Module observability 

ADR-12 observability hooks.

All tracing emission for the control core is centralized here so the set of telemetry field names stays auditable in one place. Spans and events carry identifiers and counts only — never feature matrices, targets, sample values or metadata contents. This preserves, at the telemetry layer, the same boundary the data ABI enforces: the core never exposes raw data.

The CI lint scripts/lint_tracing_fields.py enforces two invariants:

1. no tracing usage exists outside this module (so every event is vetted);
2. no field name in this module matches the forbidden data|features|targets|sample|metadata pattern (singular sample also rejects sample_count, sample_ids, etc.).

The core only emits through the tracing facade; it never installs a subscriber. Binaries and hosts choose a sink (the CLI installs a tracing_subscriber::fmt layer driven by RUST_LOG; see docs/OBSERVABILITY.md).

Constants

OBSERVABILITY_FIELD_ALLOWLIST

Frozen ADR-12 telemetry field allowlist. Every field emitted by this module must appear here, and each entry is an identifier or a count — never data. Adding a field requires an ADR-12 update and a review per the privacy rule.

Functions

emit_oof_refusal

Emit the ADR-12 out-of-fold leakage refusal event with stable taxonomy fields (category/code mirror crate::DagMlError::OofLeakage) so log consumers can alert on refusals without parsing messages.

node_span

Build the per-node span (ADR-12), nested under the current phase span so node telemetry is attributed to its run, plan and controller. Identifiers only.

phase_span

Build the per-phase-scope span (ADR-12). run_id/plan_id correlate concurrent or overlapping runs; empty variant_id/fold_id mean the field is not applicable to the current phase. Fields are identifiers only.