Oculus
Follow the traces until the light gives out.
A stalled Run leaves several questions: what was admitted, what was observed, and where did the account go dark? Oculus is the designed native observability Extension Domain for following those questions across run state, consent, tool use, runtime readiness, effects and outcome. Its first journey follows one authorized Invocation, represented by a Run. A later bounded field may relate several authorized Runs; their own offices retain authority over them.
Designed sight and the present Orb
Use the current Orb to inspect the evidence available today. Its Partial, read-only Altar projection offers a bounded Run catalogue, a parallel field with at most three live lenses of 100 records each, and a separate route into one exact Run. Loaded counts describe the account on screen, not complete history; capture limits and gaps remain visible. State of Work records that delivery.
Native Oculus remains Designed. The Orb has no native Oculus ingestion or durable query/read model behind it. State of Work keeps that remaining boundary, and ADR 29 owns the evidence contract below.
Meanings of evidence
| Kind | What it can establish |
|---|---|
| Authoritative record | A transition or attempted effect, written by the responsible office |
| Bounded observation | What one source saw, with method, time, quality, freshness, and known limits |
| Derivation | What named parent evidence yields through a versioned transformation, with limits and uncertainty |
| Interpretation or verdict | What declared criteria support through Drift or another named judging office |
Correlation locates related evidence; it does not prove causation or make a payload true. A projection is rebuildable and cannot supplant the records whose facts it presents.
Today, useful evidence is divided among owning records, a best-effort non-token Step trail, and a process-local live event channel. Token deltas are not retained as structural evidence, and failed Step persistence can leave gaps. A native read model must join these sources while keeping their different authority and loss visible.
Future physical evidence begins at the node that measured it. The Orchestrator consumes fresh node-local evidence through its admission contract; Oculus may retain the same observation for explanation. A stale or failed probe means unknown, never free capacity.
Three Chambers of Interior Evidence
- First-person testimony records what an Agent or model reports from one bounded context, including uncertainty or reservation.
- Activation interpretation applies a declared lens or intervention whose model, method, controls, limits, and uncertainty remain visible.
- Operated telemetry records events, usage, waits, pressure, failures, effects, and outcomes.
Oculus may hold all three without flattening their different ways of knowing. Drift owns causal tests and rival explanations; Immortality keeps first-person realization distinct from external evidence of the binding.
Capture, loss, and privacy
Structure-only capture is a minimum discipline, not a promise of harmlessness. Raw content, provider or tool bodies, and identity-bearing material require explicit authority and capture policy. Secrets are rejected at the producer boundary. Redaction precedes serialization, and external export passes through a second filter.
Retention is declared by evidence class and subject. Removing an observation cannot erase an owning Run fact or effect receipt. A conforming path bounds queues and cardinality, batches deliberately, flushes within a shutdown budget, and makes overload or loss visible as a gap. Today's live Run replay and each subscriber queue are bounded at 256 events. A stalled subscriber receives an explicit snapshot-resync boundary when its pending deltas overflow; the producer does not wait for that reader. This channel behavior does not supply the future Oculus ingestion, retention, or shutdown contract.
External Eyes
An external Eye, in the observability sense, sits behind a versioned, one-way adapter. Phoenix, Logfire, or OpenTelemetry tooling may receive an allowlisted, redacted, purpose-bound export; it receives no LychD database role or identity, consent, lifecycle, or control authority, and has no canonical read-back. Incoming trace context may correlate an authenticated request, but cannot authenticate or authorize it.
The current optional Phoenix contribution is External and has no proved application export path. State records its exact boundary.
Seeing never commands
Orb inspection is read-only. Any action crosses to its owning service, which rechecks authority and records its own decision.