-and added the one signal it was missing
Track 01 — AI & Agent Observability. A hackathon project built from scratch, July 20–26, 2026.
There's a sentence we said to each other on day one and then kept saying all week, because it kept being true:
An API 200 is not evidence that a feature works.
This post is the story of a project that lives entirely inside that sentence. It's about a feature SigNoz already shipped that almost nobody can reach, a real bug that makes part of it impossible, and a missing signal — measured answer quality — that we built on top. And it's about how we used SigNoz not as a black box but as the thing under test.
The surprising starting point: SigNoz already built the machinery
Most "add observability to LLMs" projects start from zero. Ours didn't, and that's the interesting part.
SigNoz v0.133.0 already ships a complete LLM-observability product in open source: a dedicated frontend module, two custom OpenTelemetry collector processors (an LLM-pricing processor and a span-mapper processor), and CRUD APIs behind them. The machinery to ingest gen_ai.* spans, price them, normalize vendor-specific shapes, and render them on a dashboard is there, in the OSS repo, today.
So our thesis wasn't "SigNoz is missing LLM observability." It was sharper and, we think, more useful:
SigNoz shipped the machinery. We make the shipped feature actually reachable — and add the one signal it's missing: measured answer quality.
That framing mattered to us ethically, too. Nothing in this project reads "SigNoz is broken." It reads: they built something good, three defaults and one bug stand between a self-hoster and it, and here's the fix — upstreamed.
The three silent gates
Here's what actually stands between a fresh docker compose up and a working LLM-observability feature. Every one of them fails silently — the backend returns success while the frontend hides the result, and nothing tells you why.
Gate 1 — enable_ai_observability is default-disabled
The whole feature sits behind an experimental flag that ships off. With it off, the UI route for LLM observability silently redirects to /home. No error, no "coming soon," no toast. You click the thing and you're just... somewhere else. At the time we hit it, there were zero web results for the flag name.
Gate 2 — use_dashboard_v2 is default-disabled
The seeded LLM dashboards are v2 dashboards. Import one over the API with this flag off and it succeeds — 200 OK — and then renders as an empty "Welcome to your new dashboard" shell. The data is flowing. The panels are defined. The screen is blank.
This is where the day-one sentence was born. Both gates let the backend succeed while the frontend hides the result. We got bitten by both, in one afternoon, before we understood the pattern.
The fix for gates 1 and 2 is to ship both flags together — and it has to be both:
SIGNOZ_FLAGGER_CONFIG_BOOLEAN_ENABLE__AI__OBSERVABILITY=true
SIGNOZ_FLAGGER_CONFIG_BOOLEAN_USE__DASHBOARD__V2=true
Setting only one still gives you an empty shell — the exact failure we're fixing. So any "dashboards-as-code" deliverable that sets one flag is quietly reproducing the bug.
Gate 3 — the registries ship empty
Two registries back the feature — llm_pricing_rules (model prices) and span_mapper_groups (vendor→spec mapping presets). Both ship with zero rows. No seeded prices, no mapping presets. And there's a nasty second-order trap here: SigNoz's own CrewAI docs tell users to instrument with OpenInference — which emits zero gen_ai.* attributes — so a user who follows the docs faithfully lands on a seeded dashboard that shows nothing, and has no way to know the mapping layer is what's missing.
The one real defect: cost is impossible regardless of configuration
The three gates are configuration. This one is a bug.
SigNoz's LLM-pricing processor and span-mapper processor are generated into the collector config correctly — we verified the rendered YAML. But neither of them is ever wired into a pipeline:
-
GenerateCollectorConfigWithLLMPricingProcessorandGenerateCollectorConfigWithSpanMapperProcessorboth write onlycollectorConf["processors"]. - Neither touches
service.pipelines.traces.processors.
In OpenTelemetry Collector terms, that's dead config: a processor that exists but is in no pipeline never runs. So even with the flag on and a correctly-rendered gpt-4o pricing rule, the effective traces pipeline was still [signozspanmetrics/delta, batch], and ClickHouse showed no cost attributes — not _signoz.gen_ai.total_cost, not _signoz.gen_ai.cost_input / cost_output (those are the real emitted names; there is no gen_ai.usage.cost output attribute).
The good news: the codebase already does this right somewhere. The logs feature wires its generated processor straight into the pipeline. So the fix is small, it follows in-repo prior art, and it's the kind of change a maintainer can verify in two minutes:
enable
enable_ai_observability→ add a pricing rule → observe the effective traces pipeline is still[signozspanmetrics/delta, batch]→ cost attributes never appear.
We filed it upstream as SigNoz/signoz#12268 — a small, focused change that cites the prior-art file and ships a clean reproduction. A teammate's fix, not a hackathon drive-by.
The part we're proudest of: measuring whether the answers are any good
Everything above makes the shipped feature reachable. But there's a signal SigNoz's LLM product genuinely does not have, and it's the one that matters most for agents in production: is the model's answer any good, and did the last release make it worse?
Cost, latency, and token counts tell you the model ran. They say nothing about whether it was right. So we built an eval layer.
Emitting a signal SigNoz has never seen
OpenTelemetry specs an evaluation signal — gen_ai.evaluation.result (name, score, label, explanation). It has zero references in the SigNoz codebase. We emit it: an LLM-as-judge scores an answer, and the score travels into SigNoz over OTLP as spec-shaped telemetry.
Crucially, how you carry it decides whether it's usable. We learned this the hard way and built a probe (probe_eval_carriers.py) that emits the same score three ways side by side to prove which one survives:
-
Span events are stored in ClickHouse as
Array(String)— you cannot filter or aggregate inside them. An eval you can'tGROUP BYis not auditable. - A spec-compliant log record and a dedicated evaluation span both land as queryable attributes.
So we carry every score on the two that SigNoz can actually aggregate, never on a span event.
The judge earns its place by benchmark, not reputation
The judge is the load-bearing piece: every downstream claim is only as trustworthy as the score it produces. So we picked it by measuring it against our actual task, and we picked it to run locally on open weights — gpt-oss:20b on Ollama, free and self-hostable.
That last choice is architecture, not thrift. This entire project exists to remove a gate between a self-hoster and a feature. A judge that needed a paid API key would reintroduce exactly that kind of gate — now you need a billing account before you can evaluate anything. A free, self-hostable judge works for the same person we're unblocking.
We benchmarked five candidates. The results were not what "bigger is better" would predict:
| model | valid JSON | grounded | fabricated | separation | jitter (temp 0) | p50 latency |
|---|---|---|---|---|---|---|
| gpt-oss:20b | 3/3 | 1.000 | 0.000 | +1.000 | 0.000 | 3.16s |
| gpt-oss:120b | 3/3 | 1.000 | 0.133 | +0.867 | 0.250 | 4.66s |
| nemotron-3-nano:30b | flaky | 1.000 | 0.270 | +0.730 | 0.180 | 5.38s |
| deepseek-v4-flash | — | HTTP 403 (not in tier) | ||||
| gemma4:31b | — | returned non-JSON |
The bigger model was the noisier one. On a repeated fabricated input at temperature 0, gpt-oss:120b returned 0.25 / 0.00 / 0.15 — a 0.25 spread — while gpt-oss:20b returned 0.00 every single time. A quality-regression alert lives or dies on that stability: a judge that wobbles ±0.25 makes "quality dropped 12%" indistinguishable from measurement noise, and can name the wrong release as the culprit. We chose the model our alert can actually trust, and it happened to be the smaller, faster, free one.
Every score also carries the two attributes that make it reproducible after the fact:
-
gen_ai.evaluation.judge.model— which model scored it -
judge.prompt.version— which rubric version scored it
So "which judge and which rubric produced this score?" is a GROUP BY, not a shrug.
The alert that names the release that regressed
The payoff is a threshold alert: avg(gen_ai.evaluation.score.value) below 0.7, over a 30-minute window, grouped by service.version. When a release's answer quality slides under the floor, the alert fires and names the release. No anomaly detection — that's enterprise-gated in SigNoz — just a threshold on a signal we made aggregatable.
We measured the full loop end to end against a live instance, not estimated it:
- emit at
16:21:43Z→ alert transitioned to firing at16:25:40Z - span-to-alert = 238s (~4 min)
And here's the part that matters for anyone building on this: that time is almost entirely SigNoz's own machinery — the 120s eval_delay plus the 1-minute evaluation interval. The judge adds only ~2.5s per call, and because spans are timestamped when the run starts, even that overlaps the eval_delay rather than stacking on it. The eval layer adds essentially nothing to detection time; SigNoz's evaluation interval is the floor.
For the demo we use a deliberately loud drop — measured mean 0.958 → 0.167 — so the mechanism is legible in one glance. That's a demo choice, not a limitation: the alert fires on the same 0.7 floor whether the slide is a cliff or a subtle crossing.
How we deployed it — and made it reproducible
We ran SigNoz self-hosted in WSL2 (Ubuntu 24.04) on native Docker Engine — not Docker Desktop, whose ClickHouse Keeper is known to segfault. Deployment is via SigNoz Foundry (foundryctl), their "one config, one command" tool: you declare the whole deployment in a casting.yaml, forge expands it into platform manifests plus a checksum-pinned casting.yaml.lock, and cast deploys it.
Because the judges of this hackathon may re-run Foundry to reproduce our deployment, we didn't hand-edit generated files — we put the fix in the source of truth. Our casting.yaml sets both gates as first-class env overrides on the SigNoz service:
spec:
deployment:
flavor: compose
mode: docker
signoz:
spec:
version: v0.133.0
image: signoz/signoz:v0.133.0
env:
SIGNOZ_FLAGGER_CONFIG_BOOLEAN_ENABLE__AI__OBSERVABILITY: "true"
SIGNOZ_FLAGGER_CONFIG_BOOLEAN_USE__DASHBOARD__V2: "true"
We verified this is the right way to do it: forge merges those overrides into the defaults (it doesn't wipe the DB/store env), the flags render into the generated compose.yaml, and — critically — forge is deterministic: re-running it produces a byte-identical lock. So a judge who clones the repo and runs foundryctl forge && foundryctl cast gets the feature-reachable deployment, not the default empty shell. The casting file is part of the argument, not a checkbox.
What we'd tell the next person
- Treat a 200 as the beginning of verification, not the end. Both gates that cost us the most time were backends succeeding while frontends hid the result. Visually confirm every dashboard; never trust the POST.
- Pick your LLM judge by measuring it, not by its size or name. The stability of the judge is the stability of your alert. Bigger lost.
-
Choose carriers your backend can aggregate. A beautiful eval signal stuffed into a span event is invisible to
GROUP BY. Know your storage model before you emit. - Put the fix in the source of truth, not the generated output — so reproduction reproduces the fixed thing.
SigNoz built a genuinely good LLM-observability product. We made it reachable, filed the bug that was blocking cost, and added the measured-quality signal it was missing — all in OSS, all reproducible from one casting.yaml.
Repo (with casting.yaml + casting.yaml.lock for reproduction): https://github.com/gajanand27-05/SigNoz-conform
Top comments (0)