Guara Cloud Positron

The observability database for native logs and traces.

Positron stores and queries telemetry through one shared storage kernel while each signal keeps the physical design that suits it. A single Rust binary that treats tenancy as a physical boundary and refuses to run unencrypted.

Explore the architecture View on GitHub

open source · MIT 100% Rust OTLP + Loki ingest Grafana data source Kubernetes operator

One kernel. Signal‑native stores.

The Storage Kernel owns what every signal needs exactly once: durability, catalog transactions, encryption, resource governance, and lifecycle.

Above it, each Signal Store owns what makes its signal fast. The Log Store keeps full-text and typed attribute indexes with workload-driven attribute promotion. The Trace Store consolidates span observations into logical spans, preserves conflicts instead of overwriting them, and maintains incremental trace summaries.

Release 1 ships logs and traces. Metrics and profiles are deliberate deferrals — the Signal Store seam is built for them, and nothing pretends otherwise.

otlp/grpc otlp/http loki/push Log Store text + attribute indexes Trace Store span consolidation Storage Kernel segments · catalog · resource governor · encryption maintenance · integrity · lifecycle clock primary data volume

Designed like a database,
not a pipeline.

Five decisions define Positron. Each is frozen in an accepted architecture decision record before a line of product code.

Tenancy is a physical boundary

isolation

Every segment belongs to exactly one tenant. Tenant data is encrypted under tenant-scoped keys, quotas are enforced per tenant, and requests bind to exactly one tenant before any payload is decoded. Tenant Purge is cryptographically complete: it eliminates every reachable key envelope from the instance and from every registered backup repository.

ADR-0006 · ADR-0039 · ADR-0061

Encryption is the default state

protection

A Positron instance initializes encrypted or not at all. Independently authenticated AES-256-GCM frames, envelope keys wrapped by your provider — AWS KMS, Google Cloud KMS, Azure Key Vault and Managed HSM, Vault Transit, OpenBao, KMIP — or a hardened local root key with a verified recovery bundle.

ADR-0031 · ADR-0034 · ADR-0035 · ADR-0043

Acknowledgment means durability

correctness

An ingest acknowledgment is issued only after the durable commit its deployment mode guarantees — never from queue acceptance. Crash recovery exposes a complete predecessor or a complete successor, never a mixture. Partial results stay explicit: committed, retryable, and rejected records are reported separately.

ADR-0004 · ADR-0013

Everything is bounded

governance

Work acquires an explicit reservation from the Resource Governor before it consumes memory, queue slots, or disk. Queries run under budgets with a truthful terminal status. Connection admission is bounded before authentication, and all background work flows through one maintenance scheduler.

ADR-0070 · ADR-0071

Releases are verifiable

trust

Every artifact binds to a signed release manifest with checksums, compatibility identity, SBOMs, and provenance. Offline verification checks an artifact against the installed project trust root.

Release trust

Speaks the protocols you already run.

Native stores behind versioned receiver adapters — compatibility is conformance-tested against pinned producers, not resemblance.

Wire in ingest

  • otlp/grpclogs and traces
  • otlp/httpprotobuf and JSON
  • loki/pushwith validated X-Scope-OrgID aliases
  • ingest policydeclarative accept, reject, or transform — before persistence, with provenance

Read out query

  • pipelinestyped operators over logs, spans, and traces
  • sqla bounded, read-only subset
  • taillive, resumable, explicitly at-least-once
  • grafanafirst-party data source plugin
  • sdksRust, TypeScript, Python, Go, Java, .NET — generated from one Protobuf definition
positron — one executable
# run the database
$ positron serve

# run the Kubernetes reconciler
$ positron operator

# bounded read-only diagnosis
$ positron doctor

# authenticate release artifacts offline
$ positron release verify

One binary, every role.

The database, the Kubernetes operator, and the offline tooling are modes of the same signed executable.

  • Container contract One multi-architecture OCI image behaves identically under Docker, Compose, and Kubernetes — with explicit persistence, health, and shutdown semantics.
  • Operator, not a dependency PositronCluster, PositronBackup, and PositronScheduledBackup reconcile through the public API. The operator never opens the data volume.
  • Verified backups Incremental, application-verified snapshots to filesystem, S3, S3-compatible, GCS, or Azure Blob — restore-only into fresh storage, proven recoverable before a backup counts.
  • Declarative upgrades Fenced, recoverable, and preceded by a verified quiescent snapshot before any persistent format changes.