# `Capstan.Telemetry`
[🔗](https://github.com/baselabs/capstan/blob/v1.3.1/lib/capstan/telemetry.ex#L1)

Value-free telemetry emission. Provides the metadata **allowlist** for "no row values
and no passwords in telemetry" (Rule 1): `event/3` routes
through `validate!/1`, which **raises** on any key outside the allowlist, so a stray row
value or password cannot ride a payload emitted through this module.

Only structural metadata — GTIDs, schema / table
names, DDL kinds, atom reasons, server identity, TLS posture, and server-reported
missing GTIDs — is permitted.

**Scope (C1):** this is the pipeline's sole telemetry emit path. Every emitter in
`Capstan.Connection` and `Capstan.AssemblerServer` routes through `event/3` (Rule-1
completion), so the allowlist gates them at runtime — a future emitter attaching a
row value or password raises rather than shipping it. The complementary test-time
guarantee is the `Capstan.ValueFree` helper, which scans the log and telemetry channels
(and, for the live vectors, the delivered sink outputs) for a planted sentinel across
every delivered and error/halt path.

Mirrors `replicant/lib/replicant/telemetry.ex`.

# `allowed_measurement_keys`

```elixir
@spec allowed_measurement_keys() :: [atom()]
```

The permitted telemetry measurement keys (counts and monotonic durations).

# `allowed_meta_keys`

```elixir
@spec allowed_meta_keys() :: [atom()]
```

The permitted telemetry metadata keys.

# `event`

```elixir
@spec event([atom(), ...], map(), map()) :: :ok
```

Emit a telemetry event with allowlist-validated metadata and measurements.

Raises `ArgumentError` if `meta` carries any key outside `allowed_meta_keys/0`, if a
measurement key is outside `allowed_measurement_keys/0`, or if a measurement value is
not a non-negative number — the fail-closed points that keep a value off a payload on
both channels. The refusals name the offending KEYS only, never the values.

---

*Consult [api-reference.md](api-reference.md) for complete listing*