Value-free telemetry emission. Provides the metadata allowlist for "no row values
and no passwords in telemetry" (Rule 1): event/3 routes
through validate!/1, which raises on any key outside the allowlist, so a stray row
value or password cannot ride a payload emitted through this module.
Only structural metadata — GTIDs, schema / table names, DDL kinds, atom reasons, server identity, TLS posture, and server-reported missing GTIDs — is permitted.
Scope (C1): this is the pipeline's sole telemetry emit path. Every emitter in
Capstan.Connection and Capstan.AssemblerServer routes through event/3 (Rule-1
completion), so the allowlist gates them at runtime — a future emitter attaching a
row value or password raises rather than shipping it. The complementary test-time
guarantee is the Capstan.ValueFree helper, which scans the log and telemetry channels
(and, for the live vectors, the delivered sink outputs) for a planted sentinel across
every delivered and error/halt path.
Mirrors replicant/lib/replicant/telemetry.ex.
Summary
Functions
The permitted telemetry measurement keys (counts and monotonic durations).
The permitted telemetry metadata keys.
Emit a telemetry event with allowlist-validated metadata and measurements.
Functions
@spec allowed_measurement_keys() :: [atom()]
The permitted telemetry measurement keys (counts and monotonic durations).
@spec allowed_meta_keys() :: [atom()]
The permitted telemetry metadata keys.
Emit a telemetry event with allowlist-validated metadata and measurements.
Raises ArgumentError if meta carries any key outside allowed_meta_keys/0, if a
measurement key is outside allowed_measurement_keys/0, or if a measurement value is
not a non-negative number — the fail-closed points that keep a value off a payload on
both channels. The refusals name the offending KEYS only, never the values.