Telemetry Collection Design

Objective

Finalize and validate the thesis telemetry collection contract across Tracks A, B, and C before experiment entities are provisioned and baseline collection begins.

Why this matters

Every later result depends on the telemetry contract being defensible, loss-aware, privacy-conscious, and reproducible. Freezing the collection design first prevents the dataset and experiments from being built on an unstable measurement surface.

Design considerations

• Track A: behavior-plane coverage favors broad modifications and narrow high-volume reads rather than collecting every syscall.
• Track B: explicitly decide whether periodic magnitude/rate counters are collected now or deferred before the corpus opens.
• Track C: keep semantic auth/DNS context separate from the kernel stream while preserving a common entity/time envelope.
• Validate lineage and entity identity, source-side secret redaction, real hook liveness, loss counters, archive integrity, and measured collection overhead.
• No sampling is introduced into the thesis collection path; freeze criteria are based on measured runtime behavior rather than static attachability alone.

Key decisions

• ADR-0057 — Track A: kernel behavioral event stream
• ADR-0058 — Track B: periodic magnitude/rate stream
• ADR-0059 — Track C: semantic telemetry stream