Theory

Theory: If You Cannot See Ref Movement, You Cannot Audit

Operational metrics (latency, error rate, disk) keep the forge up. Audit logs keep it honest. They are different streams.

Invariants

1. Golden signals for a git frontend: fetch/push latency, 5xx, queue depth.
2. Audit: who moved which ref, who changed access.
3. SOC 2 / ISO / GDPR ask for retention and access of those logs.

metrics  (SRE)     logs  (debug)     audit  (compliance)
all three, different retention

What can break

• DEBUG application logs as your only audit trail.

How to read this chapter

Metrics, logs, audit, tracing, frameworks, detection.