Metrics, traces, logs, topology, releases, and evidence share the same identity and timeline.
ARCHITECTURE / WHY IT MATTERS
How telemetry becomes an explanation.
DriftStore keeps every signal connected from the moment it arrives. That lets an anomaly move naturally into supporting traces, logs, topology, changes, and a conclusion you can inspect.
Storage work and investigation work happen away from the application’s write path.
Every investigation records the exact data window and evidence used to reach its conclusion.
Missing coverage and contradictory evidence lower the claim—or produce no conclusion at all.
END-TO-END DATA FLOW
Send telemetry once. Use it as one connected history.
DriftStore accepts standard telemetry, keeps the application-facing path short, and prepares the cross-signal views investigations need in the background.
OTLPgRPCagentsCI / Git
- tenant safe
- retry safe
- bounded load
metricstrace shapeslogstopologychanges
CONSISTENT SNAPSHOTEvery signal becomes visible together
ready to investigateQuery each signal without losing its context.
Facts, claims, contradictions, coverage, and provenance.
Move older data to economical storage without breaking investigations.
WHY ONE ENGINE
Correlation is easier when it is part of storage—not added later.
Connect it during the incident
- align labels and time windows by hand
- carry trace and release identity between tools
- write custom joins and investigation prompts
- decide whether missing data changed the answer
Keep the evidence connected
- shared service, trace, release, and time identity
- topology that reflects the investigated window
- native movement from anomaly to witnesses
- coverage and contradictions preserved with the result
The advantage is not merely operating fewer databases. The investigation can ask questions the storage model was designed to answer.
INVESTIGATION PATH
The explanation is computed before it is narrated.
The deterministic engine owns measurements, candidate explanations, falsifiers, grades, and abstention. An LLM can verbalize the approved result, but cannot add evidence or upgrade a claim.
Detect
Localize a change interval from metric semantics—not an arbitrary clock window.
Plan
Choose matched baseline and current windows; record coverage and traffic composition.
Explain
Join metric cells to trace shape, topology, logs, releases, and code changes.
Falsify
Test healthy controls, unaffected cohorts, stronger competitors, and contradictions.
Grade
Observed, corroborated, explanatory, recommended—or insufficient.
Narrate
Generate cited sentences from the approved claim graph and verify every atom.
SCALE & RELIABILITY
Ingest, storage, and investigation scale independently.
Heavy queries do not sit in the write path. Busy tenants are isolated. Recent data stays fast, older data becomes economical, and every investigation reads one stable view.
SHARED TELEMETRY HISTORYrecent · compacted · archived
The same investigation semantics survive every storage tier.
interactive queriescontinuous detectiondeep investigations
FAILURE SEMANTICS
What happens when something breaks?
An ingest process restarts+
Acknowledged telemetry remains durable, exact retries do not create duplicates, and recovery resumes from the last complete record.
Background storage work is interrupted+
Partially prepared data never becomes visible. Work resumes without creating a half-updated investigation view.
One tenant sends a burst+
Bounded queues and tenant isolation prevent one workload from consuming unlimited memory or monopolizing ingestion.
New data arrives during a query+
The running query remains on one stable snapshot, so its metrics, traces, and logs cannot disagree about what existed.
Missing evidence+
Coverage caps the claim grade. A disqualifying contradiction forces abstention.
THE RESULT