Features

CLI-first design

Every workflow runs through the blop CLI:

Command	Behavior
blop monitor start	Run the local OTLP collector in the foreground. Bare blop is an alias.
blop monitor start --detach	Start or adopt an identity-verified background collector.
blop monitor status, stop	Inspect or safely stop the managed collector.
blop status	Collector and store health: reachability, database path, retention, counts, versions.
blop services	Services observed in the window, from the standard service.name attribute.
blop traces	Bounded trace list with service, status, duration, and limit filters.
blop trace <id>	One trace: span tree, attributes, and correlated logs on request.
blop spans, blop span <id>	Search spans directly or inspect one span with trace context.
blop logs	Bounded log slice with service, severity, trace, and text filters.
blop trace-stats, log-stats, facets	Compact grouped evidence for an agent context window.
blop audit	Deterministic findings with evidence; gates CI via --fail-on.

See the CLI reference for every flag and option.

OpenTelemetry in, useful evidence out

Phase one supports OTLP/HTTP on the conventional endpoints: POST /v1/traces and POST /v1/logs, each accepting JSON or Protobuf with optional gzip compression. The store preserves OpenTelemetry identity for correlation: resource attributes (especially service.name), instrumentation scope, trace ID, span ID, parent span ID, kind, status, timestamps, attributes, and events, plus log timestamp, observed timestamp, severity, body, trace ID, span ID, and attributes. Metrics are not ingested in this release; the existing outbound exporter keeps working for any OTLP backend.

Local store

SQLite is the local default, with WAL enabled. The database lives under your platform state directory, never in the repository. Retention is configurable by age and approximate database size with conservative defaults, and eviction runs in bounded oldest-first batches. OTLP writes use a dedicated worker thread so SQLite work does not stall HTTP health and query handling.

Search, correlation, and aggregates

Trace, span, and log search support service and signal-specific filters plus indexed exact attributes. Span and log search also support attribute substring filters. Opaque cursors paginate trace and log lists. Trace/span IDs connect evidence directly, while correlated routes return logs for one trace or span. Grouped statistics and facets compress a large window into evidence that fits an agent’s context.

Machine-readable by contract

• Stable --json output with the shared blop.cli/v1 envelope: schema_version, command, generated_at, data, page, warnings.
• snake_case keys; ISO 8601 UTC timestamps; durations in integer nanoseconds in raw records and explicit milliseconds in summaries; lowercase-hex IDs.
• Bounded results and deterministic ordering; absent optional values are null.
• Documented exit codes your CI and agent can branch on.
• No interactive prompts, spinners, or colour codes on stdout.

Deterministic audits

blop audit is the high-level coding-agent command. It runs fixed analysis over stored telemetry — error traces, new error signatures against a baseline, latency regressions and slow spans, warning/error log bursts, incomplete traces, clock anomalies, and services that stopped emitting. Findings never claim causality from correlation alone: wording uses “associated with” or “observed in” unless the telemetry directly proves a dependency. The same stored data always produces the same report.

Safe in a coding loop

• Queries are read-only.
• The collector binds to 127.0.0.1 by default. Binding another interface is an explicit trust decision because this release has no HTTP authentication or TLS.
• Compressed and decompressed request bodies are capped; unsupported content types are rejected.
• No environment variables, source files, or headers are collected unless the application emits them as telemetry.
• The collector never executes application code, agent commands, scripts, or browser actions.
• Local monitoring has no cloud upload path. The active browser runner’s explicitly configured platform upload remains separate.

Active flow verification

The intent-based browser runner (blop test, run, watch, list, init, skills) executes authored checks through Browser Harness. It produces run, step, assertion, and artifact evidence for the separate control plane. It does not write browser runs into the local telemetry store.

Use it after passive evidence identifies a user flow that deserves direct proof, or as an existing CI/synthetic check. See Observe, investigate, verify and Run browser checks with the CLI.