Signals
The three telemetry signals — logs, traces, and metrics— arrive over OTLP and are stored in Elasticsearch's native OTel data streams. Every read is org-scoped twice over (by index namespace and by an explicit tenant filter) and answered through one filter vocabulary: a window plus service, severity/status, free-text q, and trace/span ids. A filter that ships does so across the API, the console, and MCP at once — so an agent sees exactly what the Explore page does.
Tenancy
Multi-tenancy is by org_id, resolved from your authenticated identity and never from the URL. Three auth lanes reach the same data: a session token for the console, API keys for programmatic access, and OAuth 2.1 access tokens for agents. No endpoint takes an org parameter — the identity carries it.
The entity graph
Services observed in your telemetry become entities, and the calls between them become edges. Edge direction is dependency: an entity depends on the ones it points to. That lets byteshift walk blast radius — trace backwards from a failing component to everything that leans on it — which is how a single trip becomes a ranked, scoped incident instead of a wall of alerts.
Monitors
Monitors are standing checks with a shared base and a typed config per kind: threshold, error_rate, heartbeat, log_match, and synthetic. They evaluate through the same telemetry filters you query with, so a zero match is a real zero — absence checks work. A trip feeds an incident; every run stores the exact query and result for evidence.
Incidents
An incident assembles from the graph: a monitor trip anchors to a source entity, pulls in the affected entities along its blast radius, and either joins a live, graph-connected incident or opens a new one. Severity starts from the monitor and is escalated by criticality-weighted blast radius. The timeline is append-only, and it auto-resolves once every feeding monitor has been green long enough.
The cost ledger
Dollars are a ledger, not telemetry. Billing restates and reconciles — nightly estimates get replaced in place by final invoice figures — so cost lives in Postgres, FOCUS-shaped, upserted by (org, dedupe_key). That is why cost is billed-first: the headline is real ledger money, and any self-reported estimate is clearly labelled as a supplement for the cuts a bill can't attribute.
How it fits together
Send signals, and the graph forms from them. Monitors watch the graph and trip into incidents; incidents carry their evidence and blast radius. Cost rides alongside as a reconciled ledger. Every one of these is readable through the API, the console, and the MCP server — the same data, three ways in.