05 — For Developers
Four lines in your own package. Six languages, byte-identical.
The public API is intentionally tiny: initialize, emit events, done. The entire egress flow is in an opt-in module — if you only want to buffer, you don't need to pull it in.
Integration
Same API in six languages.
Switch the language — the calls change, the result does not. This is exactly what the cross-language conformance suite tests against common vectors.
// @prometheus/sdk — Node 20+ and browser/ESM
import { init } from "@prometheus/sdk";
const sdk = init({ projectId: "pkg:npm/left-pad" });
sdk.emit("install");
sdk.emit("session-start");
sdk.emit("runtime-tick"); // every 5 min
sdk.emit("feature-flag", { flag: "v2-api" });project_id names
the measured project, not the SDK language — therefore each example
carries a PURL from its ecosystem. The strict regime currently recognizes five:
npm, pypi, maven, cargo, and
golang. NuGet is not yet among them, which is why the
.NET example reports a package from one of the five — the SDK measures foreign
ecosystems, not itself.
Calculated via the conformance vector
src/proto/conformance/positive/01-mode-a-runtime-band.json — a
complete submission with submitter_id, aggregates,
and attestation. All six SDKs produce the same bytes from this
and the same hash; without this property, no signature would be
cross-language verifiable.
Runtime budget
An SDK that you do not notice.
Telemetry that consumes noticeable resources is rightly removed. Therefore, the budget is an acceptance criterion, not a guideline — it blocks the release.
per hour of runtime · measured with K7 profiler
RSS delta · measured with K7 profiler
Protocol
Proven standards, no custom development.
Nothing is built from scratch in crypto or identity. Any deviation from this requires a documented architectural decision.
RFC 8785 — JCS
Canonical JSON serialization. Without it, there would be no cross-language reproducible bytes and thus no verifiable signature.
ed25519 — RFC 8032
Signing directly over the canonical body bytes, without prehash. The
submission_hash is separate and serves idempotency.
did:key
The reporter's identity is a self-describing key — no registration, no central authority.
PURL — Package URL
Project identity always as PURL, never as free text. This way,
pkg:npm/foo is unambiguously separate from pkg:pypi/foo.
Contribute
What a contribution must go through.
The hurdles are intentionally high — for a project whose core promise is anonymity, anything else would be negligent.
Four-eyes review across four dimensions
Correctness, security, performance, and error handling are tested separately. A violation of hard principles is an auto-FAIL.
K3 is never shortcut
The PII negative test runs on every release and every sprint end — even when the change seemingly does not affect the PII path.
Coverage thresholds per workspace
At least 80% on new code, plus lint, strict type checking, and property-based tests.
No drift between code and concept
If a diff deviates from a statement in the concept documentation, the documentation is updated in the same change.