Abstract
The claim begins with a question, not a headline.
Research question / RQ-07
Can the edge preserve decision attribution in one queryable row while keeping serialization and ingestion work bounded?
Investigation slows down when identity, enforcement, performance, and model evidence live in different systems. Hyx writes the request context as one wide record, then batches it without allowing sampling to erase mandatory security outcomes.
Method
Inventory the complete row, trace sampling and must-log decisions into the batching worker, verify schema/encoding tests, and run the release serialization benchmark.
Finding
Delivery, security, Hyx AI, server, and network details share one timestamped request record.
Disclosure boundary
The public study describes schema families and ingestion guarantees without publishing customer identifiers, private reason taxonomies, or operational endpoints.
System boundary
Context is joined while the request still owns it.
S-01 / system topology
request / classification / action / fleet
Delivery
Status, bytes, cache state, origin latency, protocol, POP, and configuration version explain how the request was served.
Identity
IP-derived geography, ASN, TLS, JA4, header order, and bot evidence describe the client and the uncertainty around it.
Enforcement
WAF rule, action, anomaly score, named signals, model version, probability, latency, and reasons explain why policy resolved as it did.
Ingestion
Bounded channels, batch thresholds, timed flushes, schema verification, sampling, and must-log overrides govern movement into ClickHouse.
Controlled measurement
The local encoder clears a million rows per second; storage is outside the result.
M-01 / host-local evidence
release mode / scoped result
| Measurement | Observed | Scope |
|---|---|---|
| 01JSONEachRow encoding | 584.3ns / row | 1.71M rows / second |
| 02Hand-rolled timestamp | 36.8ns | benchmark alternative |
| 03Single timestamp format | 124.5ns | library formatting path |
| 04Double timestamp format | 150.1ns | baseline comparison |
| 05Focused suite | 16 passed | schema + encoding + sampling behavior |
Release benchmark on this host. Measures JSONEachRow construction, not channel contention, network transfer, ClickHouse insertion, storage, or query latency.
Findings
Attribution is cheaper when it is not reconstructed later.
One causal surface
A connection can be followed through delivery and enforcement without a request-time join across independent telemetry products.
Schema parity is tested
The row definition, ClickHouse schema, and JSON encoding are checked together so additions cannot silently shift columns.
Sampling has exceptions
Routine traffic may be sampled, while security and operationally significant outcomes can force a record.
Batches isolate the request
Request processing sends a completed record into a bounded worker rather than performing a synchronous database insert.
Correctness and safety
Loss, overload, and schema drift are treated as observable states.
Bounded queue
The channel places a finite limit between request producers and the database worker.
Must-log policy
Important enforcement outcomes bypass ordinary sampling decisions.
Schema verification
Expected columns and encoded rows are checked as a contract rather than inferred at query time.
Timed flush
Low-volume periods still advance partial batches instead of waiting indefinitely for size alone.
Hyx’s observable advantage is joined attribution at the edge. The benchmark shows encoding is small on this host, but does not prove database capacity, retention economics, or query performance at fleet scale.
Interpretation
The evidence boundary is part of the result.
Serialization only
The 584.3ns figure excludes queue pressure, network transfer, server parsing, merges, disks, and ClickHouse queries.
Schema evolves
Sixty-six is the current repository width, not a timeless product constant. New context must preserve schema and consumer compatibility.
A row is not a trace
A joined edge record explains one request boundary; distributed origin work may still require trace propagation across services.
Evidence register
Every public claim keeps its provenance attached.
Wide row
The current LogRow defines 66 fields across delivery, image handling, TLS/JA4, bot, WAF, signals, model, network, fleet, and sampling context.
Ingestion contract
The client implements bounded channels, batch size, periodic flush, sampling, must-log rows, and schema verification.
Focused suite
Sixteen tests passed with zero failures; two performance benchmarks remain ignored in normal test runs.
Encoding benchmark
Release JSONEachRow encoding measured 584.3ns per row, or approximately 1.71 million rows per second, on this host.
References / Harvard style
Dapper
Sigelman, B.H. et al. (2010) Dapper, a Large-Scale Distributed Systems Tracing Infrastructure. Google Research.
Open source ↗Reference / 02HTTP telemetry conventions
OpenTelemetry Authors (2026) Semantic conventions for HTTP. Available at: opentelemetry.io (Accessed: 11 July 2026).
Open source ↗Reference / 03JSONEachRow
ClickHouse (2026) JSONEachRow format. Available at: clickhouse.com/docs (Accessed: 11 July 2026).
Open source ↗Research archive
Return to the systems studies.
Mechanisms, measurements, and the limits required to interpret both.