Metric catalog

Every CommonLayer metric is declared once in commonlayer_observability::metrics::catalog. Labels are low-cardinality enumerations; route is the matched route template and project is a project slug (bounded and curated). Durations are in seconds, sizes in bytes, money in integer minor units.

Source tells where a metric is produced: event metrics are recorded where the event happens (api and worker); business gauges are computed from the database by the scheduler every observability.business_gauges_interval_secs and exposed only by the scheduler; process metrics describe the exposing process itself.

Process and transport

Metric	Type	Unit	Labels	Source	Description
`commonlayer_build_info`	gauge	info	`version`, `commit`, `process`	process	Build information of the running process; the value is always 1.
`commonlayer_http_requests_total`	counter	requests	`method`, `route`, `status`	event	HTTP requests served, by matched route template and status code.
`commonlayer_http_request_duration_seconds`	histogram	seconds	`method`, `route`	event	Time from receiving a request to sending the response headers.
`commonlayer_http_requests_in_flight`	gauge	requests	—	process	HTTP requests currently being handled.
`commonlayer_http_response_size_bytes`	histogram	bytes	`route`	event	Size of HTTP response bodies when known from Content-Length.
`commonlayer_grpc_requests_total`	counter	requests	`service`, `method`, `code`	event	gRPC calls served, by service, method and status code.
`commonlayer_grpc_request_duration_seconds`	histogram	seconds	`service`, `method`	event	Duration of gRPC calls.
`commonlayer_outbound_requests_total`	counter	requests	`target`, `outcome`	event	Outbound HTTP requests by fixed adapter name (github, osv, nvd, epss, kev, stripe, registry_source, registry_commonlayer, smtp, webhook, oidc) and outcome.
`commonlayer_outbound_request_duration_seconds`	histogram	seconds	`target`	event	Duration of outbound HTTP requests.
`commonlayer_db_pool_connections`	gauge	connections	`state`	process	Database pool connections by state (idle, used, max).
`commonlayer_db_pool_acquire_duration_seconds`	histogram	seconds	—	event	Time spent waiting for a database connection.
`commonlayer_db_migrations_version`	gauge	version	—	process	Highest applied database migration version.
`commonlayer_db_privileged_connection`	gauge	info	—	process	1 when the process's runtime database connection is a superuser or owns schema objects (it could disable the ledger and audit triggers; threat model O1), else 0.

Authentication and authorization

Metric	Type	Unit	Labels	Source	Description
`commonlayer_auth_logins_total`	counter	events	`method`, `outcome`	event	Login attempts by method (password, github, oidc) and outcome.
`commonlayer_auth_registrations_total`	counter	events	`outcome`	event	Account registrations by outcome.
`commonlayer_auth_token_authentications_total`	counter	events	`kind`, `outcome`	event	Bearer authentications by kind (api_token, actions_oidc, registry) and outcome.
`commonlayer_auth_sessions_active`	gauge	sessions	—	business	Sessions that are neither expired nor revoked.
`commonlayer_authz_decisions_total`	counter	events	`permission`, `outcome`	event	Authorization decisions of Actor::require by permission and outcome (allowed, denied).
`commonlayer_csrf_rejections_total`	counter	requests	—	event	Requests rejected by the CSRF check.
`commonlayer_rate_limited_total`	counter	requests	`bucket`	event	Requests rejected by a rate-limit bucket.
`commonlayer_rate_limiter_fallbacks_total`	counter	requests	`bucket`	event	Rate-limit decisions taken by the per-process in-memory limiter because the shared limiter (Valkey) failed (threat model O3).

Jobs, events and scheduler

Metric	Type	Unit	Labels	Source	Description
`commonlayer_jobs_enqueued_total`	counter	jobs	`kind`	event	Jobs enqueued (duplicates suppressed by a unique key are not counted).
`commonlayer_jobs_finished_total`	counter	jobs	`kind`, `outcome`	event	Job attempts finished by outcome: succeeded, retried, failed (terminal error, not retried) or dead (attempts exhausted).
`commonlayer_job_duration_seconds`	histogram	seconds	`kind`	event	Duration of one job attempt.
`commonlayer_jobs_queue_depth`	gauge	jobs	`queue`, `status`	business	Jobs per queue and status (pending, running, dead).
`commonlayer_jobs_oldest_pending_age_seconds`	gauge	seconds	`queue`	business	Age of the oldest due pending job per queue.
`commonlayer_events_published_total`	counter	events	`kind`	event	Domain events written to the outbox.
`commonlayer_events_undispatched`	gauge	events	—	business	Outbox events not yet dispatched to subscribers.
`commonlayer_scheduler_ticks_total`	counter	events	`task`, `outcome`	event	Scheduler slot claims by task and outcome (enqueued, skipped, error).
`commonlayer_scheduler_last_enqueue_timestamp_seconds`	gauge	unix seconds	`task`	process	Unix time of the last successful enqueue per scheduled task.

Registry and artifacts

Metric	Type	Unit	Labels	Source	Description
`commonlayer_registry_requests_total`	counter	requests	`action`, `kind`, `outcome`	event	Registry notifications by action (pull, push, delete), artifact kind (image, chart, other) and outcome.
`commonlayer_registry_token_requests_total`	counter	requests	`principal`, `outcome`	event	Registry token requests by principal (anonymous, promoter) and outcome.
`commonlayer_artifact_pulls_total`	counter	events	`project`, `kind`	event	Pulls of promoted artifacts by project slug and artifact kind.
`commonlayer_artifact_storage_bytes`	gauge	bytes	`kind`	business	Bytes of promoted artifacts by kind (sum of digest sizes).
`commonlayer_object_storage_operations_total`	counter	events	`operation`, `outcome`	event	Object storage operations (put, get, head, delete, list, sign, check) by outcome (`success`, `not_found`, `error`; a missing bucket is `error`).
`commonlayer_object_storage_operation_duration_seconds`	histogram	seconds	`operation`	event	Duration of object storage operations.
`commonlayer_artifact_submissions_total`	counter	events	`kind`, `outcome`	event	Finished submissions by artifact kind and outcome (promoted, rejected, failed).
`commonlayer_artifact_policy_checks_total`	counter	events	`check`, `outcome`	event	Verification policy check results by check id and outcome (pass, fail, waived, not_applicable).
`commonlayer_artifact_pipeline_duration_seconds`	histogram	seconds	`kind`	event	Time from submission to promotion or rejection.
`commonlayer_mirror_operations_total`	counter	events	`outcome`	event	Mirror runs into the CommonLayer registry by outcome.
`commonlayer_mirror_duration_seconds`	histogram	seconds	—	event	Duration of mirror runs.
`commonlayer_mirror_bytes_total`	counter	bytes	—	event	Blob bytes copied into the CommonLayer registry.
`commonlayer_preservation_checks_total`	counter	events	`outcome`	event	Preservation checks by outcome (ok, missing_manifest, missing_blob, digest_mismatch, error).
`commonlayer_preservation_last_success_timestamp_seconds`	gauge	unix seconds	—	business	Unix time of the last preservation run without failures.
`commonlayer_builds_total`	counter	events	`project`, `conclusion`	event	Completed CI build runs by project slug and conclusion.
`commonlayer_artifacts`	gauge	artifacts	`kind`, `lifecycle`	business	Artifacts by kind and effective lifecycle.

Security

Metric	Type	Unit	Labels	Source	Description
`commonlayer_scans_total`	counter	events	`scanner`, `trigger`, `outcome`	event	Scanner runs by scanner, trigger and outcome.
`commonlayer_scan_duration_seconds`	histogram	seconds	`scanner`	event	Duration of scanner runs.
`commonlayer_scan_oldest_supported_digest_age_seconds`	gauge	seconds	—	business	Over supported digests, the age of the oldest newest-successful-scan.
`commonlayer_scan_last_success_timestamp_seconds`	gauge	unix seconds	`project`	business	Unix time of the newest successful scan per project.
`commonlayer_vulnerability_feed_last_success_timestamp_seconds`	gauge	unix seconds	`feed`	business	Unix time of the last successful sync per vulnerability feed.
`commonlayer_findings_open`	gauge	findings	`severity`, `state`	business	Unresolved findings by effective severity and state.
`commonlayer_findings_overdue`	gauge	findings	`severity`, `deadline`	business	Findings past a deadline (acknowledgement, remediation) without an approved exception.
`commonlayer_findings_opened_total`	counter	findings	`severity`	event	Findings opened or reopened.
`commonlayer_findings_resolved_total`	counter	findings	`severity`, `resolution`	event	Findings resolved by resolution.
`commonlayer_vulnerability_acknowledgement_seconds`	histogram	seconds	`severity`	event	Time from detection to acknowledgement.
`commonlayer_vulnerability_remediation_seconds`	histogram	seconds	`severity`	event	Time from detection to resolution by a promoted fix.
`commonlayer_security_exceptions_active`	gauge	exceptions	`kind`	business	Approved, unexpired vulnerability exceptions by kind.
`commonlayer_projects_by_security_state`	gauge	projects	`state`	business	Projects by derived security state.

Funding

Metric	Type	Unit	Labels	Source	Description
`commonlayer_funding_monthly_committed_minor`	gauge	minor units	`currency`	business	Active recurring commitments per month, in minor units.
`commonlayer_funding_monthly_target_minor`	gauge	minor units	`currency`	business	Sum of monthly targets of active allocation policies, in minor units.
`commonlayer_funding_contributions_total`	counter	events	`kind`, `outcome`	event	Contributions by kind (one_time, recurring) and outcome (confirmed, failed, refunded, disputed).
`commonlayer_funding_contributed_minor_total`	counter	minor units	`currency`, `target`	event	Confirmed contribution amounts in minor units by currency and target (project, infrastructure).
`commonlayer_payments_total`	counter	events	`provider`, `outcome`	event	Provider payment events by provider and outcome.
`commonlayer_payment_webhooks_total`	counter	requests	`provider`, `outcome`	event	Payment webhooks by provider and outcome (accepted, duplicate, invalid_signature, failed).
`commonlayer_payment_webhook_processing_lag_seconds`	histogram	seconds	`provider`	event	Time from receiving a payment webhook to applying it.
`commonlayer_ledger_transactions_total`	counter	events	`kind`	event	Ledger transactions posted by kind (AlreadyPosted replays are not counted).
`commonlayer_ledger_balance_minor`	gauge	minor units	`class`, `kind`, `currency`	business	Ledger balances summed over projects by account class, kind and currency.
`commonlayer_ledger_reconciliation_mismatches`	gauge	mismatches	`check`	business	Mismatches found by the latest reconciliation run per check (ledger, subledger, provider).
`commonlayer_ledger_reconciliation_last_success_timestamp_seconds`	gauge	unix seconds	—	business	Unix time of the last reconciliation without mismatches.
`commonlayer_funding_cycles_settled_total`	counter	events	`outcome`	event	Cycle settlements by outcome (settled, failed).
`commonlayer_payout_obligations_outstanding_minor`	gauge	minor units	`status`, `currency`	business	Open payout obligations by status and currency, in minor units.
`commonlayer_payouts_total`	counter	events	`mode`, `outcome`	event	Payouts by mode (dry_run, simulated, live) and outcome.
`commonlayer_projects_by_funding_state`	gauge	projects	`state`	business	Projects by derived funding state.
`commonlayer_projects_by_lifecycle`	gauge	projects	`state`	business	Projects by lifecycle state.

Maintenance and notifications

Metric	Type	Unit	Labels	Source	Description
`commonlayer_maintainers_active`	gauge	maintainers	`role`	business	Active maintainer assignments by role.
`commonlayer_eligibility_evaluations_total`	counter	events	`state`	event	Eligibility evaluations computed by resulting state.
`commonlayer_maintainer_eligibility`	gauge	maintainers	`state`	business	Evaluations of the last finalized period by state.
`commonlayer_maintenance_tasks`	gauge	tasks	`kind`, `status`	business	Maintenance tasks by kind and status.
`commonlayer_eligibility_appeals_open`	gauge	appeals	—	business	Open eligibility appeals.
`commonlayer_notifications_created_total`	counter	notifications	`event_group`	event	Notifications created by event group.
`commonlayer_notification_deliveries_total`	counter	notifications	`channel`, `outcome`	event	Notification delivery attempts by channel and outcome.
`commonlayer_notification_delivery_duration_seconds`	histogram	seconds	`channel`	event	Duration of one delivery attempt.
`commonlayer_github_webhooks_total`	counter	requests	`event`, `outcome`	event	GitHub webhook deliveries by event and outcome.

Repository stewardship

Metric	Type	Unit	Labels	Source	Description
`commonlayer_repository_backups_total`	counter	events	`trigger`, `outcome`	event	Source backups of project repositories by trigger (release, scheduled, manual, succession) and outcome (succeeded, failed).
`commonlayer_repository_backup_duration_seconds`	histogram	seconds	—	event	Duration of one source backup: mirror clone, bundle, verification and upload.
`commonlayer_repository_backup_oldest_release_gap_seconds`	gauge	seconds	—	business	Age of the oldest promoted release whose source commit is in no successful backup; 0 when none.
`commonlayer_repository_guardrails`	gauge	projects	`outcome`	business	Connected repositories of operational projects by guardrail outcome: pass (every required check passes), fail (a required check fails), unknown (not evaluated yet).
`commonlayer_repository_guardrails_failing_seconds`	gauge	seconds	—	business	How long the longest-failing required guardrail check of an operational project's repository has been failing; 0 when none fails.
`commonlayer_repository_access_changes_total`	counter	events	`action`, `outcome`	event	Collaborator changes CommonLayer made on project repositories by action (invite, revoke, pending) and outcome (succeeded, failed, pending).
`commonlayer_repository_successions_open`	gauge	projects	`state`	business	Open repository succession cases by state (transfer_requested, restore_planned).
`commonlayer_repository_successions_overdue`	gauge	projects	—	business	Open repository succession cases past their due date.