05 — For Developers
SDK integration in six languages
Four lines in your own package, in six languages with byte-identical output. The public API is intentionally tiny: initialize, emit events, done. The entire egress flow is in an opt-in module — if you only want to buffer, you don't need to pull it in.
Integration
The API in six languages
The calls change with the language, the result does not — that is exactly what the cross-language conformance suite tests against common vectors. The example below is JavaScript; with scripting enabled the bar above it switches to the other five.
// @prometheus/sdk — Node 20+ and browser/ESM
import { init } from "@prometheus/sdk";
const sdk = init({ projectId: "pkg:npm/left-pad" });
sdk.emit("install");
sdk.emit("session-start");
sdk.emit("runtime-tick"); // every 5 min
sdk.emit("feature-flag", { flag: "v2-api" });project_id names
the measured project, not the SDK language — therefore each example
carries a PURL from its ecosystem. The strict regime currently recognizes five:
npm, pypi, maven, cargo, and
golang. NuGet is not yet among them, which is why the
.NET example reports a package from one of the five — the SDK measures foreign
ecosystems, not itself.
Calculated via the conformance vector
src/proto/conformance/positive/01-mode-a-runtime-band.json — a
complete submission with submitter_id, aggregates,
and attestation. All six SDKs produce the same bytes from this
and the same hash; without this property, no signature would be
cross-language verifiable.
Runtime budget
The runtime budget of the SDK
The SDK is meant to go unnoticed in someone else's process. Telemetry that consumes noticeable resources is rightly removed. Therefore, the budget is an acceptance criterion, not a guideline — it blocks the release.
per hour of runtime · measured with K7 profiler
RSS delta · measured with K7 profiler
Protocol
The standards in use
Proven standards throughout instead of custom development: nothing is built from scratch in crypto or identity. Any deviation from this requires a documented architectural decision.
RFC 8785 — JCS
Canonical JSON serialization. Without it, there would be no cross-language reproducible bytes and thus no verifiable signature.
ed25519 — RFC 8032
Signing directly over the canonical body bytes, without prehash. The
submission_hash is separate and serves idempotency.
did:key
The reporter's identity is a self-describing key — no registration, no central authority.
PURL — Package URL
Project identity always as PURL, never as free text. This way,
pkg:npm/foo is unambiguously separate from pkg:pypi/foo.
Contribute
The review process for contributions
The hurdles are intentionally high — for a project whose core promise is anonymity, anything else would be negligent.
Four-eyes review across four dimensions
Correctness, security, performance, and error handling are tested separately. A violation of hard principles is an auto-FAIL.
K3 on every release
The PII negative test runs on every release and every sprint end — even when the change seemingly does not affect the PII path.
Coverage thresholds per workspace
At least 80% on new code, plus lint, strict type checking, and property-based tests.
Code and concept kept in step
If a diff deviates from a statement in the concept documentation, the documentation is updated in the same change.