Observability and telemetry

AxiomCore has two different telemetry surfaces. Runtime observability carries application execution evidence for a project. CLI adoption telemetry reports a small operational event about use of the CLI. They have different data, credentials, configuration, and retention paths.

Runtime observability

The connected project can create an OTLP source and produce an Acore observability configuration with a scoped ingestion endpoint and x-axiom-telemetry-dsn. Store that DSN as a secret and rotate or revoke it through the project controls.

observability {
  enabled = true
  telemetryUrl = "https://collector.example.com/v1/traces"
  sampleRate = 0.1
  headers = Mapping {
    ["x-axiom-telemetry-dsn"] = "<scoped-write-credential>"
  }
}

Use the exact endpoint and scoped credential issued by the project connection flow. Keep source containing that credential private, do not paste it into public examples or logs, and revoke the source after exposure.

The runtime can link native work to an incoming W3C traceparent. Export and sampling depend on the selected runtime configuration. Confirm ingestion with a known request before relying on the dashboard for incident response.

The dashboard exposes project summaries, trace detail, traffic, logs, speed insights, alert policies/events, and a contract-derived security posture. An empty view means no retained evidence matched the query; it is not proof that the application performed no work.

CLI adoption telemetry

Where the alpha access profile enables it, the CLI sends a bounded event after a command:

The client intentionally excludes file paths, URLs, credentials, project or contract names, query parameters, raw arguments, and raw error messages from this payload. Delivery has a short timeout and does not turn runtime trace data into CLI telemetry.

Disable this adoption event for the current process or environment with:

AXIOM_TELEMETRY=0 axiom build

The values false and off are also recognized in their documented casing. An access-revocation response belongs to the private-alpha access profile and can clear that profile; it should not be described as an observability retention or project-data deletion feature.

Operational checklist

1. classify the event as runtime observability, audit activity, or CLI adoption telemetry before assigning retention or access policy;
2. use scoped ingestion credentials and rotate them after exposure;
3. sample deliberately and test browser CORS for Wasm export;
4. avoid logging authorization headers, sandbox keys, request bodies, or sensitive cache payloads; and
5. test alert delivery separately from trace ingestion.