Customer-controlled data plane

The customer's DRC CLI/runtime is the authority for captured events, signed WAL segments, replay, and its managed segment-signing key. The hosted workspace receives only a typed metadata projection explicitly selected for each sync.

Disconnected operation

Capture, durable segment sealing, search, analysis, and replay run against the customer's local Storage Plane. They do not call the hosted workspace. Network loss therefore does not stop local capture or replay; sync can be retried after connectivity is restored. Store DRC_STORAGE_PATH on durable customer-controlled storage and configure DRC_SEGMENT_SIGNING_KEY_PATH to a customer-managed PKCS#8 Ed25519 key. Back up the WAL/segments and key according to customer retention and recovery policy.

Outbound sync

After creating or selecting a workspace project and signing in, explicitly sync a local execution:

drc sync \
  --execution-id <local-execution-id> \
  --site-id <customer-site-id> \
  --workspace-project-id <workspace-project-uuid> \
  --include service_name environment version state start_time

The command sends one authenticated HTTPS POST /api/v1/remote-metadata/sync request from the customer CLI to the configured hosted API. Redirects are disabled. The hosted service does not initiate a connection into the customer network. The workspace project membership must allow writes. The same site/execution pair is idempotent and cannot later be reassigned to another project.

--include is required, can be repeated, and accepts only:

• service_name, environment, version, git_sha, build_id, region, runtime_version
• start_time, end_time, state, capture_completeness

The request schema cannot represent events or arbitrary nested data; the server also validates every field and caps the projection at 16 KiB. Service strings are limited to 512 bytes. The hosted record contains the selected projection, project/site/local execution identity, an integrity digest, and sync timestamps. It is labeled customer_authoritative_not_uploaded; it is not replay evidence and does not imply hosted access to customer evidence.

The sync does not send event bodies, payloads, tags, config snapshots, environment values, secret references, artifact locations, the local signing key, or the local storage path. No fields are sent unless named on the command line. Review local capture/redaction policy independently: metadata fields can still contain customer-sensitive names or identifiers, so export only fields approved by the customer.

Boundaries and limitations

• The hosted API authenticates the operator/service account and enforces tenant project write access. The customer remains responsible for controlling the local host, storage, and key.
• Sync is operator-triggered; it does not run a background outbound agent or remotely control the customer's runtime.
• The hosted side currently stores a searchable/auditable metadata receipt only. It cannot replay, verify the customer's local segment signature, download local evidence, or command the customer-side runtime.
• Evidence transfer is deliberately not part of this bridge. If customers later require artifact exchange, define a separate consented protocol with customer-owned encryption keys, explicit destination controls, durable queueing, and reversible/cancellable transfer semantics before adding it.