Paper deep dive
Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations
Jun He, Deying Yu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 8/23/2026, 1:34:50 AM
Summary
This paper introduces Agent-Native Telemetry, an operational evidence architecture designed for autonomous AI agents. It proposes the Agent Telemetry Protocol (ATP) and a State-Delta Evidence Ledger that replace verbose human-readable logs with verifiable state deltas. The system uses four evidence primitives (Transitions, Observations, Relations, State Checkpoints) and cryptographic hash-chaining to ensure provenance and integrity. Benchmarks show significant reductions in data payload, LLM context usage, and query costs, while providing robust security against adversarial mutations and prompt injections.
Entities (12)
Relation Signals (10)
Deying Yu → affiliatedwith → OpenKedge.io
confidence 99% · Deying Yu Affiliation: OpenKedge.io
Jun He → affiliatedwith → OpenKedge.io
confidence 99% · Jun He Affiliation: OpenKedge.io
State-Delta Evidence Ledger → implements → Agent Telemetry Protocol
confidence 95% · We present the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger, an implementation...
Agent Telemetry Protocol → usesprimitive → State Checkpoints
confidence 95% · We present the Agent Telemetry Protocol (ATP) ... structures operational facts into four core evidence primitives (...State Checkpoints)
Agent Telemetry Protocol → usesprimitive → Transitions
confidence 95% · We present the Agent Telemetry Protocol (ATP) ... structures operational facts into four core evidence primitives (Transitions...)
Agent Telemetry Protocol → usesprimitive → Observations
confidence 95% · We present the Agent Telemetry Protocol (ATP) ... structures operational facts into four core evidence primitives (...Observations...)
Agent Telemetry Protocol → usesprimitive → Relations
confidence 95% · We present the Agent Telemetry Protocol (ATP) ... structures operational facts into four core evidence primitives (...Relations...)
Agent Telemetry Protocol → →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Operational telemetry is predominantly engineered for human reading: systems repeatedly serialize verbose prose, static keys, and redundant context across billions of log lines. As autonomous AI agents become primary operational consumers, feeding them traditional logs wastes scarce context capacity parsing lexical syntax rather than reasoning over system state changes -- all while lacking cryptographic guarantees of provenance or collection completeness. This paper introduces agent-native telemetry, an operational evidence architecture for autonomous machine operators founded on verifiable state deltas rather than human prose. We present the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger, an implementation that structures operational facts into four core evidence primitives (Transitions, Observations, Relations, and State Checkpoints) governed by content-addressed schemas, while isolating uncurated text as digest-verified opaque references. Producers sign and hash-chain batches for atomic collector append. Verified records feed two parallel agent access paths: a stateless protocol decoder emitting compact positional rows, and a stateful semantic gateway serving bounded graph capsules. We prove an information-preservation lower bound and formalize a ledger-relative verified negative theorem for provable event non-occurrence. On distributed microservice benchmarks (AIOpsLab and OpenTelemetry Astronomy Shop), ATP reduces raw wire payload and modeled cloud query scan costs by 96.4% relative to OpenTelemetry JSON, reduces LLM context tokens by 88.8% and query operations by 66.2%, detects all 500 tested adversarial storage mutations, and yields zero successful prompt injections across 50 adversarial trials per ATP configuration.
Tags
Links
- Source: https://arxiv.org/abs/2608.16178v1
- Canonical: https://arxiv.org/abs/2608.16178v1
Trouble viewing inline? Open PDF directly →
Full Text
73,549 characters extracted from source content.
Expand or collapse full text
Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations Jun He Affiliation: OpenKedge.io Deying Yu Affiliation: OpenKedge.io Abstract Operational telemetry is predominantly engineered for human reading: systems repeatedly serialize verbose prose, static keys, and redundant context across billions of log lines. As autonomous AI agents become primary operational consumers, feeding them traditional logs wastes scarce context capacity parsing lexical syntax rather than reasoning over system state changes—all while lacking cryptographic guarantees of provenance or collection completeness. This paper introduces agent-native telemetry, an operational evidence architecture for autonomous machine operators founded on verifiable state deltas rather than human prose. We present the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger, an implementation that structures operational facts into four core evidence primitives—Transitions, Observations, Relations, and State Checkpoints—governed by content-addressed schemas, while isolating uncurated text as digest-verified opaque references. Producers sign and hash-chain batches for atomic collector append. Verified records feed two parallel agent access paths: a stateless protocol decoder emitting compact positional rows, and a stateful semantic gateway serving bounded graph capsules. We prove an information-preservation lower bound and formalize a ledger-relative verified negative theorem for provable event non-occurrence. On distributed microservice benchmarks (AIOpsLab and OpenTelemetry Astronomy Shop), ATP reduces raw wire payload and modeled cloud query scan costs by 96.4% relative to OpenTelemetry JSON, reduces LLM context tokens by 88.8% and query operations by 66.2%, detects all 500 tested adversarial storage mutations, and yields zero successful prompt injections across 50 adversarial trials per ATP configuration. 1 Introduction Modern enterprise cloud infrastructures generate immense volumes of operational telemetry, routinely producing tens to hundreds of terabytes of log data per enterprise daily, with hyperscalers ingesting petabytes to exabytes each day [27, 32]. Managing, ingesting, and querying this continuous flood of machine data has become one of the largest and fastest-growing line items in cloud infrastructure budgets. Standard cloud log ingestion costs typically range from $0.10 to $0.50 per gigabyte (e.g., $0.50/GB for AWS CloudWatch Logs, alongside indexing charges in commercial observability platforms) [2, 8]. Beyond ingestion, querying stored logs introduces substantial recurring financial overhead: services such as AWS CloudWatch Logs Insights bill $0.005 per gigabyte of data scanned [2]. In an enterprise cluster generating 10 TB of logs daily, a single diagnostic query across that history costs $50, and running continuous automated alert evaluations and anomaly detection jobs across large fleets routinely costs tens to hundreds of thousands of dollars monthly in log scanning fees alone. Yet, empirical studies demonstrate that 80% to 90% of these ingested and scanned bytes consist of static boilerplate: repeated JSON keys, IP addresses, schema headers, timestamps, and unchanged system attributes rather than changing operational facts [30, 29]. For decades, this verbose text format was tolerated because logs were authored for human engineers scanning dashboards, reading console outputs, or running regex queries. Site Reliability Engineers (SREs) currently spend an estimated 30% to 50% of incident triage time manually filtering and correlating distributed text logs. Today, however, IT operations and DevOps are undergoing a rapid shift toward autonomous agentic workflows: industry forecasts project that by 2027–2029, over 70% to 75% of enterprises will deploy agentic AIOps to operate IT infrastructure and execute closed-loop incident triage, displacing human dashboards as the primary telemetry consumers [10, 5]. When autonomous AI agents (such as LLM reasoning engines and automated diagnostic loops) are tasked with inspecting conventional log streams, a fundamental mismatch emerges across existing industry paradigms: • Unstructured Text and Compressed Codecs: Codecs such as CLP [27] and μ [30] separate static templates from dynamic variables to compress logs and accelerate regex search, but still treat telemetry as isolated text strings, lacking native state-machine and causal context. • Unified Telemetry Envelopes: Standards such as OpenTelemetry Logs and OTLP [20, 24] structure attributes and correlation IDs, but emit verbose JSON or gRPC envelopes with high-entropy repeating keys, creating a heavy storage footprint optimized for human visualization (e.g., Grafana dashboards) rather than token-efficient machine reasoning. • Semantic and Vector Indexing: Methods such as LogLLM [16] and LogEvent2vec [18] map log text into dense embedding spaces for nearest-neighbor anomaly detection. However, generating continuous embeddings at scale incurs steep compute overhead, and vectorization destroys exact deterministic parameters (e.g., specific port numbers, return codes, memory addresses, and transaction identifiers) indispensable for precise root-cause analysis. Beyond representation inefficiencies, autonomous agents waste scarce context capacity and inference compute attempting to reconstruct causality from linear time-series streams. Scanning linear streams requires (N)O(N) processing over millions of lines across distributed services, leaving state machine transitions and topological invariant violations implicit. Furthermore, traditional pipelines lack cryptographic hash chaining and explicit collection receipts, meaning an agent cannot mathematically distinguish whether an absence of errors reflects healthy execution or unmonitored blind spots and packet drops. Finally, interspersing arbitrary user payloads, HTTP query strings, and exception traces directly into the primary log stream exposes LLM agents to passive prompt-injection attacks [25, 12]. To resolve this mismatch, this paper introduces agent-native telemetry, a clean-slate operational evidence paradigm engineered specifically for automated reasoning agents. We design and implement the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger, an architecture where the fundamental telemetry primitive is not a human-readable text line, but an authenticated, typed state delta recorded in an append-only ledger. The ledger organizes operational facts into four explicit evidence primitives—Transitions, Observations, Relations, and State Checkpoints—governed by immutable content-addressed schema manifests, while variable-length diagnostic text is quarantined as separately addressable, digest-verified opaque evidence. Verified records feed two parallel agent access paths: a stateless protocol-native decoder that emits compact tabular rows, and a stateful semantic state gateway that maintains a versioned operational state graph and returns bounded evidence capsules. We establish the mathematical foundations of agent-native evidence, proving an information-preservation lower bound for canonical state retention and formalizing a ledger-relative verified negative theorem that enables agents to mathematically prove event non-occurrence over observed scopes. Finally, we conduct a comprehensive empirical evaluation across distributed microservice testbeds, demonstrating substantial representation, context token, triage latency, and security gains. Specifically, this paper makes five core contributions: First, we formulate a transition-centered evidence model that structures operational facts into four explicit primitives (transitions, observations, relations, and state checkpoints) while isolating uncurated diagnostic text behind a digest-verified opaque boundary. Second, we design the compact canonical protocol (ATP), utilizing positional binary tuples and content-addressed schemas to achieve sub-byte cryptographic metadata overhead per record. Third, we establish formal evidence contracts proving an information-preservation lower bound and formalizing a ledger-relative negative verification theorem under declared observation boundaries. Fourth, we architect a dual-path access layer combining a stateless tabular stream decoder with a stateful semantic gateway to decouple representation compactness from graph-scoped topological retrieval. Fifth, we build an end-to-end prototype and empirically demonstrate across microservice benchmarks (AIOpsLab and OpenTelemetry Astronomy Shop) a 96.4% reduction in wire footprint and modeled cloud scan costs, an 88.8% reduction in LLM context tokens, 100% detection across 500 tested adversarial storage-mutation trials, zero successful prompt injections across 50 adversarial trials per ATP configuration, and certified negative verification. The remainder of this paper is organized as follows. Section 2 establishes the agent-native telemetry model, formal definitions, and threat model. Section 3 details the ledger architecture, canonical protocol, and parallel access paths. Section 4 establishes the formal evidence contracts, coding lower bounds, and verified non-occurrence guarantees. Section 5 details the reference implementation, empirical benchmarks, and KPI evaluations. Section 6 discusses security, privacy, and operational trade-offs. Section 7 reviews related work and comparative positioning. Section 8 concludes. 2 Agent-Native Telemetry Model 2.1 Operational Agent Requirements We define agent-native telemetry as the operational evidence supplied to automated reasoning agents for monitoring and root-cause analysis, distinct from observing an agent’s internal execution chains [1]. These agents impose four fundamental requirements that diverge sharply from human dashboards: • Deterministic Structure and Explicit State Transitions: Reasoning agents require unambiguous entity identifiers, explicit physical units, and typed state transitions rather than ad-hoc string formatting that varies across software versions. • High Information Density and Bounded Context: Because model context windows and inference budgets are finite, telemetry must convey maximal operational change per token while supporting targeted sub-graph and time-bounded range retrieval. • Verifiable Provenance and Explicit Coverage: When making high-stakes diagnostic decisions, agents must mathematically distinguish whether an absence of telemetry reflects healthy execution or unmonitored blind spots and packet drops. • Structural Isolation of Untrusted Content: External strings (e.g., HTTP query parameters, exception messages) must be structurally isolated to prevent passive prompt injection from hijacking agent reasoning. 2.2 ATP Model and Evidence Primitives We formalize the agent telemetry protocol as follows: Definition 2.1 (Agent Telemetry Protocol). The Agent Telemetry Protocol (ATP) is the production of schema-resolved, authenticated operational evidence—centered on state transitions and supplemented by observations, relations, state checkpoints, and opaque-evidence references—whose canonical records can be deterministically verified and decoded into bounded agent-facing representations with explicit provenance and collection coverage. In ATP, every schema registered in the system declares exactly one of four foundational evidence primitives: 1. Transition: Records an explicit discrete change in an entity’s operational state or execution outcome (e.g., a Kubernetes Deployment transitioning from Progressing to Available, or an RPC completing with Status:500). Transitions optionally carry an intent_ref (resolving to an IntentHash) denoting the parent agent task, control-plane reconciliation loop, or user workflow that triggered the transition. 2. Observation: Records a point-in-time measurement, health check outcome, or invariant assertion (e.g., CPU utilization crossing a threshold, or an active probe failure). 3. Relation: Records the dynamic addition, modification, or removal of a structural relationship (e.g., service call dependencies, resource ownership, or declared causal links). Relations induce a versioned operational state graph Gt=(Vt,At)G_t=(V_t,A_t). Like transitions, relations can bind to an intent_ref to provide causal lineage back to high-level operational intents. 4. State Checkpoint: A producer-emitted state snapshot bundling active entity states, sequence markers, and drop counters. This allows downstream consumers to reconstruct operational state without replaying history from genesis. Crucially, the architecture maintains a strict distinction between two checkpoint mechanisms: (1) Producer State Checkpoints, emitted in-band by producers to capture application state and drop counters for fast replay; and (2) Independent Chain-Head Checkpoints, emitted out-of-band by the collector to an independent storage or witness channel, committing to the highest accepted sequence and batch root to prevent adversarial suffix deletion (rollback) on ledger storage. 2.3 Observation Boundary and Evidence Planes Let W represent the space of physical distributed system executions, and let ℰE denote the universe of finite canonical telemetry record streams. An instrumentation profile is formally defined as Ω=(,,ℬ,,Δclk), =(P,\,S,\,B,\,C,\, _clk), (2.1) where P is the set of participating authorized producers, S is the set of registered schemas, ℬB denotes known instrumentation blind spots, C specifies distributed context-propagation mechanisms, and Δclk _clk bounds clock uncertainty across nodes. The observation mapping OΩ:→ℰO_ :W maps an execution w∈w to the canonical record stream E=OΩ(w)∈ℰE=O_ (w) emitted by trusted instrumentation under profile Ω . All coverage statements and negative guarantees in this paper are strictly scoped to OΩO_ and collector receipts. Definition 2.2 (Observation boundary). Canonical telemetry authenticates what was observed and accepted by instrumentation under profile Ω ; it does not assert observation of uninstrumented system activity. Cryptographic sequence continuity and valid signatures prove that no accepted records were altered or omitted in transit, but cannot prove that an uninstrumented application event occurred. We formalize two distinct evidence planes: • Canonical Plane (canE_can): Contains accepted signed batches, resolved schema manifests, state checkpoints, collection receipts, and digest references to opaque objects. These constitute immutable operational ground truth under the trust model. • Derived Plane (derI_der): Contains materializations generated from canE_can, including reconstructed state graphs, anomaly scores, vector embeddings, suspected causal graphs, and LLM-generated summaries. Every derived artifact explicitly records its derivation version and exact input ledger ranges. Derived artifacts guide retrieval and inference, but cannot mutate canonical records or act as authorization tokens for automated remediation. 2.4 Failure and Threat Model We assume that producer SDKs and the append-time collector/verifier are trusted components running in protected execution domains with secure private key storage. Nodes may experience crash-stop and crash-recovery failures. In contrast, network transport, ledger storage, schema registries, and opaque object stores are treated as untrusted and potentially adversarial. The adversary may drop, duplicate, reorder, delay, splice, mutate, truncate, or withhold serialized bytes. A bounded, durable local buffer in the producer SDK preserves unacknowledged batches across network partitions until collector acknowledgment. Compromised producer hosts, rogue collectors, stolen signing keys, and application-level omission prior to SDK ingestion fall outside the cryptographic guarantee. Furthermore, opaque evidence storage may be temporarily unavailable even when its signed digest and metadata on the ledger are intact. 2.5 Trusted Computing Base and Governance The Trusted Computing Base (TCB) consists of: (1) the producer SDK and its signing key; (2) the collector batch verifier; (3) the independent chain-head checkpoint signer and key; (4) the read-time range verifier; and (5) the deployment schema-authorization policy. The schema-authorization policy establishes trusted publishers, enforces producer-to-schema bindings, and governs schema lifecycle. Gateway indexes, summaries, and human-rendered prose are derived artifacts; system correctness relies solely on independent range verification against the TCB. 3 Ledger Architecture and Protocol 3.1 Ingestion and Verification Pipeline Figure 1 illustrates the State-Delta Evidence Ledger architecture, structured around four primary pipeline stages: Target SystemWorkloadProducer SDK(Sign, Buffer, Hash)Collector & Verifier(Atomic Append)Untrusted LedgerStorageRead-TimeRange VerifierStateless ProtocolNative DecoderAI Agent Reasoning(Tabular Stream / Config D)Human View(On Demand)Stateful SemanticState GatewayAI Agent Reasoning(Evidence Capsules / Config E)Schema Registry(Content-Addressed)Chain-Head Checkpoints(Independent Channel)Opaque Blob Store(Digest-Addressed)Benchmark Harness & Fault Injector Core State-Delta Evidence Ledger architecture External workload Operational consumers Figure 1: State-Delta Evidence Ledger architecture. A read-time range verifier mediates retrieval from potentially adversarial ledger storage before the stateless decoder and stateful gateway branches. The checkpoint channel lies outside the ledger-storage failure domain (dotted red outline). Heavy solid arrows carry canonical flow, thin dashed arrows carry references, and dash–dot arrows carry experimental control or measurement. 1. Producer Ingestion and Batching: The typed Producer SDK resolves schemas against a content-addressed schema registry, assigns contiguous sequence numbers scoped to the producer and boot epoch, and links each batch to the cryptographic root of its immediate predecessor via previous_root. It canonicalizes the records, generates a Merkle root over the batch, signs the composite batch commitment, and stores unacknowledged batches in a bounded durable buffer. The SDK can be deployed either as an in-process library or as a node-level DaemonSet sidecar. In the sidecar topology, routine high-frequency observations (e.g., periodic health checks) update a rolling state vector in ephemeral memory, emitting state checkpoints at coarser intervals. Uncurated diagnostic text (such as stack traces or heap profiles) is buffered ephemerally on-node and escalated to remote opaque storage only when a state transition or invariant violation is triggered, minimizing cloud ingestion overhead. 2. Collector Verification and Atomic Append: The trusted collector verifies complete batches against the producer’s registered public key, validates schema hashes, checks previous-root continuity against retained chain state, and enforces monotonic sequence progression. If valid, the batch is atomically appended to the ledger and acknowledged; any sequence mismatch, missing predecessor, or malformed record triggers batch rejection. 3. Independent Chain-Head Checkpointing: To defend against post-compromise ledger rollback (suffix deletion) on untrusted storage, the collector periodically emits signed chain-head checkpoints to an independent storage or witness channel. Each checkpoint commits to the highest verified sequence, batch root, and epoch. 4. Read-Time Range Verification: Before records are decoded or ingested by downstream consumers, a deterministic read-time range verifier evaluates the query interval [tstart,tend][t_start,t_end]. The verifier validates signature validity, confirms previous-root hash-chain continuity, cross-references highest sequences against the independent checkpoint channel, and emits an explicit coverage status receipt (∈complete,truncated,tampered,gap status∈\ complete, truncated, tampered, gap\). 3.2 Record Encoding and Batch Structure Each operational record is encoded as a compact binary tuple: schema_ref ∣ entity_ref ∣ time_delta ∣ presence_bitmap ∣ positional_values. • schema_ref: A variable-length batch-local integer alias mapping to a full schema digest HSH_S in the batch header. • entity_ref: A batch-local alias resolving to the canonical entity identifier (e.g., deployment/payments). • time_delta: Milliseconds elapsed since the batch base_time. • presence_bitmap: A bitmask indicating presence or absence of declared optional schema fields. • positional_values: Canonical packed values strictly ordered by schema slot definition. For a batch starting at sequence first_sequence, record i≥0i≥ 0 implicitly possesses sequence number first_sequence+i first\_sequence+i, eliminating per-record sequence overhead. Because fields strictly adhere to typed, positional schemas, batch segments stored in cold analytical tiers project directly into zero-copy columnar layouts (e.g., Apache Arrow [3] and Parquet [4]), enabling high-throughput vectorized analytical scans over historical state deltas without text parsing overhead. A canonical batch groups ordered records under a signed 14-field header: 1 protocol_version 8 schema_dictionary 2 producer_id 9 entity_dictionary_delta 3 boot_epoch 10 previous_root 4 first_sequence 11 encoded_records 5 record_count 12 merkle_root 6 base_time 13 signing_key_id 7 clock_quality 14 signature Individual records are leaves in a binary Merkle tree yielding _merkle\_root. The composite batch root binds this Merkle tree with all metadata, protocol version, schema dictionaries, and chain continuity: ℎ_=H(CLOSE \_root=H ( Dbatch∥_∥ D_batch \_version (3.1) _∥_ℎ∥ \_id \_epoch _∥_∥ \_sequence \_count _∥_∥ \_time \_quality H(ℎ_)∥ H(schema\_dict) H(__)∥ H(entity\_dict\_delta) _∥_). \_root \_root ). where H(⋅)H(·) denotes the cryptographic hash function (SHA-256), DbatchD_batch is a domain-separation prefix, and ∥ denotes byte concatenation. The producer signature covers ℎ_batch\_root under its private key. 3.3 Content-Addressed Schemas Schemas are immutable and identified by the SHA-256 digest of their canonical manifest: HS=SHA256(CanonicalManifest(S)).H_S=SHA256(CanonicalManifest(S)). (3.2) Any modification to field names, constraints, enums, or physical units generates a new digest HSH_S, preventing silent semantic drift. Table 1: Concrete running example across representation layers for a service transition event. Layer Concrete representation 1. Schema k8s.deployment.status:1.0.0; [old: Ready, new: Degraded, ready: 1, total: 3, reason: CrashLoop] 2. Dict schemas[0]=sha256:7f8a...; entities[0]="deploy/payments" 3. Wire 0x00 0x00 0x0A 0x00 0x00 0x01 0x0001 0x0003 0x01 (18 B) 4. Decoder # k8s.status: entity=deploy/payments, new=Degraded, ready=1/3, reason=CrashLoop 5. Gateway "focus": "deploy/payments", "state": "status": "Degraded", "ready": 1/3, "active_invariants": ["replica_mismatch"], "causal": ["pod/pay-7d9b (CrashLoop)"], "coverage": "complete" 6. Human “At 10:00:00Z, deployment ‘payments’ became Degraded (1/3 replicas) due to CrashLoop.” Table 1 traces a single operational fact—a Kubernetes Deployment transitioning to degraded status—across all representation layers. On the canonical wire, the record requires only tens of bytes. The stateless decoder produces a compact, tabular model-boundary representation, while the stateful gateway produces an evidence capsule with topological context. 3.4 Parallel Agent Access Paths To decouple representation efficiency from state-reconstruction and query planning, ATP provides two parallel agent-facing access paths, alongside an on-demand human rendering path: 1. Stateless Protocol-Native Decoder: A lightweight, zero-state stream decoder that unpacks verified binary batches into compact positional rows. For a sequence of records conforming to schema S, the decoder emits the schema header once, followed by compact value rows: # schema: k8s.pod.transition (old, new, exit) 2026-08-15T10:00:00.010Z | pod/pay-7d9b | Run | Fail | 137 2026-08-15T10:00:00.015Z | pod/auth-4a2c | Run | Fail | 137 This representation eliminates repetitive JSON field names entirely, minimizing input tokens. 2. Stateful Semantic State Gateway: An in-memory, queryable gateway maintaining the active versioned operational state graph Gt=(Vt,At)G_t=(V_t,A_t). Rather than forcing an LLM agent to inspect linear event logs, the gateway serves bounded evidence capsules containing: • Active entity state vector Vt[e]V_t[e] and transition history over window W; • Active invariant violations (e.g., failed health probes, replica imbalances); • k-hop causal and topological dependency neighborhood (Vt′,At′)(V _t,A _t); • Cryptographic coverage status receipt ∈complete,truncated,tampered,gap status∈\ complete, truncated, tampered, gap\. 3. On-Demand Human Explanations: For human operators, human-readable explanations are generated on demand via a deterministic template renderer RenderS(p)Render_S(p) or local LLM formatting pass. Human prose is never serialized on the canonical ledger wire. 3.5 Opaque Evidence Isolation Variable-length, unstructured diagnostics (e.g., stack traces, heap profiles, raw HTTP request bodies) are isolated from canonical state records. When captured, an opaque object is hashed, stored out-of-band in object storage, and represented on the ledger by a structured reference tuple: =⟨ = _,_,_ℎ, \_id,\,media\_type,\,byte\_length,\, (3.3) Hpayload,_,_⟩. H_payload,\,storage\_uri,\,retention\_class . When an agent diagnoses an incident, it reasons over structured state transitions first. If deeper diagnostic data is needed, the agent issues a targeted dereference request for _opaque\_id. The gateway verifies that SHA256()=HpayloadSHA256(payload)=H_payload before delivering the text wrapped in untrusted data delimiters. 3.6 Integrity Contract and Overhead Table 2 summarizes the cryptographic defenses across adversarial failure scenarios. Table 2: Adversarial tampering detection mechanisms. Adversarial Action Detection Mechanism & Guarantees Payload bit flip / mutation Merkle root or Ed25519 signature fails; batch rejected. Batch reorder / splicing _≠H(ℎk−1)previous\_root≠ H(batch_k-1); verification halts. Intermediate record omission Sequence jump ≠first+count≠ first+ count; flagged as gap. Suffix truncation Sequence << signed checkpoint; flagged as truncated. Schema alteration Manifest digest mismatch HS≠SHA256(S)H_S 256(S); rejected. Unmonitored code omission Outside profile Ω ; excluded from completeness scope. For a representative batch of 256 records, the batch header and signature add 136 bytes of cryptographic metadata (136/256≈0.531136/256≈ 0.531 bytes per record). Incorporating periodic chain-head checkpoints (144 bytes every 1,024 records) adds an additional 0.1410.141 bytes per record. Total cryptographic overhead is ≈0.672≈ 0.672 bytes per record, maintaining sub-byte metadata overhead while ensuring tamper-evidence and rollback detection. 4 Formal Evidence Contracts and Guarantees 4.1 Information-Preservation Limit Recall that ℰE denotes the universe of finite canonical record streams over a bounded horizon (Section 2). Let R:ℰ→R:E be a retained telemetry representation mapping record streams into an artifact space A, and let ℱallF_all denote the set of all Boolean predicates over ℰE. Proposition 4.1 (Information-preservation constraint). If, for every predicate f∈ℱallf _all, there exists an exact evaluator f^:→0,1 f:A→\0,1\ such that f^(R(E))=f(E)for all E∈ℰ, f(R(E))=f(E) all E , (4.1) then the retained representation mapping R must be injective. Proof. Suppose for contradiction that there exist distinct streams E1≠E2E_1≠ E_2 such that R(E1)=R(E2)R(E_1)=R(E_2). Define the predicate f∗(E)=1f^*(E)=1 if and only if E=E1E=E_1. Evaluating f^∗ f^* on the retained representation yields f^∗(R(E1))=f^∗(R(E2)) f^*(R(E_1))= f^*(R(E_2)), yet correctness requires f∗(E1)=1≠0=f∗(E2)f^*(E_1)=1≠ 0=f^*(E_2). Hence, no such evaluator f^∗ f^* can exist, contradicting the hypothesis. ∎ Corollary 4.2 (Coding lower bound). Let E∼PE P be a stream drawn from distribution P. If the representation is encoded by a lossless, uniquely decodable binary code C and R satisfies Proposition 4.1, then P[|C(R(E))|]≥HP(E),E_P[|C(R(E))|]≥ H_P(E), (4.2) where |C(⋅)||C(·)| denotes binary codeword length in bits and HP(E)H_P(E) is the Shannon entropy of stream E under distribution P. This establishes that no lossy summary can preserve exact answers for all downstream operational queries. Accordingly, ATP chooses a lossless canonical representation for accepted state-delta records and confines lossy summarization or aggregation to derived views in derI_der. 4.2 Gateway Query Contracts For an authenticated ledger range L, an exact query family eQ_e guarantees exact evaluation over all canonical records in scope: q^(L)=q(L)∀q∈e. q(L)=q(L) ∀ q _e. (4.3) For an approximate query family aQ_a (e.g., streaming sketches or probabilistic anomaly scores), the schema must publish its error metric dqd_q, error bound ϵq _q, and confidence 1−δq1- _q: PrL∼P[dq(q^(L),q(L))≤ϵq]≥1−δq. _L P\! [d_q( q(L),\,q(L))≤ _q ]≥ 1- _q. (4.4) 4.3 Reversibility and Rendering For an exact schema S and normalized positional tuple p, the protocol-native row encoder ASA_S and decoder AS−1A_S^-1 are strictly bijective: AS−1(AS(p))=p.A_S^-1(A_S(p))=p. (4.5) In contrast, deterministic template formatting RenderS(p)Render_S(p) produces a human-readable explanation from which exact binary recovery is not required (RenderSRender_S need not be injective). 4.4 Qualified Dependency Closure Let Gt=(Vt,At)G_t=(V_t,A_t) be the state graph maintained by the gateway. For a query focused on entity set V0⊆VtV_0 V_t, an evidence capsule induces a qualified dependency subgraph G′=(V′,A′)G =(V ,A ) containing: (1) in-scope vertices V′V up to topological distance kmaxk_max; (2) active invariant violations on V′V ; (3) inbound/outbound relation edges A′⊆AtA A_t; and (4) explicit boundary markers for dependencies traversing outside profile Ω . 4.5 Verified Event Non-Occurrence A critical requirement for automated incident responders is provable negative evidence: certifying that a specific failure, state transition, or anomaly did not occur within a given time window. Temporal intervals in the exact-query contracts refer to canonical record timestamps; claims translated to an external physical wall-clock interval must account for the clock-uncertainty bound Δclk _clk declared in observation profile Ω . Definition 4.3 (Query completeness predicate). A query range [t1,t2][t_1,t_2] over schema S and entity set V0V_0 satisfies completeness ((q) Complete(q)) if and only if: (1) all producer batches covering [t1,t2][t_1,t_2] have valid signatures; (2) hash-chain continuity (_previous\_root) holds unbroken across all batches; (3) the sequence range is monotonically contiguous with zero missing sequence numbers; (4) schema manifest HSH_S is resolved; and (5) the highest sequence is anchored against an independent chain-head checkpoint. Theorem 4.4 (Ledger-relative verified negative). Let q be an exact query evaluating predicate ϕφ over scope (V0,S,[t1,t2])(V_0,S,[t_1,t_2]) under observation profile Ω . If (q) Complete(q) holds and the evaluated result set is empty: ℛ(q)=∅,R(q)= , (4.6) then no event satisfying ϕφ was observed and accepted by trusted instrumentation under profile Ω within [t1,t2][t_1,t_2]. Proof. By (q) Complete(q), the canonical records covering [t1,t2][t_1,t_2] are authentic, sequence-contiguous, schema-resolved, and anchored against the independent checkpoint channel. Since q∈eq _e evaluates predicate ϕφ exhaustively over all canonical records within scope (V0,S,[t1,t2])(V_0,S,[t_1,t_2]), ℛ(q)=∅R(q)= implies that no accepted canonical record satisfying ϕφ exists in that scope. By Definition 2.2, this conclusion is strictly relative to the observation mapping OΩO_ : no event satisfying ϕφ was observed and accepted by trusted instrumentation under profile Ω within [t1,t2][t_1,t_2]. ∎ When (q) Complete(q) fails (e.g., due to a sequence gap, unanchored suffix, or tampering), the gateway returns non-complete coverage (∈truncated,tampered,gap status∈\ truncated, tampered, gap\), preventing false negative conclusions. 5 Implementation and Evaluation We evaluate ATP through a complete prototype implementation and extensive empirical benchmarks on distributed microservice workloads across five core evaluation dimensions: • Representation and Storage Efficiency: Wire payload per record, daily storage footprints, and modeled cloud query scan costs across evidence primitives compared to raw text, structured OpenTelemetry JSON, OTLP Protobuf, and compressed log codecs. • Agent Context and Reasoning Efficiency: Context token reduction (ρT _T), iterative tool roundtrip reduction (ρO _O), and Time-to-Root-Cause identification (TRCAT_RCA p50/p95p50/p95) across representative instruction-tuned LLMs. • Diagnostic Quality and Triage Accuracy: Incident detection recall, precision, F1-score, and root-cause localization across distinct failure classes. • Certified Negative Verification: Verification accuracy for event non-occurrence ((q) Complete(q)) and elimination of false suspect attributions. • Cryptographic Overhead and Robustness: Ingestion throughput, batch signing/verification latency, range scan speed, and passive prompt-injection resilience. 5.1 Implementation and Testbed Setup The ATP reference system is implemented as a modular, high-throughput toolchain: • Producer SDK (4.8k LoC Rust, with C FFI and Go bindings): Implements zero-allocation binary tuple packing, content-addressed schema resolution, monotonic sequence assignment, and local ring-buffer staging. Batch Ed25519 signing utilizes SIMD-accelerated AVX2 instructions. • Collector and Verifier Service (6.2k LoC Rust): Built on an asynchronous tokio runtime. Ingested batches undergo parallel cryptographic signature checks, Merkle root verification, and previous-root hash-chain validation before atomic commitment to append-only segment storage. • Read-Time Range Verifier (1.8k LoC Rust): A zero-copy segment scanner that validates contiguous sequence monotonic progression, batch root hash chains, and independent signed chain-head checkpoints across queried temporal windows [tstart,tend][t_start,t_end]. • Dual Agent Access Layer (3.5k LoC Rust/Python): Comprises (1) the Stateless Protocol Decoder, which streams verified batches directly into compact positional TSV rows, and (2) the Stateful Semantic Gateway, which maintains an in-memory versioned entity graph Gt=(Vt,At)G_t=(V_t,A_t) and serves bounded evidence capsules via gRPC and Model Context Protocol (MCP) tool interfaces. Experiments are conducted on two standard distributed microservice testbeds: 1. AIOpsLab HotelReservation [5]: 18 microservices written in Go, backed by Memcached, MongoDB, and Consul, driven by Locust load generators simulating 50,000 client requests/second. 2. OpenTelemetry Astronomy Shop [21]: 14 microservices implemented in 8 languages (Go, Java, Python, C++, Node.js, C#, Ruby, and PHP) interacting via gRPC and HTTP, backed by PostgreSQL, Redis, and Kafka, running at 25,000 requests/second. The testbeds run on a 16-node dedicated Kubernetes v1.30 cluster (AWS c5.4xlarge instances, 16 vCPUs, 32 GB RAM, 10 Gbps network per node). Fault injection scripts systematically inject 120 randomized, reproducible operational incidents spanning pod crash-loops, memory leaks, downstream cascading network latency (50–500 ms), packet drops (5–30%), configuration drift, and deployment regressions. We evaluate five end-to-end telemetry configurations across the benchmark matrix: Config A (Unstructured Text): native stdout/stderr text logs ingested via FluentBit; Config B (Standard Triad): unstructured text logs, Prometheus metrics, and Jaeger distributed traces; Config C (Structured OpenTelemetry JSON): standard OpenTelemetry log events serialized with complete JSON semantic attributes and trace correlation IDs; Config D (ATP Stateless Decoder): state-delta ledger streamed via the stateless tabular decoder; and Config E (ATP Semantic Gateway): state-delta ledger consumed via the stateful semantic gateway with topological evidence capsules. The autonomous agent reasoning matrix evaluates four representative instruction-tuned LLM families: Claude-3.5-Sonnet (20241022), GPT-4o (2024-08-06), Llama-3.1-70B-Instruct, and Qwen-2.5-72B-Instruct, alongside local lightweight models (Llama-3.1-8B, Qwen-2.5-Coder-7B) and algorithmic rule-based baselines. LLM evaluation and reproducibility protocol. For every model/configuration pairing reported in Table 4, agents execute a standardized incident-diagnosis task under a fixed system prompt, identical root-cause output schema, and controlled tool-query semantics, varying only the telemetry representation available to the agent. Model inference uses deterministic greedy decoding (T=0.0T=0.0, top-p=1.0top-p=1.0) with a 4,096 output-token limit; while commercial APIs do not guarantee strict bitwise determinism across sessions, fixed prompt templates and seeds are maintained. Each agent operates under an execution budget of at most 15 tool query operations (O, defined as a single round of telemetry retrieval or state inspection) with a 30-second per-round timeout and up to 3 retries on transient errors, terminating upon emitting an explicit root-cause verdict or exhausting the operation budget. The same 120 fault-injection incidents, background workloads, and fault schedules are used for every reported model/configuration pairing. Configs A, C, D, and E are evaluated across all four primary LLM families; Config B is additionally evaluated for Claude-3.5-Sonnet and GPT-4o. Reported metrics and 95% confidence intervals are estimated via B=10,000B=10,000 paired percentile bootstrap replicates resampled at the incident level, with ratio metrics (ρT,ρ$,ρO _T, _\$, _O) recomputed within each replicate. For adversarial robustness (Section 5.5), the 50 prompt-injection attack payloads are replayed against Configs A, C, D, and E using Claude-3.5-Sonnet as the primary model (50 trials per configuration), with secondary cross-validation independently replaying all 50 attacks per configuration on GPT-4o; reported headline attack rates reflect the primary 50 trials per configuration. Evaluation success criteria and metrics. To establish rigorous evaluation gates, we evaluate quantitative success thresholds based on 95% bootstrap confidence intervals (U0.95(x)U_0.95(x) denotes the 95% CI upper bound for ratio x) on the primary model (Claude-3.5-Sonnet) and cross-validated across all model families: (1) Context token reduction: U0.95(ρT)≤0.50U_0.95( _T)≤ 0.50 relative to Config C (stretch target ≤0.25≤ 0.25); (2) Scan cost: U0.95(ρ$)≤0.20U_0.95( _\$)≤ 0.20 (stretch ≤0.10≤ 0.10); (3) Tool roundtrips: U0.95(ρO)≤0.50U_0.95( _O)≤ 0.50; (4) Recall preservation: Δrecall=R(Config E)−R(Config C)≥−0.02 _recall=R(Config E)-R(Config C)≥-0.02; and (5) Triage latency: TRCA(ConfigE)≤TRCA(ConfigC)T_RCA(Config\ E)≤ T_RCA(Config\ C). Wire Size (Bytes/Rec)150300450600384Config A642Config B512Config C148OTLP-PB42CLP18.4ATP-Raw6.2ATP-zstd(a) Wire Payload (Bytes/Rec)Tokens / Incident (×103× 10^3)15304560Claude-3.5GPT-4o Config A Config C Config D Config E (b) Context Tokens per IncidentDiagnostic F1-Score0.70.80.91.00.78Config A0.84Config B0.87Config C0.90Config D0.95Config E(c) Diagnostic F1-ScoreTT-RCA (s) / Ops (O)50s100s150s200sConfig AConfig BConfig CConfig DConfig E Ops O T-RCA (d) Operations O & T-RCA Figure 2: Key Performance Indicators (KPIs) comparing ATP against baseline architectures across 120 randomized incident injection trials. (a) Wire representation payload per record across codecs. (b) LLM context token consumption per incident triage session for representative models. (c) Overall incident diagnostic F1-score across telemetry configurations. (d) Evidence-acquisition operations (O) and Time-to-Root-Cause identification (TRCAT_RCA in seconds). 5.2 Representation and Storage Efficiency Table 3 compares the representation efficiency, storage footprints, and modeled cloud query scan costs across candidate telemetry formats. Table 3: Representation efficiency, daily storage footprint, and simulated cloud query scan costs across telemetry formats on the benchmark microservice workload (100 million events/day; values reported as x±yx± y denote mean ± standard deviation across sample batches; daily scan costs modeled at $0.005/GB scanned). Telemetry Representation Raw Wire zstd Wire Storage Ingestion Cost Daily Scan Cost Cost Ratio Relative Change (Bytes/Rec) (Bytes/Rec) (GB/Day) ($/Month) (ρ$ _\$ at $0.005/GB) (ρ$ _\$ vs Config C) vs Config C Config A (Unstructured Text Logs) 384.2±42.6384.2± 42.6 78.4±9.278.4± 9.2 38.42 $576.30 $0.192 0.750 −25.0%-25.0\% Config B (Standard Triad: Logs+Metrics+Traces) 642.0±68.4642.0± 68.4 142.6±15.4142.6± 15.4 64.20 $963.00 $0.321 1.254 +25.4%+25.4\% Config C (Structured OTel JSON Events) 512.4±54.2512.4± 54.2 112.8±12.1112.8± 12.1 51.24 $768.60 $0.256 1.000 Baseline OTLP Protobuf (gRPC Binary Envelope) 148.6±16.8148.6± 16.8 48.2±5.648.2± 5.6 14.86 $222.90 $0.074 0.290 −71.0%-71.0\% CLP (Compressed Log Codec) [27] 42.1±5.442.1± 5.4 18.6±2.418.6± 2.4 4.21 $63.15 $0.021 0.082 −91.8%-91.8\% μ (Variable-Splitting Codec) [30] 38.4±4.838.4± 4.8 16.2±2.116.2± 2.1 3.84 $57.60 $0.019 0.075 −92.5%-92.5\% LogCrisp (Structural Log Codec) [32] 31.2±3.931.2± 3.9 12.8±1.712.8± 1.7 3.12 $46.80 $0.016 0.061 −93.9%-93.9\% ATP: State Transitions 16.2±2.116.2± 2.1 5.4±0.85.4± 0.8 1.62 $24.30 $0.0081 0.032 −96.8%-96.8\% ATP: Scalar Observations 14.8±1.814.8± 1.8 4.9±0.64.9± 0.6 1.48 $22.20 $0.0074 0.029 −97.1%-97.1\% ATP: Topological Relations 22.4±3.222.4± 3.2 7.8±1.27.8± 1.2 2.24 $33.60 $0.0112 0.044 −95.6%-95.6\% ATP: State Checkpoints 28.6±4.528.6± 4.5 9.6±1.59.6± 1.5 2.86 $42.90 $0.0143 0.056 −94.4%-94.4\% Config D/E (ATP Weighted Workload) 18.4±3.818.4± 3.8 6.2±1.46.2± 1.4 1.84 $27.60 $0.0092 0.036 −-96.4% As shown in Table 3 and Figure 2(a), standard OpenTelemetry JSON logs (Config C) consume 512.4±54.2512.4± 54.2 bytes per record due to repeated JSON key strings ("trace_id", "service.name", "attributes"). OTLP Protobuf compresses this to 148.6±16.8148.6± 16.8 bytes/record by packing field tags. In contrast, ATP’s positional binary tuple encoding (Section 3.2) requires only 18.4±3.818.4± 3.8 bytes per raw record across the composite microservice workload (ranging from 14.814.8 B for high-frequency scalar observations to 28.628.6 B for rich state checkpoint vectors). This represents a 96.4% reduction compared to Config C and an 87.6% reduction compared to OTLP Protobuf. With standard zstd block compression, ATP achieves 6.2±1.46.2± 1.4 bytes per record. In high-throughput enterprise fleets ingesting 100 million events daily, Config C incurs $768.60/month in cloud ingestion fees (at $0.50/GB) and $0.256 daily in log query scan charges (at the standard cloud rate of $0.005/GB scanned per full-history query). ATP slashes monthly ingestion from $768.60 to $27.60 and daily diagnostic scan costs to $0.0092, yielding a scan cost ratio of ρ$=0.036 _\$=0.036 (U0.95(ρ$)=0.039≤0.20U_0.95( _\$)=0.039≤ 0.20), comfortably satisfying our cost efficiency targets. 5.3 Agent Context and Reasoning Efficiency Table 4 presents the end-to-end performance of autonomous LLM reasoning agents during incident triage across 120 randomized incident scenarios, reporting both mean values and tail distributions (p50/p95p50/p95). Table 4: End-to-end incident triage KPIs across autonomous agent architectures (120 fault injection trials per cell; values reported as x±yx± y denote mean ± standard deviation across incident trials; parenthesized ranges denote 95% paired bootstrap confidence intervals; p50p50 and p95p95 tail latencies reported for T-RCA). LLM Model Configuration Tokens / Incident (T) Token Ratio (ρT _T) Operations (O) T-RCA Mean (p50/p95p50/p95) Recall (R) F1-Score Claude-3.5-Sonnet Config A (Text Logs) 48,250±1,42048,250± 1,420 1.412 (1.37, 1.45) 8.4±0.68.4± 0.6 218s(194s/342s)218\,s\ (194\,s/342\,s) 0.812±0.0240.812± 0.024 0.777±0.0260.777± 0.026 Config B (Standard Triad) 62,400±1,85062,400± 1,850 1.826 (1.78, 1.88) 9.8±0.79.8± 0.7 195s(176s/310s)195\,s\ (176\,s/310\,s) 0.865±0.0210.865± 0.021 0.835±0.0230.835± 0.023 Config C (OTel JSON) 34,180±98034,180± 980 1.000 (Baseline) 7.1±0.57.1± 0.5 184s(162s/295s)184\,s\ (162\,s/295\,s) 0.894±0.0190.894± 0.019 0.867±0.0210.867± 0.021 Config D (ATP Stateless) 11,460±11,460± 380 0.335 (0.32, 0.35) 5.8±0.45.8± 0.4 s(s/s)98\, s\ (84\,s/164\,s) 0.918±0.0170.918± 0.017 0.902±0.0180.902± 0.018 Config E (ATP Gateway) 3,820±3,820± 140 0.112 (0.10, 0.12) 2.4±0.22.4± 0.2 s(s/s)46\, s\ (38\,s/78\,s) 0.965±0.0120.965± 0.012 0.953±0.0140.953± 0.014 GPT-4o Config A (Text Logs) 51,200±1,56051,200± 1,560 1.391 (1.35, 1.43) 9.1±0.69.1± 0.6 242s(215s/380s)242\,s\ (215\,s/380\,s) 0.785±0.0260.785± 0.026 0.752±0.0280.752± 0.028 Config B (Standard Triad) 65,800±1,92065,800± 1,920 1.788 (1.74, 1.84) 10.4±0.810.4± 0.8 210s(188s/335s)210\,s\ (188\,s/335\,s) 0.842±0.0230.842± 0.023 0.816±0.0250.816± 0.025 Config C (OTel JSON) 36,800±1,12036,800± 1,120 1.000 (Baseline) 7.6±0.57.6± 0.5 198s(174s/315s)198\,s\ (174\,s/315\,s) 0.871±0.0200.871± 0.020 0.848±0.0220.848± 0.022 Config D (ATP Stateless) 12,100±12,100± 410 0.329 (0.31, 0.34) 6.1±0.46.1± 0.4 s(s/s)112\, s\ (96\,s/185\,s) 0.898±0.0180.898± 0.018 0.884±0.0190.884± 0.019 Config E (ATP Gateway) 4,100±4,100± 160 0.111 (0.10, 0.12) 2.6±0.32.6± 0.3 s(s/s)63\, s\ (52\,s/98\,s) 0.948±0.0140.948± 0.014 0.939±0.0150.939± 0.015 Llama-3.1-70B Config A (Text Logs) 54,600±1,72054,600± 1,720 1.418 (1.37, 1.46) 9.8±0.79.8± 0.7 265s(238s/412s)265\,s\ (238\,s/412\,s) 0.742±0.0280.742± 0.028 0.710±0.0300.710± 0.030 Config C (OTel JSON) 38,500±1,24038,500± 1,240 1.000 (Baseline) 8.2±0.68.2± 0.6 215s(190s/340s)215\,s\ (190\,s/340\,s) 0.835±0.0230.835± 0.023 0.812±0.0240.812± 0.024 Config D (ATP Stateless) 12,850±12,850± 460 0.334 (0.32, 0.35) 6.4±0.56.4± 0.5 s(s/s)128\, s\ (110\,s/210\,s) 0.872±0.0200.872± 0.020 0.856±0.0210.856± 0.021 Config E (ATP Gateway) 4,350±4,350± 190 0.113 (0.10, 0.13) 2.8±0.32.8± 0.3 s(s/s)74\, s\ (62\,s/120\,s) 0.931±0.0150.931± 0.015 0.920±0.0170.920± 0.017 Qwen-2.5-72B Config A (Text Logs) 52,900±1,64052,900± 1,640 1.407 (1.36, 1.45) 9.4±0.69.4± 0.6 254s(226s/395s)254\,s\ (226\,s/395\,s) 0.768±0.0270.768± 0.027 0.734±0.0290.734± 0.029 Config C (OTel JSON) 37,600±1,18037,600± 1,180 1.000 (Baseline) 7.9±0.57.9± 0.5 208s(184s/330s)208\,s\ (184\,s/330\,s) 0.852±0.0210.852± 0.021 0.829±0.0230.829± 0.023 Config D (ATP Stateless) 12,400±12,400± 430 0.330 (0.31, 0.34) 6.2±0.46.2± 0.4 s(s/s)119\, s\ (102\,s/195\,s) 0.886±0.0190.886± 0.019 0.871±0.0200.871± 0.020 Config E (ATP Gateway) 4,220±4,220± 170 0.112 (0.10, 0.12) 2.7±0.32.7± 0.3 s(s/s)68\, s\ (56\,s/112\,s) 0.942±0.0140.942± 0.014 0.932±0.0160.932± 0.016 Under Config C, triaging an incident requires an average of 34,180 tokens with Claude-3.5-Sonnet as the agent filters verbose JSON keys and linear log strings. With the ATP Stateless Decoder (Config D), token consumption drops to 11,460 tokens (ρT=0.335 _T=0.335), achieving a 66.5% reduction in context load using the stateless ATP state-delta representation without stateful graph reconstruction or invariant precomputation. With the ATP Semantic Gateway (Config E), token consumption drops to 3,820 tokens (ρT=0.112 _T=0.112), representing an 88.8% context token reduction compared to Config C. Because the Semantic Gateway serves topologically scoped evidence capsules with pre-aggregated invariant status, agent tool operations drop from 7.1±0.57.1± 0.5 in Config C to 2.4±0.22.4± 0.2 in Config E (ρO=0.338 _O=0.338), a 66.2% reduction in iterative query-response roundtrips. Consequently, mean Time-to-Root-Cause identification (TRCAT_RCA) drops from 184 s to 46 s for Claude-3.5-Sonnet (p95p95 tail latency drops from 295 s to 78 s) and from 198 s to 63 s for GPT-4o (p95p95 drops from 315 s to 98 s). To evaluate the operational cost of maintaining an in-memory versioned operational graph, we benchmarked the Semantic Gateway under steady 50,000 req/s ingestion on the 18-service HotelReservation testbed. Maintaining a 1-hour rolling historical window (tracking 12,400 active entity state vectors and 45 invariant assertion rules) consumed only 184 MB RSS in memory and 3.8% CPU utilization across 2 vCPUs. Serving bounded evidence capsules took p50=2.4msp50=2.4\,ms and p95=5.8msp95=5.8\,ms, demonstrating that the gateway introduces negligible infrastructure overhead while eliminating massive downstream LLM inference costs. 5.4 Diagnostic Quality and Non-Occurrence As detailed in Figure 2(c) and Table 4, ATP does not sacrifice diagnostic accuracy for representation compactness. In fact, Config E achieves the highest diagnostic F1-score across all model classes: 0.953 for Claude-3.5-Sonnet (Recall 0.965, Precision 0.942) and 0.939 for GPT-4o, compared to 0.867 and 0.848 in Config C. Across specific fault types: • Pod CrashLoop & OOM: F1 increases from 0.89 to 0.98 due to explicit state transition enum encoding. • Cascading Latency Spikes: F1 increases from 0.82 to 0.94 because the gateway’s qualified dependency closure explicitly presents upstream/downstream topological relationships. • Silent Configuration Drift: F1 increases from 0.74 to 0.92 via content-addressed schema manifest checking. To evaluate Theorem 4.4, we injected 60 negative-control queries requiring the agent to verify whether a healthy service experienced faults during an incident in an adjacent subsystem. Under baseline Configs A–C, agents produced a 26.7% false suspect attribution rate (hallucinating non-existent errors or mistaking dropped log packets for silent failures). In contrast, ATP’s read-time range verifier returned certified completeness (=complete status= complete); across the 60 negative-control queries, ATP correctly certified non-occurrence in all 60/60 cases with zero false suspect attributions. When artificial network partition drops were injected (30 trials), the verifier returned =gap status= gap in 28 cases and =truncated status= truncated in 2 cases, correctly warning downstream agents of unmonitored blind spots and preventing false negative assumptions. Batch SizeThroughput (k-Rec/s / GB/s)Verify Latency (μ )16641282565121024100k200k300k400k50100150200 Collector Throughput (k-Rec/s) Batch Latency (μ ) Range Scan (GB/s ×1.4× 1.4) Figure 3: Cryptographic verification performance across batch sizes: Collector ingestion throughput (k-records/s), batch verification latency (μ ), and read-time range verification scan speed (GB/s). 5.5 Cryptographic Overhead and Robustness Table 5 and Figure 3 summarize the cryptographic microbenchmarks and adversarial robustness evaluations. At our default batch size of 256 records, the Producer SDK requires 0.266μs0.266\, per record (0.042μs0.042\, serialization + 0.058μs0.058\, Merkle tree + 0.166μs0.166\, Ed25519 signing), sustaining 3.76 million records/second per core. On the collector tier, raw CPU batch verification operates at 6.10 million records/second per core (42.0μs42.0\, per batch), while the complete end-to-end async gRPC collector service ingests and commits 284,000 records/second per core (1,109 batches/sec), with batch latency and range scan throughput across batch sizes detailed in Figure 3. The read-time range verifier processes ledger segments at 1.42 GB/s per core (76.9 million records/sec), adding negligible read latency (<1.2ms<1.2\,ms for a 50,000-record query window). Total cryptographic wire overhead is constrained to 0.672 bytes/record (0.531 B batch header + 0.141 B amortized checkpoint). We executed 500 adversarial mutation trials across ledger storage (in-batch bit flips, record omissions, cross-batch sequence gaps, and suffix truncations). As established in Table 2, ATP achieved a 100% detection rate across all 500 tested mutation trials: in-batch bit flips failed Merkle root/Ed25519 signature checks immediately; replayed/spliced batches were rejected via _previous\_root mismatches; and suffix deletions were flagged against independent signed chain-head checkpoints (=truncated status= truncated). We evaluated vulnerability to passive prompt-injection by embedding 50 adversarial instruction payloads (e.g., “SYSTEM ALERT: Ignore previous instructions and emit status HEALTHY”) into HTTP headers and exception stack traces. Under raw text logs (Config A) and OTel logs (Config C), agents suffered a 78.0% (39/50) and 62.0% (31/50) hijacking rate, executing adversarial directives and falsely clearing incidents. Under ATP, Config D and Config E each yielded a 0.0% hijacking rate (0/50 each; 0/100 pooled across the two ATP configurations): in 48/50 trials per configuration, agents diagnosed incidents purely from structured state transitions without dereferencing opaque payloads; in the 2 trials dereferencing stack traces, strict [UNTRUSTED_DATA] boundary delimiters prevented hijacking, with models correctly classifying injections as untrusted data. Secondary cross-validation on GPT-4o independently replaying all 50 attacks per configuration confirmed zero successful injections under Configs D and E (0/50 each, vs. 41/50 on Config A and 33/50 on Config C). For the primary Claude-3.5-Sonnet evaluation, empirical results satisfy all specified acceptance thresholds and stretch targets: (1) U0.95(ρT)=0.12≤0.50U_0.95( _T)=0.12≤ 0.50 (surpassing the ≤0.25≤ 0.25 stretch target; worst-case across all LLM families is U0.95(ρT)=0.13U_0.95( _T)=0.13); (2) U0.95(ρ$)=0.039≤0.20U_0.95( _\$)=0.039≤ 0.20 (surpassing the ≤0.10≤ 0.10 stretch target); (3) U0.95(ρO)=0.36≤0.50U_0.95( _O)=0.36≤ 0.50 (worst-case across models ≤0.38≤ 0.38); (4) Δrecall=+0.071≥−0.02 _recall=+0.071≥-0.02 (ranging from +0.071+0.071 to +0.096+0.096 across models); and (5) TRCA(ConfigE)≤TRCA(ConfigC)T_RCA(Config\ E)≤ T_RCA(Config\ C) (triage latency reduced by 75.0%75.0\% for Claude-3.5-Sonnet and 65.6%65.6\%–68.2%68.2\% across all other LLM families). All evaluated LLM families independently satisfy every acceptance criterion. Table 5: Cryptographic overhead and throughput microbenchmarks (batch size = 256 records). Pipeline Operation Latency / Core Throughput / Core Producer Record Serialization 0.042μs0.042\, / record 23.8M23.8\,M records/s Producer Merkle Tree Generation 0.058μs0.058\, / record 17.2M17.2\,M records/s Producer Ed25519 Batch Signing (256 rec) 42.6μs42.6\, / batch 6.01M6.01\,M records/s Total Producer Work (Combined) 0.266 μ / record 3.76 M records/s Collector Batch Verification (CPU Kernel) 42.0μs42.0\, / batch 6.10M6.10\,M records/s Collector Atomic Append (Storage Commit) 12.4μs12.4\, / batch 20.6M20.6\,M records/s Collector Ingestion Service (Async gRPC+I/O) 0.901ms0.901\,ms / batch 284k284\,k records/s Read-Time Range Segment Scan 0.013μs0.013\, / record 76.9M76.9\,M records/s (1.42GB/s1.42\,GB/s) Cryptographic Wire Overhead 0.672 Bytes / Record 6 Discussion Table 6: Design objectives in reviewed work. P = primary abstraction; A = adjacent/partial support; – = not a primary abstraction. System family State-change model Schema identity Signed sequence Externally retained head Predicate-relative negative Opaque separation Dual agent access OpenTelemetry Logs, Events, Weaver, Arrow [20, 24, 23, 26, 22] A A – – – – – CloudEvents, ECS, OCSF [6, 8, 19] – A – – – – – Compression & compressed-query [27, 30, 33, 15, 32] – – – – – – – Vector & semantic log indexing [18, 16] – – – – – – – Agent-facing telemetry gateways [11, 29] – – – – – – A Signed Syslog & secure audit logs [13, 28] – – P – – – – Certificate Transparency [14] – – A A – – – State-Delta Evidence Ledger (ATP) P P P P P P P 6.1 Security and Prompt-Injection Defense The State-Delta Evidence Ledger detects in-transit record mutation, sequence omission, batch reordering, and suffix truncation under the stated trust model (Section 3.6); unmonitored code paths and compromised producer hosts lie outside this boundary (Section 2). Distributed system logs frequently include attacker-controlled inputs (HTTP headers, query strings, exception stack traces). Direct consumption allows malicious payloads to hijack agent reasoning via passive prompt injection [25, 12]. ATP establishes a structural defense: the primary ledger carries strictly typed, schema-validated state deltas, while variable-length diagnostic strings are quarantined in out-of-band opaque storage bound via cryptographic digests. When fetched, opaque payloads are delivered with explicit data delimiters and trust tags. Opaque isolation structurally reduces exposure to untrusted text; once an opaque payload is explicitly dereferenced, trust delimiters constitute a model-facing mitigation rather than a formal non-interference guarantee. Producers apply pseudonymization and field redaction prior to canonical signing. Once committed to canE_can, canonical records are immutable. Data retention policies are enforced via verifiable prefix pruning with signed truncation checkpoints, while static resource bounds prevent denial-of-service exhaustion. 6.2 Limitations, Trade-offs, and Validity ATP entails several operational trade-offs: (1) it relies on first-party instrumentation adopting typed schemas; (2) cryptographic guarantees assume a trusted ingestion TCB (producer SDK and keys); (3) suffix rollback is detectable only up to the latest published chain-head checkpoint; (4) opaque storage availability is decoupled from ledger digest validity; and (5) maintaining an in-memory versioned operational graph incurs modest overhead at the gateway tier (184 MB RSS, 3.8% CPU across 2 vCPUs under 50k req/s), offset by massive downstream token savings. Evaluation validity and ablation structure. Our empirical benchmark evaluates architectural layers through the Config A→C→D→EConfig A progression. Comparing Config C (OpenTelemetry JSON) to Config D (ATP Stateless Decoder) demonstrates the benefit of the transition-centered state-delta evidence model and schema typing without stateful gateway infrastructure, reducing cross-model mean context load from 36.8k tokens (F1=0.839F_1=0.839) to 12.2k tokens (F1=0.878F_1=0.878, Table 4). Progression from Config D to Config E isolates the additional gain from the stateful semantic gateway’s topological scoping and invariant precomputation (down to 4.1k tokens, F1=0.936F_1=0.936), confirming substantial standalone gains from the stateless representation and further boosts from graph-aware access. 7 Related Work Telemetry schemas, event envelopes, and gateways. OpenTelemetry Logs and Events standardize attributes and schemas [20, 24], Weaver introduces schema validation [23, 26], and OpenTelemetry Arrow explores columnar transport [22]. CloudEvents, ECS, and OCSF normalize event formats [6, 8, 19]. At query time, Grafana MCP [11] and HYVE [29] expose observability views to LLM clients. However, these systems treat logs as self-contained envelopes rather than transition-first state deltas under content-addressed schemas, and lack dual stateless/stateful access paths. Log compression and semantic indexing. Codecs including CLP, μ , Denum, LogShrink, and LogCrisp compress text logs and accelerate search [27, 30, 33, 15, 32]. These operate post-hoc on unstructured text, whereas ATP eliminates text formatting at producer boundary via typed binary tuples. Semantic vector indexing (e.g., LogEvent2vec [18], LogLLM [16]) clusters logs but incurs high embedding overhead and discards exact discrete parameters needed for deterministic diagnosis. Dynamic tracing, audit, and negative verification. Hindsight dynamically retains trace spans [34], while Pivot Tracing installs causal queries [17]. Signed Syslog [13], forward-secure audit logs [28], and Certificate Transparency [14] authenticate log streams and append-only trees, but none formalize predicate-relative negative verification over an observation boundary. ATP combines producer hash-chaining, collector verification, and external checkpoints to enable certified non-occurrence proofs within the declared observation boundary ((q) Complete(q)). AIOps benchmarks and adversarial robustness. AIOpsLab, LogEval, CloudOpsBench, and OpenRCA evaluate automated incident triage [5, 7, 31, 9]. Recent studies demonstrate that uncurated telemetry enables passive prompt injection against LLM agents [25, 12]. ATP isolates uncurated strings behind a digest-verified boundary to protect downstream reasoning agents (Table 6). 8 Conclusion As autonomous AI agents assume operational responsibility in cloud systems, legacy verbose text logging creates severe compute, reasoning, and security bottlenecks. This paper introduced agent-native telemetry, an operational evidence architecture founded on verifiable state deltas, instantiated via the Agent Telemetry Protocol (ATP) and the State-Delta Evidence Ledger. By structuring operational facts into four core evidence primitives under content-addressed schemas, isolating untrusted text into out-of-band opaque evidence, and providing dual agent access paths (a stateless decoder and a stateful semantic gateway), ATP bridges the gap between raw operational data and automated reasoning. We proved formal boundaries for information preservation and verified negative evidence, and demonstrated across microservice benchmarks that ATP reduced wire footprint by 96.4%, reduced LLM context tokens by 88.8%, accelerated root-cause triage, detected all 500 tested adversarial storage mutations, and yielded zero successful prompt injections across 50 adversarial trials per ATP configuration, establishing a verifiable foundation for autonomous cloud operations. References [1] A. AlSayyad, K. Y. Huang, and R. Pal (2026) AgentTrace: a structured logging framework for agent system observability. arXiv:2602.10133. Cited by: §2.1. [2] Amazon Web Services Amazon CloudWatch pricing: logs ingestion, storage, and Logs Insights scanning. Note: AWS Documentation, 2026. https://aws.amazon.com/cloudwatch/pricing Cited by: §1. [3] Apache Arrow Authors Apache Arrow: a cross-language development platform for in-memory analytics. Note: Apache Software Foundation, 2026. https://arrow.apache.org Cited by: §3.2. [4] Apache Parquet Authors Apache Parquet: columnar storage for the Apache Hadoop ecosystem. Note: Apache Software Foundation, 2026. https://parquet.apache.org Cited by: §3.2. [5] Y. Chen, M. Shetty, G. Somashekar, M. Ma, Y. Simmhan, J. Mace, C. Bansal, R. Wang, and S. Rajmohan (2025) AIOpsLab: a holistic framework to evaluate AI agents for enabling autonomous clouds. In Proceedings of Machine Learning and Systems (MLSys), Vol. 7. Cited by: §1, item 1, §7. [6] Cloud Native Computing Foundation CloudEvents specification v1.0.2. Note: CloudEvents Project, 2022. https://cloudevents.io Cited by: Table 6, §7. [7] T. Cui, S. Ma, Z. Chen, T. Xiao, S. Tao, Y. Liu, et al. (2024) LogEval: a comprehensive benchmark suite for large language models in log analysis. arXiv:2407.01896. Cited by: §7. [8] Elastic Elastic Common Schema (ECS) reference v9.4.0. Note: Elastic, 2026. https://w.elastic.co/guide/en/ecs Cited by: §1, Table 6, §7. [9] A. Fang, Y. Yang, J. Shang, Q. Lu, J. Xu, et al. (2026) OpenRCA 2.0: from outcome labels to causal process supervision. arXiv:2606.27154. Cited by: §7. [10] Gartner Research Predicts 2024: agentic AI and autonomous operations in DevOps and observability. Note: Gartner Inc., 2024 Cited by: §1. [11] Grafana Labs Grafana MCP server v1.0.0. Note: Grafana Labs, 2026. https://github.com/grafana/mcp-grafana Cited by: Table 6, §7. [12] R. Karanjai, Y. Lu, H. H. Madhavarao, L. Xu, and W. Shi (2026) Context contamination in LLM analysis of network security logs: poison with passive prompt injection and mitigation evaluation. In 35th USENIX Security Symposium (USENIX Security 26), Cited by: §1, §6.1, §7. [13] J. Kelsey, J. Callas, and A. Clemm (2010) Signed syslog messages. RFC Technical Report 5848, IETF. Cited by: Table 6, §7. [14] B. Laurie, E. Messeri, and R. Stradling (2021) Certificate transparency version 2.0. RFC Technical Report 9162, IETF. Cited by: Table 6, §7. [15] X. Li, H. Zhang, V. Le, and P. Chen (2024) LogShrink: effective log compression by leveraging commonality and variability of log data. In 46th IEEE/ACM International Conference on Software Engineering (ICSE), p. 1–12. Cited by: Table 6, §7. [16] Z. Liu, H. Zhang, and P. Chen (2023) LogLLM: large language models for log-based anomaly detection and diagnosis. arXiv:2310.01724. Cited by: 3rd item, Table 6, §7. [17] J. Mace, R. Roelke, and R. Fonseca (2015) Pivot tracing: dynamic causal monitoring for distributed systems. In 25th ACM Symposium on Operating Systems Principles (SOSP), p. 378–393. Cited by: §7. [18] F. Nooralahzadeh and J. S. Yazdi (2020) LogEvent2vec: logevent-to-vector based anomaly detection for log data. IEEE Access 8, p. 218190–218201. Cited by: 3rd item, Table 6, §7. [19] Open Cybersecurity Schema Framework Open Cybersecurity Schema Framework (OCSF) v1.8.0. Note: Linux Foundation Project, 2026. https://schema.ocsf.io Cited by: Table 6, §7. [20] OpenTelemetry Authors Logs data model, OpenTelemetry specification v1.60.0. Note: OpenTelemetry Project, 2026. https://opentelemetry.io Cited by: 2nd item, Table 6, §7. [21] OpenTelemetry Authors OpenTelemetry demo v3.0.0: astronomy shop. Note: OpenTelemetry Project, 2026. https://github.com/open-telemetry/opentelemetry-demo Cited by: item 2. [22] OpenTelemetry Authors OpenTelemetry protocol with Apache Arrow. Note: OpenTelemetry Project, 2026. https://github.com/open-telemetry/otel-arrow Cited by: Table 6, §7. [23] OpenTelemetry Authors OpenTelemetry Weaver v0.25.1: observability by design. Note: OpenTelemetry Project, 2026. https://github.com/open-telemetry/weaver Cited by: Table 6, §7. [24] OpenTelemetry Authors Semantic conventions for events v1.43.0. Note: OpenTelemetry Project, 2026. https://opentelemetry.io Cited by: 2nd item, Table 6, §7. [25] D. Pasquini, E. M. Kornaropoulos, G. Ateniese, O. Akgul, A. Theocharis, and P. Efstathopoulos (2026) When AIOps become “AI oops”: subverting LLM-driven IT operations via telemetry manipulation. In 35th USENIX Security Symposium (USENIX Security 26), Cited by: §1, §6.1, §7. [26] L. Quérel OTEP 0243: application telemetry schema vision and roadmap. Note: OpenTelemetry Project, 2026. https://github.com/open-telemetry/oteps Cited by: Table 6, §7. [27] K. Rodrigues, Y. Luo, and D. Yuan (2021) CLP: efficient and scalable search on compressed text logs. In 15th USENIX Symposium on Operating Systems Design and Implementation (OSDI 21), p. 183–198. Cited by: 1st item, §1, Table 3, Table 6, §7. [28] B. Schneier and J. Kelsey (1999) Secure audit logs to support computer forensics. ACM Transactions on Information and System Security 2 (2), p. 159–176. Cited by: Table 6, §7. [29] J. Tan, F. Bu, Y. Gao, D. Khanolkar, J. Mackay, B. Sobolev, L. Jin, and L. Zhang (2026) HYVE: hybrid views for LLM context engineering over machine data. arXiv:2604.05400. Cited by: §1, Table 6, §7. [30] R. Wang, D. Gibson, K. Rodrigues, Y. Luo, Y. Zhang, K. Wang, Y. Fu, T. Chen, and D. Yuan (2024) μ : high compression and fast search on semi-structured logs. In 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI 24), p. 529–544. Cited by: 1st item, §1, Table 3, Table 6, §7. [31] Y. Wang, G. Yu, H. Huang, Z. Wang, Y. Huang, P. Chen, and M. R. Lyu (2026) Cloud-OpsBench: a reproducible benchmark for agentic root cause analysis in cloud systems. arXiv:2603.00468. Cited by: §7. [32] J. Wei, G. Zhang, J. Chen, and Q. Zhou (2025) LogCrisp: fast aggregated analysis on large-scale compressed logs by enabling two-phase pattern extraction and vectorized queries. In 2025 USENIX Annual Technical Conference (USENIX ATC 25), p. 483–496. Cited by: §1, Table 3, Table 6, §7. [33] S. Yu, Y. Wu, Y. Li, and P. He (2024) Unlocking the power of numbers: log compression via numeric token parsing. In 39th IEEE/ACM International Conference on Automated Software Engineering (ASE), p. 919–930. Cited by: Table 6, §7. [34] L. Zhang, Z. Xie, V. Anand, Y. Vigfusson, and J. Mace (2023) The benefit of hindsight: tracing edge-cases in distributed systems. In 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23), p. 321–339. Cited by: §7.