A span becomes a receipt.
Mark a decision in OpenTelemetry. See which fields enter the ledger, then follow the record to its minute seal.
Checking the local credential bridge…
Public sample span
Edit synthetic codes only. This sample also contains one unmarked span to show the drop counter.
No prompts, message text, personal identifiers or credentials. Unknown fields are refused in this browser demo.
Mapped public record
Preparing the synthetic sample…
- Decision
- Not available
- Subject
- Not available
- Trace / span
- Not available
- Raw source
- Selected span bytes, encrypted under its subject key.
Inspect mapped fields
{}Preview codes are illustrative. The server derives public codes with a tenant key; its receipt contains the committed values.
Follow the actual acknowledgement
Record a sample to obtain its actual ledger ID. Exact byte retries return the original record without using more quota.
Open recorded receiptMapping 0.1, field by field
The first accepted export pins this tenant to 0.1. Duplicate attribute keys and conflicting resource/span sources fail closed. ADR fields remain provisional while the D-002 conformance review is pending.
| OpenTelemetry field | Recourse field | Rule |
|---|---|---|
| adr.decision | Selection | Only the boolean true creates a record. Missing, false and string values are counted as dropped. |
| traceId / spanId | trace_id / span_id | Exact nonzero identifiers; hex letter case normalizes to lowercase. |
| startTimeUnixNano | occurred_at | Nanoseconds become UTC milliseconds. Exact source bytes remain in the encrypted span attachment. |
| adr.subject_id | subject_id | Explicit opaque subject code. If absent: trace_ plus trace ID, without inferring an identity. |
| adr.actor_id or service.name | actor.id | Span or resource value becomes a tenant-keyed opaque code. Actor type defaults to agent. |
| adr.action or gen_ai.operation.name | decision.action | Tenant-keyed opaque code. Unspecified operations use an opaque unknown code. |
| adr.outcome | decision.outcome | allow, deny, defer, error or abstain; unknown and missing values become other. |
| gen_ai.provider.name / gen_ai.system | model.provider | Modern or legacy provider value becomes an opaque code. Supplying both is ambiguous and rejected. |
| gen_ai.response.model / gen_ai.request.model | model.name | Response model takes priority; falls back to request model. Values become opaque codes. |
| gen_ai.model.version | model.version | Opaque version code; missing version gets an opaque unspecified code. |
| Selected span bytes | Encrypted raw attachment | Exact selected span plus derived mapping context, encrypted under that subject key. Shared resource/scope bytes and sibling spans are excluded. |
| Prompts, messages, events and context | Private archive only | Never mapped to public metadata. The browser demo accepts public synthetic fields only. |
Connect your Collector
Use the OTLP/HTTP exporter with a base endpoint. Add otlphttp/recourse to your traces pipeline and supply tenant authentication from the Collector environment.
The sample is a local configuration for review. No live export has been run. Compressed requests are not supported in R0.
Follow the record, then check the proof.
Received means the request was acknowledged. Acknowledged is not durable. Durable means persisted in the configured store. Sealed means included in a signed root with a receipt.
Searchable-through: Searchable-through is not available. No search index is connected, and this watermark is never inferred from ledger state. It is a retrieval index position, not a durability state.
A missing record sequence is reported here, never skipped. When reconciliation finds a hole, the Received, Durable and Sealed watermarks stop at the last unbroken sequence.
Development signer means integrity under a published dev key and no independently trusted time.