audit: zero #[instrument] across 73 async functions in kerykeion

[forkwright]

Context

Area

crates/kerykeion/src/ (entire crate) — async observability.

Severity

medium — observability contract violation across the most complex async crate.

Evidence

• grep -rn "async fn" crates/kerykeion/src/ --include="*.rs" | wc -l → 73 async functions.
• grep -rn '#\[instrument' crates/kerykeion/src/ --include="*.rs" | wc -l → 0.
• grep -rn '#\[instrument' crates/ --include="*.rs" | wc -l → 0 across the entire workspace.
• ~/dev/kanon/crates/basanos/standards/RUST.md:1283 — "#[instrument] on public functions."
• ~/dev/kanon/crates/basanos/standards/RUST.md:1285 — "Spawned tasks must propagate spans (.instrument(span))"
• ~/dev/kanon/crates/basanos/standards/RUST.md:1342 — common mistake Add missing root files and GitHub templates #9: "Bare tokio::spawn without .instrument(): loses trace context."

Conflict

The fleet standard mandates tracing instrumentation; the most complex async crate (mesh collector, transport, packet processor, heartbeat, discovery) has zero #[instrument] attributes.

Why it matters

Without spans, production failures in the mesh collector are undebuggable. The standard calls observability a contract; absence of instrumentation hides the call graph from runtime diagnosis.

Done criteria

• Add #[instrument] to every public async function in kerykeion, with skip for non-display fields.
• Verify spawned tasks propagate spans via .instrument(span).
• Sweep other crates for the same gap (zero #[instrument] in workspace today).

Source

Kimi L1+L2 audit pipeline 2026-04-25.

Provenance

Originally filed on the kanon forge as issue #9 on 2026-04-25T20:15:01.561525672-05:00[America/Chicago]. Recovered from 2026-05-09 pre-brick restic backup. Forge URL no longer reachable post firmware brick.

Severity

P3