# Observability and history Observability describes what was measured. History records attributable causal facts. Neither automatically proves that a system is correct. ## One observation envelope Logs, metrics, traces, profiles, audits, lineage, health, and cost signals share an envelope for subject, schema, time, causality, provenance, classification, sampling, retention, and trust. Backends and dashboards are replaceable physical views. Signal design is part of the contract. Cardinality, collection overhead, redaction, privacy, clock uncertainty, aggregation, and sampling are planned before deployment. A troubleshooting query cannot silently widen collection or retention. ## Correlation follows owned identities An operation, attempt, effect, workflow, resource, provider binding, artifact, plan, deployment action, and tenant retain distinct identities. Observation context links them without collapsing them into one generic trace ID. Cross-process propagation carries only the admitted, integrity-protected context required by the selected boundary. Untrusted metadata cannot forge an authority or causal relationship. ## Facts are assertions with provenance A historical fact proves that an identified principal asserted a typed payload through an identified collection path. Verification facts can corroborate, verify, or reject that assertion at a later cursor. Verification never rewrites the original fact. Corrections append superseding or invalidating facts. Current state is a disposable materialization over retained facts, verification policy, and evidence. ## Evidence phases remain separate For operational work, One distinguishes: 1. a projection or export was produced; 2. bytes entered a repository or provider request; 3. an identified principal submitted the action; 4. the provider accepted or changed named objects; 5. observations satisfied semantic postconditions. No earlier phase implies a later one. Independent observation is stronger than asking the mutating adapter whether its own action succeeded, but every source retains its declared trust and freshness. ## Replay states its limits Pure planning can reproduce from canonical inputs. A workflow can replay compatible decisions from history. State can rebuild from retained facts and snapshots. Simulation can replace external effects with modeled providers. Operational reenactment is always a new reviewed plan against current reality. One never executes an old external effect merely to recreate the past. ## Privacy survives long history Sensitive payloads and subject mappings can be separately protected, retained, or erased while causal headers preserve permitted evidence. Erasure produces an attributable tombstone and cannot leave a public commitment that enables re-identification. ## Example Illustrative inspection follows causality without flattening external evidence: ```console one inspect invocation:sha256:… --observations one inspect invocation:sha256:… --history one inspect history:fact-set:sha256:… --replay ``` Follow [Correlate observations and causal history](/one/examples/observability-history). Canonical owners: [Observability](https://github.com/muijf/one/blob/main/systems/observability/AGENTS.md) and [History](https://github.com/muijf/one/blob/main/systems/history/AGENTS.md).