The sovereign healthcare runtime · The forgeforged, not configured.

Forge / Tech / Observe · Extended deep dive

Observability that ships with the runtime.

Every Forge deployment arrives with a fully integrated LGTM stack. No agents to bolt on. No third-party telemetry contracts. No data crossing the sovereign boundary. Evidence emerges from the runtime, not from a process you run before the auditor arrives.

02The problem with generic observability

Four ways generic observability stacks fail clinical software.

Most observability platforms were built for retail and ad tech. The shape of the data is similar; the shape of the obligations is not.

F / 01

Telemetry contracts leak.

The moment logs or traces leave the perimeter for a SaaS observability vendor, the sovereign claim is fiction. The auditor reads the data-processing addendum, not the marketing site.

F / 02

Instrumentation coverage drifts.

Every team that ships a service is supposed to add the SDK. Most do. Some don't. The trace you need on incident day is the one that was never instrumented.

F / 03

Retention is too short for healthcare.

Two-week retention is fine for ad tech. It does not survive a regulatory review that asks about a clinical event from last quarter, or a capacity model that needs year-over-year.

F / 04

Five tools, five access paths.

Logs in one vendor, metrics in another, traces in a third, alerting in a fourth. Each one its own SSO config, its own SOC 2 line item, its own thing the auditor has to verify.

03The LGTM stack

Four primitives. One workspace.

Each primitive answers a different question. Together they answer the ones the auditor, the SRE, and the clinical safety review ask in the same week.

LGTM / 01

Loki

Logs

What it is

An append-only log aggregator that indexes by label, not by full-text. Optimised for high-cardinality emissions from many small workloads.

The problem it solves

Most log pipelines were designed for one application running on many servers. Healthcare runs many applications on one substrate. Generic log stores either drop labels or get expensive fast. They also leave the perimeter to be useful.

What this means for you

You can attribute every log line to a tenant, a workload, a jurisdiction, a compliance class, without writing the parser. Logs are encrypted at rest, retained on your terms, and never shipped to a third-party SaaS.

Spec sheet

Storage: Append-only · AES-256
Indexing: Label-based
Retention: Up to 13 months
Tagging: Compliance-tagged at ingest

LGTM / 02

Grafana

Workspace

What it is

The query and visualisation layer for everything in your sovereign environment. Metrics, logs, traces, correlated by trace ID, explorable from a single workspace.

The problem it solves

Buying observability often means buying five tools and stitching them together. Each tool has its own access model, its own export path, its own line item in the SOC 2 report.

What this means for you

One workspace, one auth path (SSO / SAML / OIDC), one place the auditor looks. Healthcare-shaped dashboards (DICOM ingestion, HL7 / FHIR throughput, PACS retrieval latency) ship pre-built so you start with the questions, not the panels.

Spec sheet

Auth: SSO · SAML · OIDC
Boards: Pre-built · healthcare-shaped
Alerting: Threshold · anomaly · composite
Routing: PagerDuty · Slack · webhook

LGTM / 03

Tempo

Traces

What it is

Distributed tracing across the sovereign region. End-to-end trace IDs, span correlation with logs and metrics, sampling that survives the audit.

The problem it solves

Tracing usually means adding an SDK to every service, then convincing engineers to keep it up to date. Coverage drifts. The trace you need on incident day is the one that was never instrumented.

What this means for you

Beyla emits traces from the Linux kernel via eBPF, with no code changes to the workload. Coverage is a property of the runtime, not a discipline you maintain. When the auditor or the on-call engineer asks the question, the trace exists.

Spec sheet

Instrumentation: Beyla · eBPF · zero-code
Coverage: Every workload by default
Correlation: Trace IDs join logs + metrics
Sampling: Tail-based · configurable

LGTM / 04

Mimir

Metrics

What it is

A Prometheus-compatible time-series store with 13-month retention. Designed for long-horizon questions, not just the last fifteen minutes.

The problem it solves

Most metrics platforms keep two weeks of data and call it observability. Auditors, capacity planners, and clinical safety reviewers all need year-over-year. Generic stacks force a separate cold store and a separate query language.

What this means for you

One PromQL, one workspace, thirteen months of history. The same query that answers the alert on Monday answers the auditor on Thursday. Compatible with existing Prometheus exporters and existing Grafana boards, so the migration is a config file.

Spec sheet

Compatibility: Prometheus · PromQL
Retention: 13 months default
Cardinality: High · per-tenant labelling
Export: Remote-write · on-demand

04Instrumentation

Zero-code by default.

Grafana Beyla calculates RED metrics (rate, error, duration) directly from the Linux kernel via eBPF. No sidecars. No SDK changes. The runtime sees what the runtime is doing.

Rate

Requests / second

Per service · per endpoint

Error

4xx / 5xx ratio

Per service · per endpoint

Duration

p50 · p95 · p99

Histogram captured at kernel

How it lands

Beyla attaches at workload start. No build-time SDK.
Spans correlate to logs via trace ID by default.
RED metrics emit to Mimir; spans to Tempo; logs to Loki.
Grafana joins all three at query time.

What this saves you

No per-service instrumentation backlog.
No coverage gaps on incident day.
No SDK upgrade work across the fleet.
Coverage is a runtime property, not a discipline.

05Pre-built dashboards

Healthcare-shaped boards on day one.

You start with the questions, not the panels. Each board is built for a specific kind of clinical workload, with thresholds an SRE who has shipped to hospitals would actually set. Pre-built means they ship with the runtime and resolve to your labels at boot. There is no JSON to import, no Prometheus config to write.

HOW / Pre-built, in practice

Wired at boot.

When the workload starts, Beyla taps it via eBPF and metrics begin emitting against the right labels (tenant, jurisdiction, workload, region) without code changes.

Resolved to your tenants.

Dashboards ship with placeholders that resolve to the tenants and regions on your account. You log in, the right hospital names are already in the dropdowns.

Updated with the runtime.

When the platform team ships a board improvement, you inherit it on the next refresh. You can fork any board, but you don't have to maintain the baseline.

BRD / 01

DICOM ingestion

Imaging throughput

What hospitals send and what gets through. Pre-wired to standard PACS query and retrieve patterns, with per-tenant and per-modality breakdowns out of the box.

Who reads this

SREImaging opsClinical safety

Panels you get

Per-modality throughput (CR · CT · MR · US · MG · PT)
Per-hospital tenant breakdown
Association success rate
p95 and p99 ingestion latency
Retry rate by sending PACS
Queue depth at peak

Where the data comes from

· Mimir · throughput, latency histograms (Beyla)
· Loki · DICOM association logs · compliance-tagged

Default alerts

Throughput drop > 30% over 5 minutes
Queue depth crosses tenant ceiling
Association failure rate > 1%

BRD / 02

HL7 / FHIR throughput

Hospital integration

Designed for the team that fields the 4am page when a hospital's outbound feed stops. Every panel answers a question a real integration lead has asked under pressure.

Who reads this

Integration teamHospital integration leadsSRE

Panels you get

Messages per second by event type (ADT, ORU, OBX, FHIR Observation, Encounter, Patient)
Parse error breakdown by source system
Downstream queue depth
Mapping-failure cohort
p95 ack latency to upstream

Where the data comes from

· Mimir · message rates and ack histograms
· Loki · parse errors and mapping failures as structured log events

Default alerts

Parse error rate > 0.5% for any source
Downstream queue depth above SLO
Mapping failure spike from a single source

BRD / 03

PACS retrieval latency

Radiologist-facing performance

Catches network-path regressions before the radiologist does. Sliced by study size, jurisdiction, and modality so the cause is visible, not just the symptom.

Who reads this

SRERadiology operationsNetwork ops

Panels you get

Time-to-first-byte by study size (small · medium · large)
Latency by region (SYD · LON · MAN · DUB · BER · FRA)
Latency by modality
Retrieval failure rate
Cache hit rate
p99 retrieval over rolling 24 hours

Where the data comes from

· Tempo · per-retrieval traces with span correlation
· Mimir · latency histograms emitted by Beyla at the kernel

Default alerts

p95 retrieval crosses 2x baseline for 5 minutes
Retrieval failure rate > 0.1%
Cache hit rate drops by more than 15 points

BRD / 04

Clinical AI inference

Model performance and drift

For the team running diagnostic models in production. Latency, version split, drift, per-tenant fairness, and cost. All on labels you can query against your own contracts.

Who reads this

ML / AI teamClinical safety reviewerProduct owner

Panels you get

Inference latency p50 / p95 / p99 by model and version
Model-version traffic split (canary vs control)
Input distribution drift signal
Per-tenant inference rate and cost
Failure rate by failure mode (timeout · model error · input invalid)

Where the data comes from

· Mimir · latency, traffic, drift signals
· Tempo · per-inference traces with model and version labels
· Loki · drift events and failure mode emissions

Default alerts

p99 latency above SLO for any active model
Drift signal threshold crossed
Canary version regression vs control
Failure rate spike by mode

The boards are one workspace, not four pages.

Every board shares the same labels. Tenant, jurisdiction, workload, region, model version. That means questions that cross boards are queries, not workflows.

One label set, four boards.
Tenant and jurisdiction labels are applied at ingest by IsoCell and ForgeMesh. Every board inherits them automatically.
One click from symptom to source.
From an inference latency spike, jump to the trace, to the underlying logs, to the audit event that captured the deployment. Same workspace, same query language.
Cross-board correlation.
“Did the DICOM throughput drop correlate with the inference latency spike?” Answered in one PromQL query. No tab switching, no export-and-join.
The auditor and the SRE share it.
The on-call engineer's evidence panel and the auditor's compliance query resolve against the same labels. One source of truth, two questions.

You don't configure observability. You ask it questions.

06Compliance & evidence

The auditor and the SRE ask the same workspace.

Telemetry doubles as evidence. The same query that shows last night's p99 spike shows the auditor the access pattern they were asking about. One workspace. One source of truth.

Immutable logs

Append-only. Cryptographically chained. Cannot be revised after the fact.

Compliance tags

Every record carries jurisdiction, tenant, and class at ingest.

Retention policy

13-month default. Custom on Enterprise.

On-demand export

SIEM-compatible. One query per audit request.

Sovereign auth

SSO · SAML · OIDC. Bound to your IdP.

No external egress

Telemetry never leaves the sovereign boundary.

07Where Observe sits in the runtime

Sovereign by construction.

ForgeAudit

Evidence

Append-only audit trail. Observe events feed in by default.

ForgeObserve

You are here

Loki · Grafana · Tempo · Mimir. Sovereign LGTM workspace.

ForgeMesh + ForgeVault

Networking + Storage

Beyla taps the mesh at kernel level. Storage stays inside the jurisdiction.

IsoCell

Compute

Per-workload Firecracker microVMs. Each emits telemetry from boot.

3verest substrate

Hardware

Bare metal in named data centres. No public-internet hops between layers.

Telemetry that never leaves the perimeter, because the perimeter was already where it lives.

08Who asks what of the workspace

Three shapes of question.

UC / 01

Clinical AI team

Monitoring inference latency for diagnostic models.

Per-model p99, per-tenant fairness, drift signals. The trace from a slow inference call lands in the same workspace as the auditor's evidence query.

UC / 02

Imaging platform

Tracking DICOM throughput across hospital tenants.

Per-tenant ingestion rate, per-modality retry pattern, per-region latency. The dashboard ships pre-built. The SOC 2 evidence exports on demand.

UC / 03

OEM / Platform vendor

Per-tenant evidence for the auditor.

Every event carries a tenant tag, a jurisdiction tag, a compliance class. Exporting a tenant's audit trail is one query. Demonstrating residency is the same query.

Private beta · <100 slots

See the workspace running.

We can show you the live LGTM stack against a sample workload, or against the shape of your own. Either way, you see it inside the perimeter.

Request access Talk to an engineer See the runtime

Four ways generic observability stacks fail clinical software.

Most observability platforms were built for retail and ad tech. The shape of the data is similar; the shape of the obligations is not.

F / 01

Telemetry contracts leak.

The moment logs or traces leave the perimeter for a SaaS observability vendor, the sovereign claim is fiction. The auditor reads the data-processing addendum, not the marketing site.

F / 02

Instrumentation coverage drifts.

Every team that ships a service is supposed to add the SDK. Most do. Some don't. The trace you need on incident day is the one that was never instrumented.

F / 03

Retention is too short for healthcare.

Two-week retention is fine for ad tech. It does not survive a regulatory review that asks about a clinical event from last quarter, or a capacity model that needs year-over-year.

F / 04

Five tools, five access paths.

Logs in one vendor, metrics in another, traces in a third, alerting in a fourth. Each one its own SSO config, its own SOC 2 line item, its own thing the auditor has to verify.

Zero-code by default.

Grafana Beyla calculates RED metrics (rate, error, duration) directly from the Linux kernel via eBPF. No sidecars. No SDK changes. The runtime sees what the runtime is doing.

Rate

Requests / second

Per service · per endpoint

Error

4xx / 5xx ratio

Per service · per endpoint

Duration

p50 · p95 · p99

Histogram captured at kernel

How it lands

Beyla attaches at workload start. No build-time SDK.
Spans correlate to logs via trace ID by default.
RED metrics emit to Mimir; spans to Tempo; logs to Loki.
Grafana joins all three at query time.

What this saves you

No per-service instrumentation backlog.
No coverage gaps on incident day.
No SDK upgrade work across the fleet.
Coverage is a runtime property, not a discipline.

Healthcare-shaped boards on day one.

HOW / Pre-built, in practice

Wired at boot.

When the workload starts, Beyla taps it via eBPF and metrics begin emitting against the right labels (tenant, jurisdiction, workload, region) without code changes.

Resolved to your tenants.

Dashboards ship with placeholders that resolve to the tenants and regions on your account. You log in, the right hospital names are already in the dropdowns.

Updated with the runtime.

When the platform team ships a board improvement, you inherit it on the next refresh. You can fork any board, but you don't have to maintain the baseline.

BRD / 01

DICOM ingestion

Imaging throughput

What hospitals send and what gets through. Pre-wired to standard PACS query and retrieve patterns, with per-tenant and per-modality breakdowns out of the box.

Who reads this

SREImaging opsClinical safety

Panels you get

Per-modality throughput (CR · CT · MR · US · MG · PT)
Per-hospital tenant breakdown
Association success rate
p95 and p99 ingestion latency
Retry rate by sending PACS
Queue depth at peak

Where the data comes from

· Mimir · throughput, latency histograms (Beyla)
· Loki · DICOM association logs · compliance-tagged

Default alerts

Throughput drop > 30% over 5 minutes
Queue depth crosses tenant ceiling
Association failure rate > 1%

BRD / 02

HL7 / FHIR throughput

Hospital integration

Designed for the team that fields the 4am page when a hospital's outbound feed stops. Every panel answers a question a real integration lead has asked under pressure.

Who reads this

Integration teamHospital integration leadsSRE

Panels you get

Messages per second by event type (ADT, ORU, OBX, FHIR Observation, Encounter, Patient)
Parse error breakdown by source system
Downstream queue depth
Mapping-failure cohort
p95 ack latency to upstream

Where the data comes from

· Mimir · message rates and ack histograms
· Loki · parse errors and mapping failures as structured log events

Default alerts

Parse error rate > 0.5% for any source
Downstream queue depth above SLO
Mapping failure spike from a single source

BRD / 03

PACS retrieval latency

Radiologist-facing performance

Catches network-path regressions before the radiologist does. Sliced by study size, jurisdiction, and modality so the cause is visible, not just the symptom.

Who reads this

SRERadiology operationsNetwork ops

Panels you get

Time-to-first-byte by study size (small · medium · large)
Latency by region (SYD · LON · MAN · DUB · BER · FRA)
Latency by modality
Retrieval failure rate
Cache hit rate
p99 retrieval over rolling 24 hours

Where the data comes from

· Tempo · per-retrieval traces with span correlation
· Mimir · latency histograms emitted by Beyla at the kernel

Default alerts

p95 retrieval crosses 2x baseline for 5 minutes
Retrieval failure rate > 0.1%
Cache hit rate drops by more than 15 points

BRD / 04

Clinical AI inference

Model performance and drift

For the team running diagnostic models in production. Latency, version split, drift, per-tenant fairness, and cost. All on labels you can query against your own contracts.

Who reads this

ML / AI teamClinical safety reviewerProduct owner

Panels you get

Inference latency p50 / p95 / p99 by model and version
Model-version traffic split (canary vs control)
Input distribution drift signal
Per-tenant inference rate and cost
Failure rate by failure mode (timeout · model error · input invalid)

Where the data comes from

· Mimir · latency, traffic, drift signals
· Tempo · per-inference traces with model and version labels
· Loki · drift events and failure mode emissions

Default alerts

p99 latency above SLO for any active model
Drift signal threshold crossed
Canary version regression vs control
Failure rate spike by mode

The boards are one workspace, not four pages.

Every board shares the same labels. Tenant, jurisdiction, workload, region, model version. That means questions that cross boards are queries, not workflows.

One label set, four boards.
Tenant and jurisdiction labels are applied at ingest by IsoCell and ForgeMesh. Every board inherits them automatically.
One click from symptom to source.
From an inference latency spike, jump to the trace, to the underlying logs, to the audit event that captured the deployment. Same workspace, same query language.
Cross-board correlation.
“Did the DICOM throughput drop correlate with the inference latency spike?” Answered in one PromQL query. No tab switching, no export-and-join.
The auditor and the SRE share it.
The on-call engineer's evidence panel and the auditor's compliance query resolve against the same labels. One source of truth, two questions.

You don't configure observability. You ask it questions.

Sovereign by construction.

ForgeAudit

Evidence

Append-only audit trail. Observe events feed in by default.

ForgeObserve

You are here

Loki · Grafana · Tempo · Mimir. Sovereign LGTM workspace.

ForgeMesh + ForgeVault

Networking + Storage

Beyla taps the mesh at kernel level. Storage stays inside the jurisdiction.

IsoCell

Compute

Per-workload Firecracker microVMs. Each emits telemetry from boot.

3verest substrate

Hardware

Bare metal in named data centres. No public-internet hops between layers.

Telemetry that never leaves the perimeter, because the perimeter was already where it lives.

Three shapes of question.

UC / 01

Clinical AI team

Monitoring inference latency for diagnostic models.

Per-model p99, per-tenant fairness, drift signals. The trace from a slow inference call lands in the same workspace as the auditor's evidence query.

UC / 02

Imaging platform

Tracking DICOM throughput across hospital tenants.

Per-tenant ingestion rate, per-modality retry pattern, per-region latency. The dashboard ships pre-built. The SOC 2 evidence exports on demand.

UC / 03

OEM / Platform vendor

Per-tenant evidence for the auditor.

Every event carries a tenant tag, a jurisdiction tag, a compliance class. Exporting a tenant's audit trail is one query. Demonstrating residency is the same query.