Skip to main content
QM currently uses one-shot collection. Durable run, turn, usage, and model economics can cover the requested interval; tool activity covers only what remains in QM’s approximately one-hour run_activity retention window.
collect qm persists an owner-only snapshot and audits it. It never pushes. audit --runtime qm performs the same collection into a temporary owner-only artifact, audits it, then removes it. Strict direct mode uses a dedicated export-view reader. Fly mode runs an operator-contained exporter inside QM core. Offline snapshot mode needs neither. The manifest makes the distinction explicit with collectionMode, privilegeBoundary, and databaseLeastPrivilege; Xerg never upgrades a process boundary into a database least-privilege claim.

​
Snapshot guarantees

qm-snapshot/v1 is strict JSONL with a manifest, typed sanitized records, and a required completion trailer. Xerg verifies its SHA-256 digest, record counts, duplicate IDs, one-megabyte line limit, 100,000-record limit, and 256 MiB artifact limit. Creation is atomic and refuses overwrite. Every session, scope, run, model, activity, call, metric, harness, and deployment identifier is HMAC-pseudonymized before a byte is written. The parser rejects IDs that do not have the collector’s pseudonym shape. The database read uses a repeatable-read, read-only transaction, parameterized allowlisted queries, 1,000-row keyset pages, 15-second statement/idle timeouts, and a two-second lock timeout. Open runs are fingerprinted again after the snapshot. Xerg retries once on change, then marks the source drifted instead of claiming stability.

​
Exit codes

  • 1: connection, credential, privilege, schema, contract, snapshot, or Fly failure
  • 2: no economic model observations
  • 3: an evaluable threshold was exceeded
  • 5: a monetary or detector threshold cannot be evaluated
If QM contains unpriced usage, dollar/rate gates fail with code 5; unpriced calls are never counted as actual $0 spend. Continuous collect qm --follow, reconnect watermarks, durable capture beyond QM’s activity TTL, and live Slack-triggered collection are not currently supported.