Observability

A timed-out Claude Code MCP write enters an unknown state, checks an operation journal, and either verifies the existing effect or retries with the same idempotency key

Treat a timed-out MCP write as an unknown outcome

A timed-out MCP write may have failed, succeeded, or finished after the client gave up. Use an operation journal and effect lookup before Claude Code retries it.

A Claude Code run pins an MCP capability manifest and stops when the live server schema, implementation, target scope, or side effects differ

Pin the MCP tool contract before Claude Code uses it

An MCP method can keep the same name while its schema, target scope, or side effects change. Pin a capability manifest so Claude Code cannot inherit a different tool after approval.

A Claude Code cost envelope that prices tool calls before execution, reserves budget at dispatch, records actual spend, and stops over-budget paths

Make Claude Code price the tool path before it starts

Token limits miss the expensive part of many Claude Code runs. A cost envelope prices search, MCP calls, evals, and retries before the agent can spend them.

A Claude Code evidence-linked trace connecting an observed failing deployment to a scoped plan, an authorised MCP tool call, the resulting effect, and a review decision

Make Claude Code cite the evidence behind every tool call

A tool-call log shows what Claude Code did. An evidence-linked trace shows which observation caused each action, which policy allowed it, and when the chain broke.

A Claude Code rollback rehearsal verifies a recovery target, restores an isolated environment, checks all external effects, and proves old code can read new data

Make Claude Code rehearse rollback before production approval

A rollback note says recovery should work. A rollback rehearsal checks the exact target, non-code state, data compatibility, recovery time, and service behaviour before approval.

Two passing Claude Code test commands point to different commit, working tree, and lockfile fingerprints, so the review marks one result stale and requests a rerun

Bind Claude Code test results to the code they actually tested

Claude Code can report passing tests from different repository states. Add a run fingerprint so each result names the exact code, dependencies, tools, and policy it tested.

An approved effect contract and a Claude Code MCP write enter a receipt gate that checks the principal, target, state change, and independent verification before completion

Require an effect receipt after every Claude Code MCP write

An MCP tool can return success after changing the wrong target or using the wrong authority. Make Claude Code prove the external effect before it reports completion.

A Claude Code run replay record connecting the task contract, agent actions, decision points, evidence packet, human review, and incident replay

A diff cannot replay a Claude Code run

A Claude Code diff shows the final change, but it leaves out the starting state, failed commands, MCP results, skipped tests, and plan changes. Capture a compact replay record before the run disappears.

A Claude Code flight recorder diagram with task contract, tool calls, evidence, review, and rollback

Claude Code needs a flight recorder

Claude Code can produce a clean patch from a messy run. Production teams need a flight recorder: the task contract, tool calls, permission pressure, tests, assumptions, and rollback notes that explain how the patch was made.

Diagram showing metric-only LLM observability versus a replayable production AI trace

LLM observability is not a dashboard. It is a replayable trail.

A latency chart will not explain why an AI answer was wrong. Production LLM systems need traces, sources, tool calls, prompt versions, eval results, and human decisions.