Positron stores and queries telemetry through one shared storage kernel while each signal keeps the physical design that suits it. A single Rust binary that treats tenancy as a physical boundary and refuses to run unencrypted.
The Storage Kernel owns what every signal needs exactly once: durability, catalog transactions, encryption, resource governance, and lifecycle.
Above it, each Signal Store owns what makes its signal fast. The Log Store keeps full-text and typed attribute indexes with workload-driven attribute promotion. The Trace Store consolidates span observations into logical spans, preserves conflicts instead of overwriting them, and maintains incremental trace summaries.
Release 1 ships logs and traces. Metrics and profiles are deliberate deferrals — the Signal Store seam is built for them, and nothing pretends otherwise.
Five decisions define Positron. Each is frozen in an accepted architecture decision record before a line of product code.
Every segment belongs to exactly one tenant. Tenant data is encrypted under tenant-scoped keys, quotas are enforced per tenant, and requests bind to exactly one tenant before any payload is decoded. Tenant Purge is cryptographically complete: it eliminates every reachable key envelope from the instance and from every registered backup repository.
ADR-0006 · ADR-0039 · ADR-0061A Positron instance initializes encrypted or not at all. Independently authenticated AES-256-GCM frames, envelope keys wrapped by your provider — AWS KMS, Google Cloud KMS, Azure Key Vault and Managed HSM, Vault Transit, OpenBao, KMIP — or a hardened local root key with a verified recovery bundle.
ADR-0031 · ADR-0034 · ADR-0035 · ADR-0043An ingest acknowledgment is issued only after the durable commit its deployment mode guarantees — never from queue acceptance. Crash recovery exposes a complete predecessor or a complete successor, never a mixture. Partial results stay explicit: committed, retryable, and rejected records are reported separately.
ADR-0004 · ADR-0013Work acquires an explicit reservation from the Resource Governor before it consumes memory, queue slots, or disk. Queries run under budgets with a truthful terminal status. Connection admission is bounded before authentication, and all background work flows through one maintenance scheduler.
ADR-0070 · ADR-0071Every artifact binds to a signed release manifest with SBOMs, reproducible payloads, and provenance. Every supported target is a qualification cell with retained, immutable evidence — a capability is not claimed until its cell is qualified.
ADR-0073 · ADR-0074Native stores behind versioned receiver adapters — compatibility is conformance-tested against pinned producers, not resemblance.
X-Scope-OrgID aliases# run the database
$ positron serve
# run the Kubernetes reconciler
$ positron operator
# bounded read-only diagnosis
$ positron doctor
# authenticate release artifacts offline
$ positron release verifyThe database, the Kubernetes operator, and the offline tooling are modes of the same signed executable.
PositronCluster, PositronBackup, and
PositronScheduledBackup reconcile through the public
API. The operator never opens the data volume.