[aruokhai]

Adds enclave:telemetry (wit/telemetry/telemetry.wit), a host interface a guest imports to report spans, events and metrics. Spans and events go to AWS X-Ray. Metrics go to CloudWatch through PutMetricData.

What a guest gets

• tracing
  • event(level, message, fields)
  • A span resource. Spans nest by the order the guest opens them, and close on end() or on drop.
• metrics
  • counter-add and gauge-set
  • histogram-record, sent as CloudWatch's values/counts distribution
• No function takes a tenant id. The runtime attributes everything to the tenant it already authenticated, as with tasks, notify and streams.
• When telemetry is switched off, calls still succeed and do less. Events and closed spans are always mirrored to the console under the guest target.

How it works

• One trace per invocation. A request, task run or stream message becomes one X-Ray trace. Its root is annotated with tenant and invocation, which X-Ray indexes. Spans become subsegments, and events and fields go in metadata.
• The trace ships when the store drops. That covers every exit, timeouts and traps included, so no call site has to remember to flush.
• Metrics are aggregated, not queued. Each 30 s window is summed, keeps the last value, or keeps the distribution. Nothing is sent for an empty window. The runtime adds no tenant dimension.
• Host calls are synchronous and never touch the network.
  • Two forwarders are shaped like the guest-log forwarder: a bounded queue, batches, two backed-off retries, and drops counted and reported once a minute.
  • Anything X-Ray or CloudWatch would refuse is dropped or shed when it is recorded, instead of failing a whole request. Examples are an out-of-range value, a repeated dimension, or a trace document over 64 KiB.
• Hand-wired, like the other interfaces (no bindgen), including the span resource.
• Deployment
  • deployment.nix gains xray and metricsNamespace. They are measured into PCR0, and their or defaults keep an older deployment.nix building to the same derivation.
  • deploy/tofu gains a telemetry variable that grants xray:PutTraceSegments and cloudwatch:PutMetricData, the latter limited to the one namespace. Nothing is granted when telemetry is off.
• Dependencies: aws-sdk-xray 1.109 and aws-sdk-cloudwatch 1.127 are the releases that match the locked smithy runtime, so no existing crate moves.

See docs/TELEMETRY.md for limits, delivery, and exactly what leaves the enclave.

Testing

• scripts/ci-check.sh is green: rustfmt, clippy -D warnings, 414 lib tests (16 of them new), bin, and boot_origin.
• tests/telemetry.rs serves the example guest's new /telemetry route through the real linker, with X-Ray and CloudWatch replaced by in-memory destinations. It checks attribution, nesting, fields, events, timings, metric aggregation and units. This is what proves the hand-wired ABI matches what wit-bindgen generates.
• Every suite that serves the example guests passes with --include-ignored. That is guest_logs, harness, serve_auth, serve_guest, serve_h2, serve_tls, serve_grpc and serve_grpc_wire.
• scripts/wit-drift.sh is clean. tofu validate and tofu fmt are clean.

Not covered

• No run against real X-Ray or CloudWatch, and none against an emulator stand-in such as LocalStack.
• No sampling: every invocation is traced. At $5 per million traces, with 100k free each month, it isn't needed yet.

🤖 Generated with Claude Code