Point One Zero Platform architecturev11 · generated viewSign in to edit
Engineering Standards › Observability & logging

Observability & logging

If it is not traced, it did not happen. An agent run that cannot be replayed cannot be debugged, costed, or defended to a client. The standard is vendor-neutral by construction: emit OpenTelemetry with the GenAI semantic conventions, and treat the backend as a swappable choice rather than the thing your instrumentation is written against.

Why the convention matters more than the tool

Every observability product arrived with its own tracing format, and choosing one used to mean rewriting instrumentation to leave it. The OpenTelemetry GenAI semantic conventions standardise the vocabulary, span names, model attributes, token counts, tool calls, agent steps, so the same emitted telemetry can be read by Langfuse, Phoenix, Tempo, Jaeger or a cloud vendor's backend without touching application code. The conventions are still evolving, which is an argument for emitting them through a shared module rather than by hand.

LayerWhat is emittedWhy
Agent spanOne root span per run: use case, tenant, agent name, run contract, outcome, total cost.The unit a human reviews and a client is billed for.
Model call spansProvider, model ID, temperature, input tokens, output tokens, cached tokens, latency, finish reason.Cost and latency attribution to the exact call, not the whole run.
Tool call spansTool name, namespaced source, arguments schema, result size, error class, retry count.Most agent failures are tool failures wearing a model's voice.
Retrieval spansStore, query, filters, number of chunks, scores, which store answered.The difference between a hallucination and a retrieval miss is visible only here.
Evaluation scoresJudge scores attached to the trace they grade, with rubric and judge versions.Quality becomes queryable next to cost and latency instead of living in a separate spreadsheet.
Structured run logOne JSON line per run mirroring the root span, written regardless of backend availability.Telemetry pipelines fail; the ledger must not.

Content capture and the privacy line

  1. Traces are content-blind by default. Prompt and completion bodies are off unless explicitly enabled for a named environment, and never enabled for a tenant whose data-rights clause forbids it.
  2. Redact at the SDK boundary, not at the dashboard. Anything that leaves the process has already been filtered; a redaction rule that lives in the viewer is not a control.
  3. Tenant ID on every span, always. It is the attribute that makes isolation auditable and per-client cost real.
  4. Sample deliberately. Full capture in development and on evaluation runs; head or tail sampling in production, with errors always kept.
  5. Traces are business-blind. The harness records that a run happened, what it cost and whether it passed, not what the deal was worth.

What the dashboards must answer without a code change

Cost per run, per use case, per tenant, and the trend over the last thirty days.
Cache hit rate per route, the single number that explains most unexpected spend.
p50, p95 and p99 latency by route and model, not averaged across everything.
Tool error rate by tool and source, with the top failing arguments.
Quality scores over time per rubric dimension, against the release that changed them.
Token budget breaches, which runs hit the ceiling and were killed, and what they were doing.

Backend choice is an environment-layer decision, not an application one: Langfuse for LLM-native tracing with prompt management and scoring built in, Phoenix where evaluation and experimentation sit closest to the traces, Tempo or Jaeger where the AI stack must sit inside an existing SRE estate. All three read the same emitted conventions, which is the entire point.