Everything System9 does is metered, attributed, and verifiable. This plane is
where that promise is kept: a telemetry and logging pipeline that says what
happened, a metering and FinOps stack that says what it cost and who spent it,
an Activity Ledger that says who did what to a workspace,
and Automations that let the estate react to its own events.
The load-bearing property across all four is the same one the rest of the platform
insists on, an account you can check yourself, not one you have to trust.
What's covered
The record
| Page | What you'll find |
|---|
| Monitoring & logging | The metrics and telemetry pipeline, health synthesis and alerting, structured logging, and how a per-cell view rolls up into an estate view |
| What is measured | The metric catalog: what every service and core subsystem measures, the naming and dimensioning model, the operator and tenant planes, retention tiers, and the alert rules that ship |
| Node log rolling | The durable log estate: why a rotated file is not a record, and how durable-worthy lines survive rotation and are served leaderless across a node |
| Activity Ledger | The append-only, per-workspace, hash-chained activity ledger across cells, distinct from per-cell logging, where governance decisions and refusals converge |
| Automations | Reactive rules that fire on events, clean-room bindings, and the governance a firing must clear before it acts |
The bill
| Page | What you'll find |
|---|
| Metering, FinOps & tokenomics | Every metered event into a hash-chained meter audit chain with gap detection, Compute Units, and the FinOps rollups and cost-anomaly signals over the top |
| The licensing lifecycle | Offline signed licensing with no phone-home on the enforcement path, the four-stage expiry that never goes dark on day one, entitlements, and the prepaid capacity model |
| Applying a license | The five ways a license is installed, the one activation chokepoint they share, the rejection codes an operator will see, how a renewal reaches a whole node, and installing with no network at all |
| When the meter cannot report | What happens to metered usage when a cell cannot reach home, scenario by scenario: the crash-safe log, the bounded bundle queue, acknowledgement that is verified rather than assumed, peer forwarding, clock-tamper detection, and the offline ladder |
The relationship
| Page | What you'll find |
|---|
| Proactive support | What the platform can offer a vendor about its own health, what it redacts before anything leaves, and the posture controls over whether it leaves at all |
Start with licensing if you are evaluating
For a buyer, the page that answers the most questions fastest is
the licensing lifecycle, because it carries the
three properties that shape a procurement conversation:
- Licensing verifies entirely offline. The verification key is embedded at build time and the private key never leaves a hardware module, so there is no phone-home on the enforcement path. A monotonic epoch ratchet defeats clock rollback.
- Nothing goes dark on day one. Expiry is a four-stage lifecycle: active, then 30 days of grace with full access and warnings, then 30 days read-only, then administrator access and data export only.
- Infrastructure is free and overage is billed, never blocked. Cells, nodes and service groups cost nothing, so the safest architecture is not the most expensive one, and a workload that exceeds its entitlement is charged rather than stopped.
The principles that run through it
- Every bill line has a hash-chained record behind it. Metering is not a
billing black box; each metered event lands in an independently verifiable chain
with gap detection.
- Attribution is to an entity, not an API key. Consumption rolls up per agent,
per run, per workspace, per cell, because the agent is an entity.
- Charged units are not currency. A metered Compute Unit (what a customer is
charged) and an inference-event cost (the platform's own cost of goods) are
different quantities and are never summed.
- You are never charged for the shape of your deployment. Cells, nodes, and
service groups are free; only work costs anything, so splitting an estate for
residency or resilience costs nothing.
- Governance decisions and refusals that surface here are made on the
Security plane.
- The device-signed edge half of metering runs on the
Edge Agent.
- Cost attribution follows agents through the
Agent Platform.