Data flow · 15 of 19 · Flight recorder

Flight recorder: reuse the telemetry, add one tamper-evident chain

Almost all of this already exists. The additions are one field, task_id, carried on every record from every agent type, and one chain for the audit events that is tamper-evident, not just searchable. Model calls are audited with the same id as tool calls.

Flight recorder: reuse the telemetry, add one tamper-evident chain Data flow from four sources, Clearance audit, Glidepath, ArgoCD and git, through the existing otel-collector into Loki, Tempo and Prometheus with the dora-exporter, and into Tower, while Clearance audit events are also hash-chained into WORM storage and anchored in the self-hosted Rekor. One task_id on every record.HASH-CHAINEDOTLPANNOTATIONQUERYPR LABELS + TRAILERSClearance + proxytool and LLM auditGlidepathCDEvents · OTel spansArgoCDApplication annotationsGittrailer + PR labelotel-collectorexists todayPrometheusdora-exporter · authorWORM + Rekortamper-evidentLoki · Tempologs · tracesTowerRelease Record · Agent tabLEGENDNewExists todayEvidence chainTelemetry

Principle honored

Live-verified reuse over new mechanism. The dora-exporter already correlates by annotations rather than CDEvents, because CDEvents cannot confirm a deploy happened.

What changes

  • hangar.io/task on commits (trailer), PRs (label) and Application annotations, alongside the hangar.io/* labels every component already propagates.
  • dora-exporter emits its four metrics with an author=agent|human label, so agent change failure rate reads against a human baseline.
  • Audit events hash-chain; periodic checkpoints go to WORM storage and to the self-hosted Rekor (ADR-0014).

Decide first

Proposal, not built: MinIO object lock needs enabling when the bucket is created, so decide before creating the audit bucket. Loki alone is searchable but not tamper-evident, which is why the second chain exists.

Hangar · Autopilot