# Observability core

This root composes the internal observability workloads deployed after the
namespace, CRD, and Local PV prerequisites:

- kube-prometheus-stack without Grafana or its bundled node-exporter;
- single-binary Loki and Tempo using isolated AIStor buckets;
- Alloy for Pod logs and internal OTLP/gRPC traces;
- a standalone node-exporter;
- the exact core NetworkPolicy matrix, platform rules, scrape targets, verified
  dashboards, and source-only Alertmanager Slack routing.

It intentionally does not create public ingress, Grafana, OIDC, or credential
Secrets. The Slack routing source references
`alertmanager-slack-webhook/url`; while that Secret is absent, do not apply the
AlertmanagerConfig, its kube-prometheus-stack reference, its public HTTPS
NetworkPolicy, or alert rules. Namespace, CRD, and Local PV roots remain outside
this aggregate because their protected apply order is different.