APRF-RFC-0003 · accepted · MINOR · APRF v0.11.0
Demote observability OBS-M2 to recommended (OBS-R4)
Demotes OBS-M2→OBS-R4 (token/cost attribution); removes from Core/Regulated mandatories; pre-release ID-removal exception.
Created 2026-08-01
| Field | Value |
|---|---|
| Status | accepted |
| Author(s) | StackRail (working-draft publisher) |
| Created | 2026-08-01 |
| SemVer impact | MINOR |
| Index summary | Demotes OBS-M2→OBS-R4 (token/cost attribution); removes from Core/Regulated mandatories; pre-release ID-removal exception. |
| Related | APRF-RFC-0002 (pre-release ID-removal exception) |
Problem
OBS-M2 required token/cost attribution per request/feature/tenant as a Core mandatory. That over-weights FinOps labeling relative to production-blocking gates (identity, injection, pinned models, containment, spend ceilings). Teams with OBS-M1 linkage and COST spend limits still failed Core when attribution labels were incomplete.
Proposal
- Demote OBS-M2 → OBS-R4 (recommended
shouldlanguage; hybrid detection viarepo-ai-token-cost-attribution). - Remove OBS-M2 from Core and Regulated
mandatoryCheckIds(Core 39→38; Regulated 55→54; tier3-only unchanged). - Keep OBS-M1 (trace linkage) and sensitive-field redaction as observability mandatories (redaction Check later renumbered OBS-M3 → OBS-M2 into the vacated mandatory slot; see
id-gaps.md). - Pass condition unchanged in substance: ≥95% attributed billed calls over 24h with request + feature + tenant (or equivalent) labels; attest
measuredAt≤90d.
Alternatives considered
- Soften passCondition but keep mandatory — rejected; still blocks Core for a FinOps maturity control.
- Demote in place (
gate: recommendedon OBS-M2) — rejected; recommended Checks use*-R*namespace.
Compatibility
| Change | Impact |
|---|---|
| OBS-M2 removed; OBS-R4 added | Core −1; Regulated −1; recommended +1 |
| Crosswalk / relatedRules | Remapped OBS-M2 → OBS-R4 |
Pre-release exception: no tagged release yet — OBS-M2 YAML removed rather than deprecated stub. Recorded in `id-gaps.md`. After first tagged release, future demotions must use deprecated + replacedBy.
Security considerations
No change to spend ceilings (COST-M1/M3) or trace redaction (mandatory sensitive-field Check). Residual risk is slower cost forensics; mitigated by keeping OBS-R4 high-severity recommended with hybrid collectors.
Open questions
- Should Regulated re-include token attribution as mandatory once Level-5 FinOps guidance is ratified?
Checklist
- Problem and affected parties
- Proposed change stated
- SemVer impact justified
- Compatibility / deprecation plan
- Checks remain measurable
- Crosswalk impact noted
- Security / safety considered
- Open questions listed
Source markdown: /aprf/rfc/0003-observability-obs-m2-to-recommended.md