Observability, alerting and resource management

Structured JSON event emission runs each event through sanitise, classify, envelope, write and bus fan-out. Envelope fields cannot be overridden, and if the sanitiser fails the payload is dropped while the event itself is kept.

What it does

sanitise → classify → envelope → write → bus fan-out

Inputs

level, event, extra

Outputs

stdout (buffered via) / stderr (FATAL, CRITICAL sync); 'log'

Depends on

tracing/context

State

none (central store optional)

Safeguards

envelope fields cannot be overridden; payload dropped (not event) if sanitiser fails

Gateway log helpers emit GATEWAY_ALLOW and GATEWAY_BLOCK events with a reason. Their log lines feed the anomaly counters and the block-reason detectors, and they depend on the logger.

What it does

emit GATEWAY_ALLOW / GATEWAY_BLOCK

Inputs

reason

Outputs

log lines → anomaly counters, block-reason detectors

Depends on

logger

Adds trace correlation fields to every log line when tracing is enabled, taking them from the AsyncLocalStorage context.

Ingests each record into the central store, writing rows to platform_audit_events in PostgreSQL. The call is fire-and-forget with a loop guard labelled audit_store_ingest, so ingest failures do not block logging.

What it does

(...).catch(=>{}), loop guard label audit_store_ingest

Inputs

record

Outputs

rows in platform_audit_events (Part G)

State

PostgreSQL

Safeguards

fire-and-forget

Redacts by key name: object keys are normalised and matched against an exact-stem set of about 100 entries, and matching values become [REDACTED]. This protects secrets and PII by field name.

What it does

normalise + exact-stem set (~100)

Inputs

object keys

Outputs

[REDACTED]

Safeguards

secrets/PII by field name

Scans string values with regex families, a Luhn check for cards and IPv6 confirmation, and replaces matches with placeholders. Covers PEM, Ed25519 PKCS#8, JWT, Bearer/Basic, URL userinfo, e-mail, SSN, IBAN, phone and card values.

What it does

regex families, Luhn for cards, IPv6 confirmation; flags LOG_SANITIZER_SCAN_*

Inputs

strings

Outputs

placeholders

Depends on

net

Safeguards

PEM, Ed25519 PKCS#8, JWT, Bearer/Basic, qodiqa/portal/provider keys, URL userinfo, e-mail, SSN, IBAN, phone, cards

Limits logged values by size, depth and cycles using the numbers 10 and 10,000 plus a WeakSet. Oversized or looping data is replaced with [MAX_DEPTH], [CIRCULAR] or [TRUNCATED], keeping logging safe against DoS.

What it does

10, 10,000, WeakSet

Inputs

any value

Outputs

[MAX_DEPTH], [CIRCULAR],...[TRUNCATED]

Safeguards

DoS-safe logging

Labels each event as SECURITY, AUDIT or OPERATIONAL using sets, substrings and suffixes of the level and event name, with a cache of 2,000 entries. The result is written as a category field.

What it does

sets/substrings/suffixes, cache ≤2,000

Inputs

level, event

Outputs

category field

Samples noisy logs per key, keeping the first N and then every Mth entry within each window, and emits a summary WARN. This bounds log flooding and depends on the logger.

What it does

first N / every Mth per window; summary WARN

Inputs

key

Outputs

fewer log lines

Depends on

logger

Safeguards

bounds log flood

Aggregates repeated failure logs over a 10 s window and up to 1,000 keys, controlled by QODIQA_LOG_FAILURE_FIRST_N. It emits LOG_EVENTS_AGGREGATED summaries in place of the individual events.

What it does

10 s window, 1,000 keys, QODIQA_LOG_FAILURE_FIRST_N

Inputs

emit fn, event, payload

Outputs

LOG_EVENTS_AGGREGATED summaries

Depends on

logger

Keeps an in-memory Prometheus registry with cumulative buckets and sorted, escaped label keys, and renders it as text exposition. State lives in process memory only; the API cannot fail, and there is no series cap.

What it does

cumulative buckets, label keys sorted/escaped

Inputs

metric ops

Outputs

text exposition

State

none (process memory)

Safeguards

infallible API; no series cap

Caveat no series cap

Defines the metric catalogue of 315 metrics: 200 counters (C), 87 gauges (G) and 28 histograms (H). Closed label enums are kept by convention rather than enforced.

What it does

200 C / 87 G / 28 H

Outputs

see

Safeguards

closed label enums by convention

Caveat closed label enums by convention

Seeds metrics at boot with inc(labels,0) for closed label sets, so every series is visible at the first scrape (OBS-PL-02). This keeps alert rules correct.

What it does

inc(labels,0) for closed label sets

Outputs

series visible at first scrape (OBS-PL-02)

Safeguards

alert-rule correctness

Maps a block reason onto one of 6 security events and counts it in qodiqa_security_events_total, labelled by event, so security-relevant blocks show up as metrics.

What it does

map to 6 events

Inputs

block reason

Outputs

qodiqa_security_events_total{event}

Serves the Prometheus scrape endpoint on GET as text/plain 0.0.4 with no-store. It is protected by a rate limit, an IP allow-list, an ops token and the QODIQA_DIAGNOSTICS_ENABLED gate.

What it does

Active

Inputs

GET

Outputs

text/plain 0.0.4, no-store

Safeguards

rate limit + IP allow-list + ops token + QODIQA_DIAGNOSTICS_ENABLED gate

Records enforcement decision metrics into qodiqa_requests_total from the request body. Metrics never throw into the response.

Records verification decision metrics from the request body into the qodiqa_verification_* family, in the same way as the enforcement metrics, using the metrics module.

Counts HTTP responses in qodiqa_http_responses_total and restricts the label to a 31-name allow-list, which keeps cardinality bounded. It depends on the metrics registry.

What it does

31-name allow-list

Outputs

qodiqa_http_responses_total

Depends on

metrics

Safeguards

bounded cardinality

Monitors latency every 30 s against thresholds of 2,000 ms mean and 5,000 ms p99, using lifetime (non-windowed) histogram stats. It emits REQUEST_LATENCY_* events.

Counts provider failures in the counter qodiqa_provider_failures_total, which carries a provider label so failures can be told apart by provider. It depends on the metrics registry.

What it does

qodiqa_provider_failures_total{provider}

Inputs

provider

Counts security events for auth, RBAC and MFA: rbac_denials_total, ops_auth_failures_total with a reason label, and mfa_events_total with an outcome label. It depends on the metrics registry.

What it does

rbac_denials_total, ops_auth_failures_total{reason}, mfa_events_total{outcome}

Depends on

metrics

Documents a defect: a counter not exported from the registry causes a TypeError that is swallowed, so the counter never increments and stays at its seeded 0. It is proven by a request.

What it does

registry member not in ⇒ TypeError swallowed

Inputs

proof request

Outputs

counter never increments (stays at seeded 0)

Depends on

metrics

Caveat counter never increments (stays at seeded 0)

Lists 10 metrics that are registered but never emitted, so they expose only HELP and TYPE lines.

Optional OTLP metrics push: exports a registry snapshot on an interval, skipping a run if the previous one overlaps, by POST to the endpoint's /v1/metrics. Only an https endpoint is accepted.

What it does

interval export, overlap skip

Inputs

env, registry snapshot

Outputs

POST <endpoint>/v1/metrics

Safeguards

https-only endpoint

Validates tracing configuration read from QODIQA_OTEL_* variables, checking the https endpoint and sampling rates. The result is a frozen config, or a TRACING_CONFIG_INVALID event when invalid.

What it does

https endpoint check; rates

Inputs

QODIQA_OTEL_*

Outputs

frozen config; TRACING_CONFIG_INVALID

Depends on

logger

Safeguards

https-only

Parses and formats the W3C traceparent header with a regex of the form 00-32-16-2, rejecting zero ids. It returns a context and sets the response header; parsing is strict.

What it does

regex 00-32-16-2, reject zero ids

Inputs

header

Outputs

ctx; response header

Safeguards

strict parse

Creates the root request span named 'HTTP <METHOD>' with attributes and an AsyncLocalStorage context, and sets the traceparent response header. Span goes to the tracer queue; URL query values are redacted.

What it does

span HTTP <METHOD>, attrs, ALS context, traceparent response header

Inputs

request

Outputs

span → tracer queue

Depends on

tracer

Safeguards

URL query values redacted

Decides sampling deterministically from the trace id prefix and the configured rate, producing a sampled flag, using only the id and the rate.

What it does

deterministic from id prefix

Inputs

rate

Outputs

sampled flag

Models spans with key-stem attribute redaction and converts them to OTLP. It takes attributes as input and returns a span, and redaction hides sensitive attribute values by key stem.

Optional batch export of spans as OTLP/HTTP JSON, sent when the batch reaches QODIQA_OTEL_BATCH_SIZE or a timer fires. One attempt only and no queue cap; the endpoint must be https.

What it does

batch ≥ QODIQA_OTEL_BATCH_SIZE or timer; single attempt; no queue cap

Inputs

spans

Outputs

POST <endpoint>/v1/traces

Safeguards

https-only

Caveat single attempt; no queue cap

Standalone Sentry-protocol client tool that filters and samples errors, builds an event and POSTs an envelope to the Sentry HTTPS API. It accepts only an HTTPS DSN and redacts tags and extras.

What it does

filter, sample, build event, POST envelope

Inputs

errors

Outputs

Sentry HTTPS API

Safeguards

HTTPS DSN only; tag/extra redaction

Attaches a dispatcher to the logger bus and forwards each record to the log-shipping path. A self-reference guard and try/catch isolation keep a failing destination from affecting logging.

What it does

forward each record; self-reference guard

Inputs

logger bus

Outputs

(record)

Safeguards

try/catch isolation

Validates log-shipping configuration per destination from QODIQA_LOGSHIP_* and ALERT_SIEM_* variables. HTTPS is required; the result is a frozen config, or a LOGSHIP_CONFIG_INVALID event.

What it does

per-destination validity; https required

Inputs

QODIQA_LOGSHIP_*, ALERT_SIEM_*

Outputs

frozen config; LOGSHIP_CONFIG_INVALID

Depends on

logger

Safeguards

https-only URLs

Normalises a log record to the shipping schema and redacts it using a 20-stem list. If redaction itself fails, the fail-safe marker [REDACTION_FAILURE] is used.

What it does

schema map, 20-stem redaction

Inputs

record

Outputs

normalised event

Safeguards

[REDACTION_FAILURE] fail-safe

Queues events per destination with a depth cap of 10,000, retries with exponential back-off up to 3 times, and drops on overflow, run by BackgroundTaskRunner. It reports qodiqa_logship_* metrics and a health gauge.

What it does

per-destination depth cap 10,000; exp. back-off ≤3; BackgroundTaskRunner

Inputs

events

Outputs

qodiqa_logship_* metrics; health gauge

Depends on

metrics, BackgroundTaskRunner

Sends log batches over HTTPS only, with a 15 s timeout, using the given url, headers and body. Non-https targets are rejected.

What it does

HTTPS only, 15 s timeout

Inputs

url, headers, body

Depends on

https

Safeguards

rejects non-https

Optional ELK destination that sends events as ndjson, in ECS format when the schema is ecs, by POST to a Logstash-style URL.

What it does

ndjson; ECS if schema ecs

Inputs

events

Outputs

POST to Logstash-style URL

Optional Datadog destination that sends events as a JSON array to a Datadog http-intake host for the configured site, with the API key carried in the DD-API-KEY header.

What it does

JSON array to http-.<site> with DD-API-KEY

Inputs

events

Outputs

HTTP

Safeguards

api key in header

Optional Splunk HEC destination that sends HEC JSON to <url>/services/collector/event, with a CIM option. Requests carry an Authorization: Splunk header.

What it does

HEC JSON, CIM option

Inputs

events

Outputs

<url>/services/collector/event

Safeguards

Authorization: Splunk

Optional SIEM destination that builds a CEF line and delivers it through an HTTP wrapper or by syslog over UDP or TCP.

What it does

CEF line; HTTP wrapper or syslog UDP/TCP

Inputs

events

Outputs

SIEM

Builds CEF strings and sends them as syslog datagrams over UDP or as a stream over TCP. Header and extension escaping makes the output injection-safe.

What it does

header/extension escaping; UDP/TCP socket

Inputs

fields

Outputs

CEF string; datagram/stream

Depends on

dgram, net

Safeguards

injection-safe escaping

Maps an event onto an ECS 8.11 document through field mapping, so log-shipping destinations that use the ECS schema receive events in that shape.

What it does

field mapping

Inputs

event

Outputs

ECS doc

Maps an event onto a Splunk CIM document through field mapping, for use when the CIM option is chosen for the Splunk destination.

What it does

field mapping

Inputs

event

Outputs

CIM doc

Initialises and shuts down the alerting framework: registers services, starts escalation and initialises detection. It emits ALERTING_FRAMEWORK_INITIALIZED and depends on all alerting modules.

What it does

register services, start escalation, init detection

Outputs

ALERTING_FRAMEWORK_INITIALIZED

Depends on

all alerting modules

Runs the detection engine over logger records: applies an exclusion set, runs 5 detectors in order, and de-duplicates for 60 s. The dedup map is held in memory.

What it does

exclusion set, 5 detectors in order, dedup 60 s

Inputs

logger records

Outputs

calls

Depends on

detectors, engine

State

in-memory dedup map

Raises REPLAY_ATTACK alerts from the events and blocks it sees, using 3 event rules plus a block reason rule, as one of the detectors in the alerting engine.

What it does

3 event rules + block reason

Inputs

events/blocks

Outputs

REPLAY_ATTACK alerts

Raises SIGNATURE_FAILURE alerts from events and blocks, using 3 event rules plus 7 block regexes, as one of the detectors in the alerting engine.

What it does

3 event rules + 7 block regexes

Inputs

events/blocks

Outputs

SIGNATURE_FAILURE alerts

Raises POLICY_FAILURE alerts from events and blocks, using 6 event rules plus 4 block patterns, as one of the detectors in the alerting engine.

What it does

6 event rules + 4 block patterns

Inputs

events/blocks

Outputs

POLICY_FAILURE alerts

Applies 25 operational and 6 governance rules, covering DLP exposure, RBAC, ops auth and reconciliation, to raise OPERATIONAL or GOVERNANCE alerts. DLP alerts carry hashes and rule names, not values.

What it does

25 operational + 6 governance rules (DLP exposure, RBAC, ops auth, reconciliation)

Inputs

events

Outputs

OPERATIONAL/GOVERNANCE alerts

Safeguards

DLP alert carries hashes/rule names, not values

Detects anomalies with z-score and rate thresholds across allow, block, RBAC, ops and key events, capped at 1,000 tenants and 5,000 keys. It raises ANOMALY alerts and serves /alerts/counters, from in-memory state.

What it does

z-score + rate thresholds; caps 1,000 tenants / 5,000 keys

Inputs

allow/block/RBAC/ops/key events

Outputs

ANOMALY alerts; /alerts/counters

State

in-memory

Resolves open REDIS_DEGRADED alerts when GATEWAY_RUNTIME_RECOVERED arrives, paging up to 200 per status, and sets status RESOLVED in PG. The actor recorded is system:auto-recovery.

What it does

resolve open REDIS_DEGRADED alerts (page ≤200 per status)

Inputs

GATEWAY_RUNTIME_RECOVERED

Outputs

status RESOLVED

Depends on

AlertStore

State

PG

Safeguards

actor system:auto-recovery

Scores risk as a base plus amplifiers minus a discount and maps the result through a threshold map to a derived severity.

What it does

base+amplifiers−discount, threshold map

Inputs

severity, subtype, confidence, context

Outputs

derived severity

Creates an alert by scoring it, checking suppression, saving it, notifying at MEDIUM and above, and scheduling escalation. Per-alert suppression rules apply; storage is PG with a memory fallback.

What it does

score, suppression check, save, notify (MEDIUM+), schedule escalation

Inputs

spec

Outputs

alert record, alert.* events

Depends on

store, notification, escalation

State

PG / memory fallback

Safeguards

per-alert suppression rules

Runs alert lifecycle operations: a state guard, a store update and cancelling escalation. Needs the MANAGE_ALERTS permission, with step-up required to suppress.

What it does

state guard, store update, cancel escalation

Inputs

alert id, meta

Outputs

status transitions

Depends on

store

State

PG

Safeguards

permission MANAGE_ALERTS, step-up on suppress

Holds the severity policy table that maps each severity to its channels, roles, immediacy, escalation steps and SLA windows, and answers policy lookups for the rest of alerting.

What it does

channels, roles, immediacy, escalation steps, SLA windows

Inputs

severity

Outputs

policy lookups

Orchestrates notifications by filtering enabled channels from the environment, sending per channel and writing a delivery record to PG in qodiqa_notification_deliveries. Recipients are read from env at load.

What it does

enabled-channel filter by env;; delivery record

Inputs

alert

Outputs

per-channel deliveries; qodiqa_notification_deliveries

Depends on

channels, store

State

PG

Safeguards

recipients from env at load

Provides the channel base: a token bucket per 60 s, retry with jitter, a SHA-256 payload hash and metrics, published as qodiqa_alert_notification_*.

What it does

token bucket per 60 s, retry+jitter, SHA-256 payload hash, metrics

Inputs

alert, recipient

Outputs

qodiqa_alert_notification_*

Depends on

metrics

Webhook channel that sends the alert as a JSON POST over http or https, with an optional HMAC-SHA256 signature header, and the destination can be http or https.

What it does

JSON POST, optional HMAC-SHA256 header, http or https

Inputs

alert

Outputs

HTTP

Depends on

http/https

Safeguards

HMAC signature

Slack channel that formats the alert as an attachment payload and delivers it with a POST to a Slack webhook, as one of the notification channels.

What it does

attachment payload

Inputs

alert

Outputs

Slack webhook POST

Teams channel that formats the alert as an Adaptive Card and delivers it with a POST to a Teams webhook, as one of the notification channels.

What it does

Adaptive Card

Inputs

alert

Outputs

Teams webhook POST

E-mail channel that delivers alerts through SMTP (STARTTLS, no plaintext AUTH), SendGrid or Mailgun. TLS verification is on by default, and the channel depends on net, tls and https.

What it does

SMTP (STARTTLS, no plaintext AUTH) / SendGrid / Mailgun

Inputs

alert

Outputs

e-mail

Depends on

net, tls, https

Safeguards

TLS verify default on

PagerDuty channel that triggers an Events v2 event for the alert and sets a dedup_key, as one of the notification channels used when an alert is delivered.

What it does

Events v2 trigger, dedup_key

Inputs

alert

Outputs

PagerDuty

SMS channel for CRITICAL alerts, sent through Twilio REST or a webhook with messages truncated to 160 characters. Twilio requests use Basic auth.

What it does

Twilio REST / webhook, 160-char truncation

Inputs

CRITICAL alert

Outputs

SMS

Safeguards

Basic auth to Twilio

SIEM channel that delivers the alert as a CEF message, sent either over HTTP or through syslog, as one of the notification channels used for alerts.

What it does

CEF over HTTP or syslog

Inputs

alert

Outputs

SIEM

Escalates alerts by scanning every 30 s for passed deadlines, stepping up levels, notifying and recording. It writes qodiqa_escalation_records and emits ALERT_ESCALATED; timers are in memory.

What it does

30 s scan, level steps, notify, record

Inputs

alert deadlines

Outputs

qodiqa_escalation_records; ALERT_ESCALATED

Depends on

store, notifications

State

PG + in-memory timers

Correlates alerts into incidents using 4 window keys with a minimum of 2 alerts, within caps. Results go to qodiqa_incidents in PG.

What it does

4 window keys, MIN 2 alerts, caps

Outputs

qodiqa_incidents

Depends on

store

State

PG

Alert store using PG upsert with dedup, RLS-enforced reads and retention, plus a memory fallback of 10,000. Access runs under tenant context and RLS.

What it does

PG upsert + dedup, RLS reads, retention, memory fallback (10,000)

Inputs

alerts

Outputs

tables listed

State

PG / memory

Safeguards

tenant context/RLS

Matches alerts against qodiqa_suppression_rules in PG, aware of the tenant, and drops any alert that a rule suppresses. Rules are tenant-scoped.

What it does

match qodiqa_suppression_rules (tenant-aware)

Inputs

alert

Outputs

suppressed alert dropped

Depends on

PG

State

PG

Safeguards

tenant-scoped

Exposes the alerting REST API with 13 routes returning JSON, plus SSE with a heartbeat. Requires READ_AUDIT or MANAGE_ALERTS, with step-up on sensitive actions.

What it does

13 routes

Inputs

HTTP

Outputs

JSON / SSE

Depends on

engine, store

Safeguards

READ_AUDIT / MANAGE_ALERTS, step-up, SSE heartbeat

Liveness endpoint, active on GET /health and answering 200. It sits behind an IP allow-list, with optional loopback or auth, and has no rate limit.

What it does

Active

Inputs

GET /health

Outputs

200

Safeguards

IP allow-list, optional loopback/auth, no rate limit

Readiness endpoint on GET /ready answering 200 or 503. It gates on 9 components plus an informational cache, covering stores, pg, admission and audit, under the same access controls as liveness.

What it does

9 gating components + informational cache

Inputs

GET /ready

Outputs

200/503

Depends on

stores, pg, admission, audit

Safeguards

same

Redis HA health endpoint on GET /health/redis that reports per-store state and answers 200 or 503, under the same access controls as liveness.

What it does

per-store state

Inputs

GET /health/redis

Outputs

200/503

Safeguards

same

Emits readiness metrics and logs only when the readiness state changes, using the probe results as input, and publishes them as qodiqa_readiness_* metrics.

What it does

transition-only metrics/logs

Inputs

probe results

Outputs

qodiqa_readiness_*

Depends on

metrics

Serves authenticated diagnostics on GET /diagnostics as JSON, covering integrity, pool stats, event loop, redis persistence and SLA. It depends on the monitors.

What it does

integrity, pool stats, event loop, redis persistence, SLA

Inputs

GET /diagnostics

Outputs

JSON

Depends on

monitors

Provides profiling endpoints: heap stats, GC via PerformanceObserver, and an inspector CPU profile. They return JSON summaries, take a window in ms clamped to 1 to 30 s, and sit behind a second kill switch plus the ops stack.

What it does

heap stats; PerformanceObserver GC; inspector CPU profile

Inputs

window ms

Outputs

JSON summaries

Depends on

v8, perf_hooks, inspector

Safeguards

second kill switch + ops stack; 1–30 s clamp

Standalone tool that writes a heap snapshot with v8 to a .heapsnapshot file at a given path.

Event bridge that republishes logger records onto the bus, with an entry lookup for /block events. It depends on the logger and the audit log.

What it does

republish; /block with entry lookup

Inputs

logger records

Outputs

bus events

Depends on

logger, audit-log

Aggregation store for the dashboard that rebuilds from the audit chain at load through a history scan, with retention caps. Aggregates are held in memory.

What it does

rebuild from chain at load; retention caps

Inputs

bus, audit chain

Outputs

in-memory aggregates

Depends on

audit-log

State

in-memory (+ chain scan)

Aggregator and repository layer that answers dashboard queries from the store and pages results newest-first, returning them as JSON for the dashboard routes.

What it does

paging newest-first

Inputs

queries

Outputs

JSON

Depends on

store

Metrics engine for the dashboard that computes the overview, a by-reason breakdown and time buckets from incoming events and returns them as aggregates.

What it does

overview, by-reason, time buckets

Inputs

events

Outputs

aggregates

Status and health registry for the dashboard covering 3 registered components and RSS, returned as JSON. It depends on the stores.

What it does

3 registered components, RSS

Outputs

JSON

Depends on

stores

Dashboard REST and SSE layer: 7 GET JSON routes plus /stream, which skips events under backpressure and counts them in qodiqa_dashboard_sse_backpressure_events_total. Requires VIEW_DASHBOARD with step-up.

What it does

7 GET JSON + /stream, backpressure skip

Inputs

HTTP

Outputs

JSON/SSE; qodiqa_dashboard_sse_backpressure_events_total

Depends on

bus

Safeguards

VIEW_DASHBOARD + step-up

Parses the dashboard retention settings in DASHBOARD_MAX_* as positive integers and turns them into caps, which bound the memory that the dashboard store can use.

What it does

positive-int parse

Inputs

DASHBOARD_MAX_*

Outputs

caps

Safeguards

memory bound

Times each request by stage using an AsyncLocalStorage record and a ring of 20,000, read back on loopback at /stages. Needs QODIQA_BENCH_STAGE_TIMING=true; loopback-only, and refused in production.

What it does

ALS record, 20,000 ring, loopback readout

Inputs

QODIQA_BENCH_STAGE_TIMING=true

Outputs

//stages

Depends on

async_hooks

State

ring buffer

Safeguards

loopback-only; prod refused

Caveat loopback-only; prod refused

Bench sampler that writes a JSONL line every 100 ms of pool and audit stats to the file named by QODIQA_BENCH_SAMPLER_PATH. Bench use only.

What it does

100 ms JSONL of pool/audit stats

Inputs

QODIQA_BENCH_SAMPLER_PATH

Outputs

file

Depends on

pool, audit-log

State

file

Safeguards

bench only

Caveat bench only

Admission control with an in-flight cap, a bounded queue and a timeout. Overload returns 503 SERVER_OVERLOADED with gauges and a WARN summary, failing fast before nonce consumption.

What it does

in-flight cap + bounded queue + timeout

Inputs

requests

Outputs

503 SERVER_OVERLOADED, gauges, WARN summary

Depends on

metrics

Safeguards

fail-fast before nonce consumption

Gates readiness on saturation and backlog through boolean checks, so the readiness check returns 503 when the audit modules report overload.

What it does

boolean checks

Outputs

503

Depends on

audit modules

Event-loop delay monitor, active in the gateway, built on perf_hooks. It publishes qodiqa_event_loop_delay_* metrics and an entry in the diagnostics output.

What it does

Active

Outputs

qodiqa_event_loop_delay_*, diag

Depends on

perf_hooks

Background task runner that runs tasks with a criticality level and a timeout, and reports its activity as qodiqa_background_task* metrics through the metrics registry.

What it does

criticality, timeout, metrics

Inputs

tasks

Outputs

qodiqa_background_task*

Depends on

metrics

Batch certification service that validates up to 100 items with a semaphore of 5 and a state machine, writing audit entries. State is memory only, the file store is unused; needs SUBMIT/READ/CANCEL permissions, admin stack and step-up.

What it does

validate ≤100 items; semaphore 5; state machine; audit entries

Inputs

POST /v1/certifications/batch

Outputs

batch results; audit log entries

Depends on

audit-log

State

memory only (file store unused)

Safeguards

permissions SUBMIT/READ/CANCEL; admin stack + step-up

Caveat memory only (file store unused)

Micro-benchmark framework with suites for crypto, runtime, policy, transparency, storage, memory, cpu and postgres. It runs from the CLI and writes JSON, MD and console reports to report files.

What it does

suites crypto/runtime/policy/transparency/storage/memory/cpu/post gres

Inputs

CLI

Outputs

JSON/MD/console reports

State

report files

Phase-56 harness scripts that run the real router with a harness, and depend on PG, Redis and Ollama. They are run from the CLI and store JSON.

What it does

real router + harness; PG/Redis-dependent

Inputs

CLI

Depends on

PG/Redis/Ollama

State

JSON

End-to-end measurement rig that boots the real server and runs a scenario by size matrix, writing evidence files to <sha>/. It uses the bootstrap helper and depends on PG and Redis.

What it does

boots real server; scenario×size matrix

Inputs

CLI

Outputs

<sha>/

Depends on

PG/Redis

State

evidence files

Safeguards

refuses nothing special; uses bootstrap helper

Reproduction harness that runs preflight, e2e:measure and then a comparison, giving pass or fail. It needs disposable PG and Redis and refuses ports 5432 and 6379.

CI load gate that runs the harness and compares against a baseline. It is report-only and UNARMED, outputs perf/ci, and needs PG and Redis in CI.

What it does

harness run + baseline compare (report-only, UNARMED)

Inputs

workflow

Outputs

perf/ci

Depends on

PG/Redis in CI

State

perf/*

Caveat report-only, UNARMED

Generates 3 Grafana dashboards and checks that every expression metric is registered, running promtool through Docker. Output is written as files, from the metric names.

What it does

generate 3 dashboards; check that every expression metric is registered; promtool via Docker

Inputs

metric names

Depends on

docker (promtool)

State

files

Prometheus alert rules, 70 plus 13 rules, shipped as manifests that are driven by the metrics. They depend on an external Prometheus to evaluate them.

What it does

70 + 13 rules

Inputs

metrics

Outputs

manifests

Depends on

external Prometheus

Repository documents covering benchmark, load and soak results, kept as files in the repository so the recorded numbers can be reviewed.