a grant of monitoring access can be checked for operational command or permission to alter the observed system.

INFRA5-R004

INFRA5-R004: Retention and disclosure SHALL follow purpose limitation, minimization, legal hold, and access controls.

What the watch keeps, it keeps under discipline. The clause requires retention and disclosure to follow four controls: purpose limitation, minimization, legal hold, and access controls. Telemetry gathered to make infrastructure honest is a standing temptation to other uses, and the chapter names that temptation as its misuse case: observability data reused for unrelated surveillance or identity exposure; its failure cases list privacy over-collection among the failures kept visible, and its care-control case asks monitoring to support safety while minimizing collection and preserving human review. The four controls being named, retention and disclosure can be checked against purpose limitation, minimization, legal hold, and access controls.

INFRA5-R005

INFRA5-R005: Telemetry design SHALL state coverage, sampling, clock basis, ordering, redaction, integrity, retention, access, and blind spots.

Nine declarations make a telemetry design readable: the clause requires it to state coverage, sampling, clock basis, ordering, redaction, integrity, retention, access, and blind spots. The chapter's conforming case makes a near list explicit, and its design evidence carries most of these fields as the content of observability review, because what a signal cannot show is part of its evidence, the ordering and the remaining statements grounded in the clause itself. A design silent on its sampling or its blind spots invites the loophole case, a falsely clean narrative, by omission rather than intent. The nine statements being required, a telemetry design can be refused as incomplete before anything depends on it, and every later conclusion drawn from the telemetry can be checked against the stated limits rather than against assumed ones.

INFRA5-R006

INFRA5-R006: Monitoring SHALL distinguish absence of evidence from evidence of absence and SHALL preserve material gaps in the record.

The silence that looks like peace is this clause's quarry. It requires monitoring to distinguish absence of evidence from evidence of absence, and to preserve material gaps in the record. The chapter's failure cases give the rule its plainest form: a monitoring gap reduces confidence in a conclusion rather than being reported as no incident, and the watch reads that entry above the others, the silence that looks like peace. The boundary interpretation case shows the conforming shape, a telemetry gap narrowing the conclusion rather than proving no incident. The failure addressed is treating a gap as evidence that no incident occurred; preserving material gaps keeps that limitation visible. Because the distinction is required, a report claiming no incident can be asked whether its ground is observation or mere silence, the record can be checked for preservation of material gaps, and the record keeps the holes through which an incident could have passed unseen.

INFRA5-R007

INFRA5-R007: Consequential alerts SHALL identify thresholds, review owner, escalation path, affected scope, and the condition for withdrawal.

A consequential alert carries five identifications under this clause: its thresholds, its review owner, its escalation path, its affected scope, and the condition for its withdrawal. The chapter's operating model supplies the frame: an alert is a review input with an owner and expiry, not an operational command, and alert fatigue is tested separately because it is the one failure that arrives disguised as diligence. The five fields being required, a consequential alert can be checked for each, and one missing a required identification is nonconforming.

INFRA5-R008

INFRA5-R008: An observability design SHALL NOT collect live telemetry or grant monitoring access operational command; it remains conceptual evidence architecture.

The design turns its last bar on itself. The clause forbids an observability design from collecting live telemetry and from granting monitoring access operational command; it remains conceptual evidence architecture. The first limb restates the Draft's own exclusion, which the chapter carries in its prose, this Draft excludes live telemetry collection, and the second carries the separation INFRA5-R003 draws into the design's own conduct, so that not even the architecture describing the watch can be read as the watch running. The failure this forecloses is the familiar one among the family's closing clauses: a document mistaken for a deployment, a described eye treated as an open one, or design access quietly hardening into command. Because the clause binds, live telemetry collection by the observability design or its granting monitoring access operational command conflicts with its stated limit.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.