Cerbos is an open-source, cloud-native authorization engine (Policy Decision Point) that evaluates access policies at runtime. It processes authorization requests via gRPC and HTTP APIs, enforcing policies defined in YAML using RBAC, ABAC, and derived roles. The system ingests policies from multiple storage backends (disk, Git, SQL databases, cloud blob storage, Cerbos Hub) and compiles them into an optimized rule table with a bitmap-based index for low-latency evaluation. The rule table uses CEL (Common Expression Language) for condition evaluation, with partial evaluation for query planning. Architecturally, Cerbos is a Go monorepo producing two main binaries: `cerbos` (server + CLI tools) and `cerbosctl` (admin CLI). The server exposes gRPC/HTTP endpoints for CheckResources and PlanResources, along with admin, playground, and AuthZEN-compliant APIs. It includes built-in observability with OpenTelemetry metrics/tracing, structured logging, audit logging (local, Kafka, Hub), and telemetry. The evaluation engine is highly optimized with lazy dimension materialization, program caching, and functional core sharing to minimize memory and latency. External dependencies include protobuf, gRPC, CEL, OpenTelemetry, and various storage drivers (PostgreSQL, MySQL, SQLite, Kafka, BadgerDB, cloud SDKs). The project is designed for Kubernetes deployment (sidecar, service, daemonset), AWS Lambda, and systemd. It also provides a CLI for policy management, testing, and debugging, including a REPL for interactive condition evaluation.
Fission is a Kubernetes-native serverless framework (FaaS) that deploys and manages functions triggered by HTTP requests, message queues (Kafka, NATS, etc.), cron schedules, and Kubernetes events. The system is composed of multiple microservices: a router that proxies HTTP requests to function pods, an executor that manages warm-pool and per-function deployment backends, a builder that compiles function packages, a fetcher sidecar that materializes code into pods, and a storage service for archive management. All resources (Function, Environment, HTTPTrigger, Workflow, etc.) are defined as Kubernetes Custom Resource Definitions (CRDs) and reconciled by controller-runtime controllers. The architecture supports multi-tenant namespaces, canary deployments via FunctionAlias and CanaryConfig CRDs, a workflow engine with event sourcing, and a pluggable state store (memory, SQLite, Postgres) for durable queues and key-value storage. Internal service-to-service communication is authenticated via HMAC signing. Observability is built on OpenTelemetry (traces, metrics, logs) and Prometheus. The CLI tool (`fission`) provides full lifecycle management and a GitOps-friendly spec system. The codebase is RFC-driven with formal verification (TLA+ specs) for critical subsystems like the workflow event log and queue lease protocol.
Micrometer is a Java library that provides a unified facade for application metrics, enabling instrumentation of code with counters, timers, gauges, and distribution summaries, and publishing them to various monitoring backends (Prometheus, Datadog, OTLP, Graphite, InfluxDB, etc.). It is not an application itself but a library designed to be embedded in Java applications. The architecture is modular: the core module defines the metrics API and abstractions (MeterRegistry, Meter, Counter, Timer, Gauge, DistributionSummary), while separate implementation modules provide backend-specific registries with their own naming conventions and transport protocols. Additionally, the observation module offers a higher-level API for tracing and context propagation, bridging metrics with observability. Key entry points include the MeterRegistry (for creating and managing meters) and the ObservationRegistry (for observation lifecycle). Data flows involve application code recording measurements via meters, which are aggregated in-memory and periodically pushed to configured backends via HTTP, UDP, or other protocols. The library also includes extensive instrumentation binders for popular frameworks (Jetty, OkHttp, gRPC, Kafka, JVM internals, etc.) that automatically collect metrics from those systems. External dependencies vary by implementation module but include HTTP clients (OkHttp, HttpURLConnection), monitoring system SDKs (AWS SDK for CloudWatch, Google Cloud for Stackdriver), and protocol libraries (OTel protobuf, StatsD). The core module has minimal dependencies, relying only on Java standard library and optional logging frameworks (SLF4J, Log4j, Logback).
This is the OpenTelemetry Collector Contrib repository, a large collection of community-maintained components (receivers, processors, exporters, extensions, connectors) for the OpenTelemetry Collector. It provides a pluggable telemetry pipeline for traces, metrics, logs, and profiles. The architecture is a multi-module Go monorepo where each component follows a consistent factory pattern with generated metadata (via mdatagen). Key entry points include component factories (NewFactory), configuration structs with Validate methods, and lifecycle hooks (Start, Shutdown). Data flows involve receiving telemetry from diverse sources (e.g., Prometheus, Kafka, cloud APIs, databases), processing (transformation via OTTL, filtering, sampling, resource detection), and exporting to backends (e.g., Elasticsearch, Datadog, AWS S3, ClickHouse). External dependencies include cloud provider SDKs, database drivers, messaging libraries, and the core OpenTelemetry Collector SDK. The codebase is well-structured with extensive unit and integration tests, benchmarks, and fuzz tests. It demonstrates high craftsmanship in areas like the OTTL transformation language, the Stanza log processing pipeline, and the resource detection processor with cloud-specific detectors. Many components are reusable as standalone libraries (e.g., pkg/ottl, pkg/stanza, pkg/expohisto). The repository is actively maintained with frequent commits, CI/CD pipelines, and a clear governance model. While some components are in alpha or deprecated, the overall quality is high and the patterns are consistent.
This is a production-grade GraphQL server library for Go. It parses GraphQL SDL into an AST, validates incoming queries against the schema, executes queries/mutations/subscriptions by binding Go structs and methods as resolvers, and supports introspection, tracing, and basic Apollo Federation. The public API centers on graphql.ParseSchema/MustParseSchema and Schema.Exec, with a relay.Handler for HTTP transport. Internally, the code is organized into focused packages for lexing, parsing, validation, execution, and tracing, with a clear separation between schema representation (ast), resolvable binding, and runtime execution. The library is not a service or data pipeline; it is a component meant to be embedded in Go HTTP servers, as demonstrated by the example/starwars, example/social, example/caching, and example/federation servers. Architecturally, the codebase is a well-structured library with minimal external dependencies beyond the Go standard library. Optional integrations exist for OpenTelemetry and OpenTracing, and the validation test corpus is derived from the graphql-js reference implementation. The execution engine uses reflection-based resolver binding, supports field selection inspection, memory pooling, and configurable validation limits. The repository is actively maintained, targets the September 2025 GraphQL spec, and includes extensive unit tests, fuzz tests, and benchmarks. Some deprecated APIs remain (e.g., the old trace package and DisableIntrospection), but they are clearly marked and superseded by modern equivalents. Overall, this is a mature, high-quality library with strong engineering practices and reusable internal patterns.
This is the Supabase JavaScript SDK monorepo, providing isomorphic client libraries for Supabase backend services. It is a well-structured TypeScript monorepo managed with pnpm and Nx, containing six core packages: auth-js (authentication), postgrest-js (database queries via PostgREST), realtime-js (WebSocket-based realtime subscriptions), storage-js (file storage and vector index API), functions-js (edge function invocation), and the umbrella supabase-js package that combines them into a single `createClient()` entry point. The SDK supports multiple runtimes (Node.js, Deno, browsers, Bun, React Native, Cloudflare Workers) and includes optional OpenTelemetry tracing support. The codebase demonstrates high craftsmanship with extensive TypeScript generics for type-safe query building, fluent builder patterns, robust error handling hierarchies, and comprehensive integration tests against local Supabase infrastructure. It is actively maintained with frequent releases, automated CI/CD, and a strong focus on backward compatibility.
This repository is the **Wow** framework, a comprehensive, production-grade event-sourcing and CQRS framework for building reactive, cloud-native applications in Kotlin and Java. It provides a full stack: domain modeling with aggregates, commands, events, and sagas; reactive command/event buses with multiple backends (MongoDB, Redis, Elasticsearch, Kafka); a query gateway with rich filter DSL and snapshot/event-stream queries; automatic OpenAPI generation; a compensation subsystem with a React dashboard for managing failed executions and retries; observability via OpenTelemetry; and BI tooling for ClickHouse. The architecture is modular (30+ Gradle modules) but deployable as separate services (e.g., compensation server, example server). It is actively developed with extensive tests (unit, contract, integration, JMH benchmarks) and comprehensive documentation.
highlight.io is an open-source, full-stack observability platform that provides session replay, error monitoring, logging, distributed tracing, and metrics dashboards. The system is architected as a monorepo with a Go backend (serving GraphQL APIs via gqlgen), a React/TypeScript frontend (using Vite, Apollo Client, and a custom UI component library), and SDKs for over a dozen languages and frameworks (JavaScript/TypeScript, Go, Python, Ruby, Java, Rust, Elixir, .NET, etc.). Data is ingested via OpenTelemetry (OTLP) and custom SDKs, processed through Kafka queues, stored in ClickHouse for analytics and PostgreSQL for relational data, with Redis caching and S3 for session replay assets. The platform includes alerting (Slack, Discord, Microsoft Teams, webhooks), integrations with GitHub, Jira, Linear, Vercel, and more, as well as AI-powered features like session insights and error grouping. The primary entry points are the frontend SPA (routed via React Router) and the backend GraphQL endpoints (private-graph for authenticated users, public-graph for data ingestion). Key data flows include: browser SDK capturing session events and errors → public-graph → Kafka → ClickHouse/Postgres; server SDKs sending logs/traces/metrics via OTLP → OpenTelemetry collector → ClickHouse; and background workers (Lambda functions) for digests, session exports, and alert evaluations. The system is designed for both cloud-hosted and self-hosted deployments (Docker Compose, AWS ECS). While primarily an application, the repository contains significant data engineering components: ClickHouse materialized views for aggregations, Kafka for stream processing, and custom query parsing (ANTLR grammar) for search across logs, traces, and sessions. The codebase demonstrates high craftsmanship with a well-structured monorepo, extensive testing (Go unit tests, e2e tests across frameworks), and a reusable UI component library. However, the large number of SDKs and integrations introduces maintenance complexity, and some legacy patterns (e.g., coexistence of old and new dev tools) indicate ongoing refactoring.
VictoriaLogs is a high-performance, lightweight log management system designed for both small and large-scale deployments. It consists of multiple Go-based services for log ingestion (vlagent, vlinsert), storage (vlstorage), and querying (vlselect), complemented by a Preact/TypeScript web UI (vmui). The system uses a columnar storage approach with bloom filters, custom encoding, and a pipeline-based query engine (LogsQL) for efficient log processing. Key architectural patterns include composable data transformation pipes, extensible filter systems, mergeable statistical aggregations, and object pooling for performance optimization. The frontend features a modular component architecture with custom hooks for state management, contextual controls, and interactive visualizations.
Apollo Router is a production-grade GraphQL gateway written in Rust. It accepts incoming GraphQL HTTP requests, composes a supergraph schema from subgraph schemas, plans queries across subgraphs, and executes them through a tower-style service pipeline. It supports federation, subscriptions, persisted queries, demand control, entity caching, progressive overrides, connectors, and defer. Configuration is YAML-based and can be managed via Apollo GraphOS Uplink for schema/config propagation.
EcoLogits is a Python library that estimates the environmental footprint (energy, GHG emissions, abiotic resource depletion, primary energy, water consumption) of generative AI model inference accessed through provider APIs. It integrates with official client libraries for OpenAI, Anthropic, Cohere, Mistral AI, HuggingFace Hub, Google GenAI, and LiteLLM by monkey-patching their core methods using `wrapt`. When a user makes an API call, the library intercepts the request, measures latency, looks up model characteristics and electricity mix data, and attaches an `ImpactsOutput` object to the response containing usage and embodied impact estimates with uncertainty ranges. Architecturally, the library is organized around a provider instrumentor pattern: each provider has a tracer class that wraps sync/async and streaming/non-streaming methods. Impact calculations are performed by a Directed Acyclic Graph (DAG) engine that resolves interdependent computations (energy, GWP, ADPe, PE, WCF) from regression coefficients and data files. The library also supports video generation impact estimation via a standalone function. An optional OpenTelemetry integration exports metrics to an OTLP endpoint. Key entry points are `EcoLogits.init()` to enable tracers for selected providers, and `video_impacts()` for video generation. External dependencies include provider SDKs (openai, anthropic, etc.), `wrapt` for wrapping, `pydantic` for data models, and optionally `opentelemetry-api` and `opentelemetry-sdk`. The library is published on PyPI and documented with MkDocs. While primarily a software library, EcoLogits has a strong data/research character: its methodology is based on Life Cycle Assessment principles, relies on curated JSON data files (models, electricity mixes, video models) that require regular updates, and is published in the Journal of Open Source Software. The codebase demonstrates high craftsmanship with clean abstractions, extensive testing, and a well-documented methodology.
HyperDX / ClickStack is a full-stack observability platform for ingesting, storing, querying, and visualizing logs, traces, metrics, and session replays. The system is architected as a monorepo with a Next.js frontend (React, Mantine, CodeMirror, Recharts), an Express.js API backend (MongoDB metadata, ClickHouse primary data store), a CLI tool (ink-based TUI), and an OpenTelemetry collector for ingestion. Key capabilities include real-time dashboards with drag-and-drop tile layout, multi-channel alerting (webhook, Slack, incident.io), advanced search with Lucene and SQL, log pattern mining (Drain algorithm), session replay, service maps, Kubernetes monitoring, and a Model Context Protocol (MCP) server that exposes observability tools to AI assistants. The platform supports authentication via local accounts or OIDC, OpAMP agent configuration, and includes an evaluation framework (hdx-eval) for benchmarking agent performance on SRE scenarios. Although the repo is primarily an application, it contains data-intensive components like the log miner and analytics query engines that cross over into data engineering territory.
Cog is an open-source CLI and runtime for packaging machine learning models into production-ready Docker containers. It automatically generates HTTP inference servers with OpenAPI schema, handles GPU/CUDA/cuDNN compatibility, and provides a full weight management pipeline for large model artifacts. The project consists of a Go CLI (build, push, serve, predict, doctor, weights management), a Rust/PyO3 prediction server (coglet) with slot-based concurrency, a Python SDK for defining model interfaces (BaseRunner, Input, streaming), and a TypeScript playground UI. Key workflows include building OCI images from cog.yaml, pushing to registries, serving models via HTTP with SSE streaming, and managing model weights via content-addressed storage and lockfiles. The architecture is multi-language but cleanly separated, with well-defined protocols between components.
This repository builds and maintains the `grafana/otel-lgtm` Docker image, an all-in-one OpenTelemetry backend for development, demo, and testing. It bundles Grafana, Prometheus, Tempo, Loki, Pyroscope, and the OpenTelemetry Collector into a single container, providing a complete observability stack with a single `docker run` command. The image supports optional eBPF-based auto-instrumentation (OBI) for zero-code traces and RED metrics, and can export telemetry to external vendors via OTLP. The architecture is a multi-stage Docker build that downloads and verifies each component using checksums or cosign signatures. The container entrypoint (`run-all.sh`) starts all services in parallel, waits for health checks, and handles graceful shutdown. The OpenTelemetry Collector configuration is dynamically extended based on environment variables (debug exporter, external endpoints, custom headers). The repository also includes example applications in Java, Go, Python, .NET, and Node.js that demonstrate OpenTelemetry instrumentation, along with acceptance tests (OATS) that validate traces, metrics, logs, and profiles. CI/CD is comprehensive: automated builds, linting (flint, hadolint, shellcheck, etc.), container scanning with Trivy, CodeQL analysis, and weekly scheduled releases with immutable version tags. Container images are signed with cosign and attested via GitHub Artifact Attestations. The repository is actively maintained with Renovate for dependency updates and a well-defined release process.
Emmett is a TypeScript monorepo providing an opinionated event sourcing and CQRS framework for Node.js applications. It implements the decider pattern for business logic, with pluggable event store backends (PostgreSQL, SQLite, MongoDB, EventStoreDB, in-memory) and web framework integrations (Express, Hono, Fastify). The framework includes built-in projections (single/multi-stream, raw SQL, document-oriented via Pongo), consumer/processor pipelines with checkpointing and locking, workflow orchestration, and comprehensive observability via OpenTelemetry (tracing, metrics, logging). The codebase is modular with separate packages per database and web framework, extensive test coverage (unit, integration, e2e), and a CLI for schema migrations. It is actively maintained with a large community (539 stars, 53 forks) and zero dependabot alerts. The architecture demonstrates high craftsmanship with reusable patterns for middleware composition, streaming transformations, and BDD-style testing specifications.
This is a monorepo of first-party middleware and service implementations for the Fiber web framework (v3). It provides production-grade authentication (JWT, PASETO, SPNEGO/Kerberos), authorization (Casbin, OPA), observability (OpenTelemetry, Prometheus, New Relic, Sentry, custom monitor/uptime dashboards), real-time communication (WebSocket, Socket.IO v5), Web Application Firewall (Coraza), resilience patterns (circuit breaker, CPU load shedding), structured logging (zap, zerolog), internationalization, hCaptcha verification, Swagger UI/OpenAPI docs, profiling (fgprof), and Testcontainers integration for testing. Each package lives in its own Go module under v3/, following a consistent Config+New() pattern and includes extensive test coverage with benchmarks. The architecture is library-oriented: components are imported by Fiber applications, not run standalone. The codebase demonstrates strong engineering practices: config validation at construction, atomic concurrency patterns, lock-free read paths, and protocol-level optimizations (e.g., zero-copy Socket.IO codec, WebSocket write coalescing). Some packages show signs of technical drift (e.g., paseto uses a deprecated library, socketio has mutable package globals), but overall the repository is actively maintained with weekly releases and automated dependency updates.
This is a standalone Rust web server that implements Turborepo's remote caching API. It acts as a sidecar process, typically started inside CI pipelines (GitHub Actions, GitLab, Kubernetes), that forwards artifact storage and retrieval requests to any S3-compatible object store (AWS S3, Cloudflare R2, RustFS). The server exposes a small set of REST endpoints: health check, artifact upload/download/head, event logging, and a team artifact listing stub. Artifacts are streamed directly from the HTTP body to S3 (and vice versa) without buffering into memory. Optional Bearer-token authentication uses constant-time comparison, and the server is instrumented with OpenTelemetry for distributed traces and system-level metrics (CPU, memory) that are exportable via OTLP. The repository also includes a GitHub Action wrapper (Node.js) that manages the binary lifecycle—startup health polling, graceful shutdown, and log collection—and a multi-stage Docker build that produces statically linked Linux binaries and a universal macOS binary. The architecture is a monolith (single binary) built with actix-web, with clear separation into modules for settings, storage, authentication, routes, and telemetry. All artifacts are scoped under a team prefix derived from the Turborepo client's query parameters.
This repository provides a generic-based dependency injection framework for Go, called 'kod' (Killer Of Dependency), along with a CLI tool for code generation, component registration, and dependency graph validation. It features a rich interceptor chain for cross-cutting concerns (retry, validation, tracing, rate limiting, circuit breakers, etc.), and includes a comprehensive test suite and examples. The codebase also incorporates an extensive set of AI agent skills for software development workflows (grilling, code review, TDD, domain modeling) from the mattpocock/skills ecosystem. The primary value is the DI framework that leverages Go generics to provide compile-time safety for component wiring, with generated boilerplate code. The architecture is modular with clear separation of core, interceptors, internal utilities, and tests. It is actively maintained with modern Go features.
This repository implements OpenTelemetry eBPF Instrumentation (OBI), a production-grade observability agent that uses eBPF to automatically capture distributed traces, metrics, and logs from user-space applications without any code changes. It supports a wide range of protocols (HTTP/1.1, HTTP/2, gRPC, SQL, Redis, Kafka, MongoDB, AMQP, MQTT, DNS, and more) and multiple language runtimes (Go, Java, Python, Node.js, Ruby, .NET, Rust). The agent can run as a standalone binary, a Docker container, or an OpenTelemetry Collector receiver. Its architecture consists of eBPF programs (kprobes, uprobes, tracepoints, TC) that emit events to ring buffers, which are read by Go userspace tracers and processed through a pipeline of discovery, decoration, filtering, and export stages. Telemetry is exported via OTLP (gRPC/HTTP) or Prometheus, with optional Kubernetes metadata enrichment and network flow monitoring. The codebase is well-structured with clear separation of concerns, extensive integration tests, and several reusable generic components (message queues, pipeline runners, expiry caches, attribute filters). It is actively maintained with frequent commits and comprehensive CI/CD.
go-instrument is a CLI tool that automatically instruments Go source files with OpenTelemetry trace spans. It parses Go AST, identifies functions that accept a `context.Context` parameter, and inserts span creation, defer, and optional error recording statements. It handles various edge cases: anonymous functions, build constraints (ignore/exclude), generated files, custom context/error parameter names, already-instrumented functions, and preserves original line numbers for panic stack traces via compiler directives. The tool is implemented as a reusable library with a clear separation between the generic AST processing engine (`processor` package) and the specific instrumentation strategy (`instrument` package), allowing custom instrumenters. The CLI frontend is minimal; the core logic is in the `processor` and `instrument` packages and is cleanly abstracted via an `Instrumenter` interface. The codebase is well-tested, includes fuzz testing, and uses current Go tooling.