The repository has one telemetry seam: every binary calls telemetry::init. With the complete OpenObserve environment
contract it exports OTLP directly to the selected organization and stream; dev and CI fall back to human-readable
stdout. The interesting part is not the exporter. The interesting part is the trust boundary. A notation_id, a
workflow service name, an outcome, a duration, a status code — yes. A client name, an answer body, an email address, a
document body — never. The Rust code keeps request bodies out of spans in the first place, and every production stream
must enforce the same allow-list at its boundary.
The analytics story follows the same pattern. Operational telemetry goes directly to OpenObserve. Matter data is
archived separately by the nightly Restate Archives workflow: Postgres snapshots become Parquet through arrow and
parquet. The separately tracked Iceberg work must land with a restore drill before we call this an open table format.
The ecosystem point is simple: the boundary is written down, enforced, and testable.