Metrics, logs & traces
Ingest and query a tenant time-series store, a Quickwit-backed log index, and distributed traces — plus LLM traces and stats for model-serving paths.
SS-06 · VRQGO Observability & APM
The visibility plane over the mesh. A tiny time-series store, a Quickwit log index, distributed traces and LLM traces, SLOs with burn-rate alert routing, synthetic probes that prove mesh reachability, multi-channel alerting, and the append-only, signed audit index that every other service writes its audit chain into.
What it does
Ingest and query a tenant time-series store, a Quickwit-backed log index, and distributed traces — plus LLM traces and stats for model-serving paths.
Define SLOs, read burn rate, bind an alert, and evaluate-and-route: a burning SLO fans an alert to its channels automatically.
Register synthetic probes and post results — reachability checks that prove a mesh peer or a steered DNS name is actually answering.
Register alert channels and read dispatches and incidents — the alerting fabric the SLOs route into.
The append-only audit-events index (with audit-latency) is where every service's Vault-Transit-signed ADR-0014 chain lands and becomes queryable.
Worked examples
Auth on every call is the platform standard: an SS-01 Bearer token plus your X-Tenant-Id. $BASE is the service's /api/v1 base; ${H[@]} carries the auth headers.
A probe posts reachability results; an SLO watches them and routes an alert when the burn rate crosses. Ingest is append-only and non-idempotent by design.
# Register a probe that checks a mesh peer is answering
curl -sX POST "$BASE/probes" "${H[@]}" -d '{
"name":"mesh-1-peer-reach", "kind":"mesh", "target":"100.100.1.1", "interval_s":30
}'
# The probe runner posts a result (fire-and-forget, no Idempotency-Key)
curl -sX POST "$BASE/probes/mesh-1-peer-reach/results" "${H[@]}" \
-d '{ "ok": true, "rtt_ms": 11 }'
# Evaluate the reachability SLO and route the alert if it is burning
curl -sX POST "$BASE/slos/mesh-reachability/evaluate-and-route" "${H[@]}"
# → { "burning": false, "budget_remaining": 0.94, "dispatched": [] }Endpoints
Method · path from services/06's openapi.json. The complete catalog for every group is on the docs page.
/api/v1/metricsIngest a metric sample (OTLP/agent write path)/api/v1/logsIngest a log record/api/v1/logsQuery the Quickwit log index/api/v1/slosDefine an SLO/api/v1/slos/{name}/burnRead an SLO's burn rate/api/v1/slos/{name}/alert-bindingBind an alert to an SLO/api/v1/slos/{name}/evaluate-and-routeEvaluate an SLO and route the alert/api/v1/probesRegister a synthetic probe/api/v1/probes/{id}/resultsPost a synthetic probe result/api/v1/channelsRegister an alert channel/api/v1/incidentsList incidents/api/v1/dispatchesList alert dispatches/api/v1/audit-eventsAppend a signed audit event/api/v1/audit-eventsQuery the signed audit index/api/v1/audit-latencyRead audit-chain write latency/api/v1/llm/tracesIngest an LLM traceArchitecture placement
SS-06 is the sink for the fabric's telemetry and its audit chain. Ingest surfaces (metrics, logs, audit-events, LLM traces, probe results) are append-only and deliberately non-idempotent — every OTLP agent and every service's Audit.Record fires-and-forgets into them. SLOs evaluate burn rate and route alerts to channels; synthetic probes run reachability checks over the mesh itself; the audit index is what makes the ADR-0014 chain queryable.
Keep exploring
ZTNA, the sovereign mesh, native WireGuard coordination, SD-WAN and the UPO policy compiler — one fabric.
Open deep-dive →Authoritative DNS, GeoDNS steering, health-checked answers and a DNSSEC ceremony — the resolution layer under the mesh.
Open deep-dive →Detections-as-code, guard-railed containment, threat intel, and the Zeek mesh chaos-rig auditor.
Open deep-dive →The Envoy edge in front of the whole fabric: TLS, JWT, WAF, rate-limits, routes and weighted canaries.
Open deep-dive →