Observability

This file captures the §5 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

Observability is the first of the five structural prerequisites (ZTG-0a through ZTG-0e). It is drafted first because it is upstream of every later invariant: ZTG-1 boundary decisions, ZTG-2 Stasis events, ZTG-3 surface registry declarations, ZTG-4 evidence-coupled effects, and ZTG-5 harm-class provenance all presuppose that governance-relevant events are recorded with sufficient fidelity to be examined after the fact.

Operational Questions

Of the seven operational questions the framework answers, ZTG-0a is the substrate beneath two: replayability and evidence coupling. Neither is meaningful without it. A decision cannot be replayed (ZTG-0b) if the system did not record what it decided and against what inputs. An effect cannot be coupled to evidence (ZTG-4) if the evidence is not produced and retained in a form that survives examination. ZTG-0a does not itself deliver replayability or coupling; it establishes the recorded substrate those invariants operate on. It also conditions a third question — override visibility — because an override that is not observed cannot be attributed.

Normative

All governance-relevant events MUST be recorded with sufficient fidelity to support deterministic post-hoc audit. A governance-relevant event is any state transition, decision point, boundary check, policy evaluation, authorization grant, refusal, escalation, identity validation, time-source check, surface-routing decision, Stasis entry or exit, harm-class assignment, liability ceiling assignment, or evidence-record emission that bears on what the governed system was permitted to do, under what conditions, and with what accountability.

Observability in ZTG-0a is not logging in the ordinary operational sense. Operational logging serves debugging, performance analysis, and service health. Governance observability serves audit, replay, and attribution. A system may satisfy its operational logging needs completely and still fail ZTG-0a. The distinguishing requirement is decision-level reconstruction: for any governance-relevant event, the record MUST allow an authorized reviewer to reconstruct what was evaluated, under which policy version, by what identity, at what time, and with what result.

Governance-Relevant Events

The class of events that MUST be observable is defined by governance relevance, not by event volume or operational convenience. An implementation MUST be able to enumerate the governance-relevant event types its architecture can produce and demonstrate that each produces a record. At minimum the class includes: authorization requests; boundary evaluations and their verdicts; policy-version selection; identity validation; time-source checks; surface- and sub-surface routing decisions; Stasis entry, exit request, and exit ratification; harm-class and liability-ceiling assignment; evidence-record emission; input normalization; and any promotion of memory content into policy-relevant input.

Grants and refusals are equally governance-relevant. An architecture that records authorizations but not refusals does not satisfy ZTG-0a. Because the boundary's default disposition toward any model-derived action is refusal (ZTG-1), refusals are not an exceptional case to be sampled; they are the larger share of the boundary's decisions and the share most diagnostic of its behavior under pressure. Escalations MUST likewise be recorded, including the condition that triggered the escalation and the authority to which it was routed.

Fidelity Requirements

A governance record MUST carry enough information to reconstruct the decision it documents without recourse to the live system. This includes, at minimum: the event type; the invariant or prerequisite the event bears on; the policy version in effect; the identity exercising or requesting authority; the time of the event against a ZTG-0c-consistent time source; a representation of the inputs evaluated, sufficient for ZTG-0b replay; and the verdict or resulting state transition.

Aggregate operational metrics do not satisfy ZTG-0a. Counters, rates, and dashboard summaries report how many events of a kind occurred; they do not permit reconstruction of any individual decision. "How many actions were refused this hour" is not a substitute for "why was this action refused." Metrics are a permitted derived view computed downstream of the record substrate; they are never a substitute for it. A conforming system retains decision-level records and MAY compute metrics from them, not the reverse.

This requirement is a specific guard against constructed formalism: the substitution of a measurable proxy for the thing it was meant to preserve. Decision-level reconstruction is the thing; metrics are the proxy. ZTG-0a holds the line at the thing.

Completeness and Negative Space

Missing records are governance facts, not gaps in telemetry. An action path that produces a governed effect with no corresponding observable record is a violation of ZTG-0a, not merely a monitoring deficiency. Silence MUST NOT be read as evidence of normal operation.

This is the property that makes the rest of the framework auditable, and it depends on the recording of refusals established above. If a correct refusal leaves a record, then the absence of any record on an action path is distinguishable from a correct refusal, and absence can be treated as a violation. If refusals were unrecorded, silent bypass and correct refusal would be indistinguishable, and negative space would carry no information. A conforming implementation MUST treat the absence of an expected record as a detectable condition with defined consequences, rather than as ordinary missing data.

Record Integrity

Observability requires integrity, not merely emission. A record that can be altered or forged after the fact does not support audit; it supports a reconstruction the system cannot vouch for. ZTG-0a therefore requires that governance records be tamper-evident to a degree sufficient for auditability: unauthorized alteration, deletion, or insertion of a record MUST be detectable.

This integrity requirement is intrinsic to ZTG-0a and is not deferred to ZTG-4. ZTG-4 couples evidence to externally observable effects — it guarantees that an effect and its evidence stand or fall together. But many governance-relevant events produce no external effect: refusals, escalations, policy-version selection, identity validation. ZTG-4's effect-coupling does not reach these, yet ZTG-0a must keep their records trustworthy. Sourcing ZTG-0a's integrity from ZTG-4 would also invert the framework's dependency order, in which invariants depend on prerequisites and not the reverse. ZTG-0a owns record integrity; ZTG-4 owns the atomic binding of evidence to effect. The two cross-reference, and a conforming system satisfies both, but neither requirement is discharged by the other.

The integrity standard follows the introduction's load-bearing rule. A governance guarantee that rests on a forgeable record reduces to a probabilistic claim about whether the record is accurate. A cannot-have-been-altered property that reduces to probably-was-not is not an integrity property.

Privacy and Confidentiality

Operational evidence may contain sensitive data, and access to it may be restricted. Confidentiality controls MUST NOT compromise record integrity, completeness, or auditability. Confidentiality is an access-control property; it governs who may read a record. It is not a license to omit.

An implementation MAY store sensitive payloads in protected form — encrypted or vaulted, with access gated to authorized auditors — provided a cryptographic digest of the protected content is bound into the tamper-evident record so that the record's integrity and the payload's correspondence remain verifiable. Permitted: protection that restricts access while preserving recoverability and verifiability. Disallowed: redaction in the sense of omission, where an authorized auditor or a ZTG-0b replay can no longer reconstruct the decision.

Deletion of inputs that are load-bearing for ZTG-0b replay — for example, under a data-erasure obligation — sits at a genuine tension between confidentiality regimes and replayability. ZTG-0a requires that any such deletion is itself a recorded, attested governance event, so that a degraded record is a documented and attributable state rather than a silent gap. The full resolution of how erasure and replay fidelity compose belongs to ZTG-0b.

Conformance Criteria

A conforming implementation can: enumerate its governance-relevant event types and demonstrate record coverage for each; produce decision-level records for both grants and refusals, and for escalations; demonstrate that aggregate metrics are derived from, not substituted for, decision-level records; detect the absence of an expected record and treat it as a violation rather than missing telemetry; detect tampering with governance records; and demonstrate that confidentiality controls restrict access without defeating audit or replay reconstruction.

Further Considerations

Observation is not governance. Observability is a prerequisite for governance, not an instance of it. Recording an action does not bind it. Monitoring that reports what a system did, after it did it, is the retrospective posture the introduction identifies as inadequate for AI operating tempo (§1.2). ZTG-0a exists so that the binding decisions made at the boundary (ZTG-1) and the gates (ZTG-5) can be audited, replayed, and attributed — not so that observation can stand in for binding. A reviewer who can see everything and bind nothing is the failure mode this prerequisite serves to avoid, not the goal it serves to reach.

The cybernetic grounding. Observability is the framework's feedback channel, and cybernetics treats feedback as constitutive of regulation rather than additional to it. A controller acting on a system without feedback at the resolution of the variable it regulates is not regulating; it is operating open-loop and hoping. This is why decision-level fidelity, not aggregate metrics, is the conformance standard: a regulator fed only summary statistics has feedback at the wrong resolution for the decisions it must govern. Ashby's requisite variety makes the same point from the other side — a regulator must command variety at least equal to the disturbances it controls, and a record that collapses distinct decisions into a count has discarded exactly the variety the governance function needs. ZTG-0a specifies the feedback path that closes the loop the rest of the architecture depends on.

Auditability and institutional accountability. The introduction grounds governance in the continuous authority of a ratifying officer (§1.2). That authority is only reviewable if the system records how the officer's policies actually operated — which actions they admitted, which they refused, and under which version of policy. Without observability, institutional authority over an autonomous system is asserted but not attributable: there is no record connecting an outcome to the policy and identity that produced it. Observability is what makes the ratifying officer's authority an auditable fact rather than a nominal claim.

Dashboard sedation. High-level operational presentation can manufacture calm while unresolved governance conditions persist beneath it. A dashboard that renders refusals as a smooth low line, or aggregates escalations into a healthy green tile, can suppress operator urgency precisely when attention is most warranted. This is the constructed-formalism risk in operational dress: the comfort of the summary replaces the signal it was meant to convey. ZTG-0a's fidelity requirement is partly a defense against this — observability must preserve signal, not operator comfort — but the chapter does not specify operator interface behavior, which is a deployment concern.

Evidence volume and evidence confidentiality. Decision-level fidelity across every governance-relevant event produces large, and often sensitive, evidence stores. This is a real operational cost, and it is not a reason to weaken ZTG-0a. The framework does not soften a conformance requirement to fit institutions not yet ready to operate it. Volume is addressed by deployment-level retention, tiering, and storage architecture; sensitivity is addressed by the protect-don't-omit discipline above. Neither is addressed by recording less.

Relationship to replayability. Observability and replayability are co-required but distinct. Observability records what happened with enough fidelity to examine it; replayability (ZTG-0b) requires deterministic reconstruction of a decision from those records. Observability is necessary for replayability and does not guarantee it: a record can be complete and faithful and still fail to replay if the decision procedure was non-deterministic. ZTG-0a establishes the substrate; ZTG-0b establishes the reconstruction. The fidelity fields ZTG-0a requires — inputs sufficient for replay, policy version, time — are the interface between the two.

Observability of the observer. A governance record substrate is itself part of the governed system, and changes to it — retention policy changes, schema changes, access-grant changes to the evidence store — are governance-relevant. An implementation should determine whether and how operations on the observability substrate are themselves observed, and document the determination as part of conformance. This chapter does not fully specify the recursion; it flags it.

How We Do It

Constable implements ZTG-0a as an append-only governance evidence substrate that every governance-relevant component writes to, structurally separated from the agent runtime so that the recorded subject cannot edit the record.

Authorization and Effect Record. Constable records governance events into a monotonic evidence substrate. Each record carries event type, the invariant or prerequisite tag it bears on, policy version, identity, a ZTG-0c-consistent timestamp, an input digest, the output verdict, residual-harm and liability-ceiling fields where ZTG-5 applies, and correlation identifiers linking the records of a single authorization across components. The input digest, rather than raw input, is what binds into the chain by default; protected payloads are stored separately and referenced by digest, satisfying the protect-don't-omit discipline.

Event taxonomy. Constable's governance event types include, at minimum: AUTHORIZATION_REQUESTED, BOUNDARY_EVALUATED, AUTHORIZATION_GRANTED, AUTHORIZATION_REFUSED, AUTHORIZATION_ESCALATED, POLICY_VERSION_SELECTED, IDENTITY_VALIDATED, TIME_SOURCE_CHECKED, SURFACE_ROUTE_SELECTED, STASIS_ENTERED, STASIS_EXIT_REQUESTED, STASIS_EXIT_RATIFIED, EVIDENCE_APPENDED, EFFECT_DISPATCHED, HARM_CLASS_ASSIGNED, LIABILITY_CEILING_ASSIGNED, INPUT_NORMALIZED, and MEMORY_PROMOTION_REFERENCED. The taxonomy is maintained so that every action path through the gate maps to a coverage expectation, making negative space testable.

Monotonic Logger integration. The substrate is an append-only, tamper-evident record chain. Records are hash-linked so that alteration, deletion, or insertion is detectable, satisfying ZTG-0a's intrinsic integrity requirement independently of ZTG-4's effect-coupling. High-consequence events — Irreversible-class and over-threshold authorizations per ZTG-5 — are written as critical-class records. The Logger's integrity is a ZTG-0a property; its atomic coupling of an effect to its evidence, where an effect occurs, is the ZTG-4 property. Constable satisfies both through the same substrate but does not conflate the requirements.

Airlock and Memoria signals. Airlock emits input-normalization evidence (INPUT_NORMALIZED) so that the inputs a policy evaluated are reconstructable. Memoria emits promotion evidence (MEMORY_PROMOTION_REFERENCED) whenever memory content becomes policy-relevant input, preserving the ZTG-1 requirement that memory-to-policy elevation occur through explicit, attested promotion rather than implicit interpretation — and making that elevation observable.

Operator views. HumanSeal surfaces observability to operators. The UI is constructed to avoid converting unresolved conditions into ambient calm: escalations and refusals under pressure are surfaced rather than aggregated away. Operator presentation is derived from the decision-level substrate; it is never the system of record.

Conformance tests. Constable's internal testing for ZTG-0a includes: event-coverage tests asserting every action path produces its expected records; negative-path tests asserting refusals and escalations are recorded with reconstruction-sufficient fidelity; tamper tests asserting that altered, deleted, or inserted records are detected; gap tests asserting that a missing expected record triggers violation handling rather than passing silently; and metric-derivation tests asserting that operator metrics are computed from, and reconcile against, the decision-level records. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• Tamper-evidence revises the prior recommendation. The next-chapter-recommendation.md stance framed integrity as cross-referenced to ZTG-4; this draft assigns intrinsic integrity to ZTG-0a and confines ZTG-4 to effect-coupling. Decision recorded in planning/ztg-0a-resolved-assumptions.md. The ZTG-4 chapter, when drafted, should be written to this division and not reclaim integrity.
• Erasure↔replay tension is named, not resolved. ZTG-0a requires deletion of replay-load-bearing input to be a recorded, attested event; the full composition of data-erasure obligations with ZTG-0b replay fidelity is left to the ZTG-0b chapter. Flag for ZTG-0b.
• Observability of the observer (recursion: governance of the evidence substrate itself) is flagged in Further Considerations but not specified. May warrant a normative line here or a cross-reference once ZTG-0e (Governance Consistency) is drafted.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.