Operate / Site reliability operators

Observability without authority inversion

Observe operations, failures, and latency without promoting dashboards, logs, sessions, or databases above proof.

evidence provenance and verified appendstructured logs, metrics, traces, and proof receiptsComplete production checklist

Implementation rail · structured logs, metrics, traces, and proof receipts

Exact execution and operator checks

01
Operator check
Define the observation envelope
Log only operation identity, artifact digest, verifier status, retry count, latency, provider boundary, and observation time. Exclude payloads, tokens, keys, cookies, and passphrases.
Substantive records: /reference/operations-receipts · /trust/evidence
Expected: Telemetry is bounded evidence beneath artifact truth.
02
Exact mechanic
Run governance:evidence-check
```
pnpm governance:evidence-check
```
Mechanic
pnpm governance:evidence-check
Authentication and account boundary
Authorized local repository checkout; the command proves only the checked repository boundary.
Exact source
package.json · SHA-256 132f99232dfaf26f7186b73752938d1377042808f42d60d374fe7b2e57c7646b
Expected: Committed evidence satisfies the governance evidence contract.

Exact mechanic

Recompute the held artifact

import { createReceizClient } from "@receiz/sdk";

const encoded = process.env.RECEIZ_ARTIFACT_BASE64;
if (!encoded) throw new Error("RECEIZ_ARTIFACT_BASE64 is required");
const artifactBytes = Uint8Array.from(Buffer.from(encoded, "base64"));
const receiz = createReceizClient();
const verification = await receiz.verification.verifyArtifact(artifactBytes);
if (verification.status !== "verified-artifact") throw new Error(verification.status);
console.log(verification.status);

Mechanic: receiz.verification.verifyArtifact
Authentication and account boundary: Account-free local verification of complete held artifact bytes.
Exact source: node_modules/@receiz/sdk/dist/index.d.ts · SHA-256 3278d551808697d9936ffdf75931358c903bb0cc5a211191b611d4474895f6be

Expected: The exact held bytes return verified-artifact independently of telemetry.

04
Operator check
Correlate without authority inversion
Match the independently recomputed artifact digest to the observation record. Treat missing telemetry as an observability failure, never as revocation of held proof.
Substantive records: /trust/hierarchy
Expected: The observation and proof are correlated without promoting telemetry.

Complete operating anatomy

Every boundary required to ship.

Solved outcome: Telemetry routes investigation and preserves exact operation identities while sealed artifact truth remains authoritative.
Prerequisites: Hold an operation identity, artifact digest, verifier result, bounded telemetry schema, retention rule, redaction rule, alert owner, and correlation clock.
Exact primitive: evidence provenance and verified append
Governing law: Observability without authority inversion is governed by reasoning-kernel: Product ontology is decided inside the Receiz authority boundary. governance-evidence: Registered evidence entries satisfy the checker's exact presence, binding, and status rules. canonical-artifact-verifier: The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate.
Source-of-truth order: Receiz law → sealed artifact truth → deterministic proof object state → verified durable local or register truth → authenticated snapshot → server distribution, synchronization, indexing, and publication → database, session, observability, and interface projections.
Expected artifact, receipt, or state: A bounded operational observation linked to an operation identity, artifact digest, check result, and observation time; it is evidence, not proof authority.
Inspection: Inspect the operation identifier, artifact digest, verifier result, retry count, and external provider boundary. Inspection exposes structure and receipt fields; inspection never establishes verification.
Independent verification: Independent verification for observability: recompute the held artifact first, then correlate its digest with the observation. This establishes only the evidence provenance and verified append boundary named by the bound sources; The implementation rail remains beneath proof authority: structured logs, metrics, traces, and proof receipts.
Offline behavior: Held proof and local verification remain usable without telemetry. Buffered observations may append later without rewriting proof state.
Identity and account boundary: Public Record Moment, Seal File, Verify, Export, and public proof reading are account-free. Identity is optional and adds continuity, custody, recovery, and governed private controls after proof admission.
Security boundary: Telemetry excludes artifact payloads, private keys, access tokens, passphrases, cookies, and unbounded personal data.
Conformance command: pnpm governance:evidence-check
Deployment checks: Deploy structured logs, metrics, and traces with payload and credential redaction; prove operation-ID and digest correlation, bounded retention, alert routing, and continued local verification when telemetry is unavailable.
Production checklist: Test redaction; correlate one accepted and one rejected verification; force telemetry loss; prove held proof remains usable; validate retry counters, provider boundaries, clock fields, retention, and alert ownership.
Rollback and containment: Containment for observability: The observation channel becomes a security incident. Contain, rotate exposed credentials, purge per policy, and preserve incident evidence. The observation cannot be correlated to the proof. Recompute the artifact and correct the weaker telemetry projection. Operational visibility degrades; proof truth remains intact. Buffer permitted observations and restore the pipeline separately. Preserve every stronger held artifact and admitted state while the named boundary is corrected.

Fail closed

Mutation and failure matrix

Telemetry contains a token, key, cookie, passphrase, or private payload.

Effect: The observation channel becomes a security incident.
Retry: Stop ingestion and never copy the exposed value.
Recovery: Contain, rotate exposed credentials, purge per policy, and preserve incident evidence.

Observation digest does not match independently verified bytes.

Effect: The observation cannot be correlated to the proof.
Retry: Do not relabel the observation.
Recovery: Recompute the artifact and correct the weaker telemetry projection.

Metrics, logs, or traces are unavailable.

Effect: Operational visibility degrades; proof truth remains intact.
Retry: Retry bounded export without blocking proof use.
Recovery: Buffer permitted observations and restore the pipeline separately.

Exact authority

Claim-to-source bindings

Product ontology is decided inside the Receiz authority boundary.
docs/receiz-reasoning-kernel.mdnormative-doctrine · SHA-256 bbe2eeb58ef1487a84f3e128eaad16215c8aceecf30f3cdc5a68fa6316a844bd
Registered evidence entries satisfy the checker's exact presence, binding, and status rules.
scripts/check_governance_evidence.tsevidence-register · SHA-256 4d887a3943808bec1f3d274b02bd4cf7cfc9f3b39c5e34169c709ddc97c8263c
The verifier classifies the supplied artifact. Embedded subpayloads and remote responses remain subordinate.
packages/receiz-sdk/src/artifactVerification.tsimplementation-verifier · SHA-256 c10cdba92568fea273e1d9e7a3321083d52945378ab0cc83aee9720d44f0bba3

One complete system

Exact execution and operator checks

Define the observation envelope

Run governance:evidence-check