Instrument hit/miss/bypass/stale metrics

Instrument tenant-scoped semantic cache for repeated FAQ paraphrases so cost owner cutting duplicate GPT calls for Acme Corp FAQs can answer: demand, errors, latency/age, saturation. Emit fields needed by hit_rate ∈ [0.25,0.55] and cross_tenant_hits == 0 with bounded labels. Sample successful high-volume traces; keep errors and rollout transitions denser within policy.

Define at least one alert that would fire for CACHE-XTENANT-2, with a for/pending window that survives deploy blips. Missing scrape or missing revision labels must not look like health. Include a trace/log example id format you will actually search.

Add a unit/integration check that metrics increment on the happy path and on the cross-tenant near-duplicate question returns Acme's private pricing blurb branch. Store machine-readable output in CI artifacts when practical.

Cardinality discipline: tenant and revision are usually enough; raw question text is not a label. Exemplars or trace links beat screenshots alone when debugging CACHE-XTENANT-2. Define who owns alert fatigue review. If you export to a vendor, record retention and access. Synthetic probes should use non-sensitive fixtures and still exercise POST /v1/answer. Practice the query you will type at 2am once, while calm.

Document the exact PromQL or log query in the runbook stub for this service. Verify histograms have buckets around your SLO target. Add a canary synthetic check that exercises the oracle path every few minutes in staging. Confirm that PII redaction happens before export. Track build/version as a label on the golden signals. Delete noisy debug logs before they become accidental product dependencies. In this chapter the product is tenant-scoped semantic cache for repeated FAQ paraphrases, the human stakeholder is cost owner cutting duplicate GPT calls for Acme Corp FAQs, and the incident id you design against is CACHE-XTENANT-2. Re-state the oracle in your notes — paraphrase hit returns cached answer with cache=HIT; different tenant never hits — and keep the invariant visible: cache key includes tenant_id + policy_version; similarity ≥ 0.92 and risk≠high. Track hit_rate ∈ [0.25,0.55] and cross_tenant_hits == 0 as the scoreboard. Surface under change control: POST /v1/answer. If you only have forty minutes, finish the fixture for cross-tenant near-duplicate question returns Acme's private pricing blurb before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.