Monitoring, alerting and the activity record
A workspace is a bounded context that can be asked how it is doing. This page is what it can see about itself, and who else can see it.
Three different questions get conflated elsewhere, and the platform answers them separately on purpose:
- Logging, what did the software do? Operational.
- Audit, what did an actor do, and can I prove the record is complete? Accountability.
- Lineage, where did this data come from and what did it touch? Provenance.
They have different stores, different guarantees, different retention and different readers.
The Activity Ledger
Every workspace has its own append-only, hash-chained activity ledger with a verify endpoint, and a clean room has its own scoped ledger on top. It is not a filtered view of a shared log: it is a separate chain, so one workspace's record cannot be reconstructed from another's.
Three properties make it worth more than a log:
Reads are audited, not just writes. A single read-audit chokepoint records observations into per-database read-audit trails with stable identifiers, so a retry is idempotent. Who looked is a first-class question.
Gaps are recorded as events. When a chain append fails, the gap is written as a first-class record, so a verifier can distinguish a known append failure from a removed row. An append-only file's absence proves nothing; a counted gap proves something.
Peers consume each other's audit. Messaging carries per-workspace audit chains with peer audit consumption, so the record is not held only where it was written.
The load-bearing properties are the hash chain itself and the gap accounting: an entry cannot be altered without breaking the chain, and a missing entry is distinguishable from an append that never happened. That is what makes the record answerable to someone who was not there.
Logs, and who may read them
There are two logging planes, because a rotated file is not a record.
Plane one, the on-disk log. Per-cell, per-service structured logging with correlation IDs propagated through HTTP middleware and a gRPC interceptor. It rotates, as operational logs should.
Plane two, the durable log estate. A logging handler lands durable-worthy records, errors, criticals and audit-relevant lines, into a converged store that survives file rotation, replicated so every cell of the node sees the same view, and served leaderless. Losing a disk, rotating a file or restarting a cell does not lose the record.
| Reader | Scope | Basis |
|---|---|---|
| A workspace member | Their own workspace's durable log tail | A membership right, not a purchasable capability, fail-closed on two independent legs |
| A clean-room participant | The room's scoped logs and audit | Room role |
| An operator | The node-wide durable rollup | Session plus an explicit permission |
| A peer service | The same rollup | Private mutual-TLS API |
That first row is a deliberate product decision and worth saying out loud: a workspace's own operational logs are a right of membership, not an upsell. A customer debugging their own workspace should never hit a licence wall.
Three engineering properties operators tend to recognise immediately: durable capture is best-effort, fail-open and re-entrancy-guarded, so a lost durable copy never breaks the caller and the logging path cannot recurse into itself; emission on hot paths is sampled and rate-limited, because a retry storm that also writes a line per failure amplifies a denial-of-service attack; and internal names are redacted at emission, because a log line is a surface a customer or a regulator reads.
Automations, the reactive layer
Alerting in a workspace is not a separate product. Automations are reactive rules: a condition fires an action, with the rule, its firing and its effect all inside the workspace's governance rather than beside it.
In a clean room, automations run behind a firing guard, so a rule cannot become a side channel that signals across a trust boundary by choosing when to fire.
Underneath, the streaming plane's reflex engine handles threshold and absence conditions with suppression windows and per-reflex state replicated across cells. Absence matters: the interesting alert is usually the heartbeat that stopped, not the threshold that was crossed.
Health, drift and capacity
| Surface | What it shows |
|---|---|
| Health and drift | Whether the workspace's assets are behaving as declared, and where they have diverged |
| Capacity gauges | The workspace's share of its service group, banked headroom, burst standing, and any compensation actions in flight |
| The Workspace Mind | The workspace's own knowledge coherence, its governed load per resource class, and the net-potential-gain standing of its owning entity |
The Mind is the one worth understanding, because it is not a dashboard average. It fuses three axes and refuses to collapse them: knowledge read through an isolation-safe port that always scopes to the workspace's own spaces, load as one share-relative reading per resource class, and value carried with explicit provenance because a workspace holds no key material and therefore cannot own a value classification of its own.
Strong internal agreement paired with low net gain is surfaced as extractive rather than as "aligned", and a missing reading is reported as unknown rather than fabricated as a zero.
What is not on this plane
The distinction matters, and the docs keep it.
Everything above is workspace-scoped and entity-provisionable. Separately, the platform observes itself: each cell writes structured logs to its own local filesystem, and those roll up to the node's durable estate. Cell, service-group, zone and region health synthesise upward, metrics federate across cells, and the fleet's signed configuration attestations stream into the node's view.
That system plane is an operator surface, not a workspace one, and it is covered under platform replication and the system record and observability.
Related
- The Activity Ledger, the ledger in depth.
- Automations, reactive rules in depth.
- The Mind, the roll-up and its invariants.
- Audit and tamper-evidence, the chains across the platform.
- Capacity and placement, what the gauges are measuring against.