@lucern/contracts 1.0.1 → 1.0.2

package/dist/index.js

@@ -14175,8 +14175,11 @@ var INFISICAL_SECRET_ENVIRONMENT_POLICIES = [
 var INFISICAL_SECRET_CONSUMERS = [
   "lucern-web",
   "lucern-gateway",
+  "lucern-sdk",
   "lucern-mcp",
   "lucern-cli",
+  "lucern-agent",
+  "lucern-railway-pdp",
   "lucern-ai-runtime",
   "lucern-graph-sync",
   "lucern-observability",
@@ -14923,214 +14926,7 @@ var PLATFORM_LANGFUSE_SECRET_DEFINITIONS = [
   }
 ];
 
-// src/infisical-runtime.platform-ops-secrets.ts
-var PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS = [
-  {
-    id: "platform.neo4j.uri",
-    canonicalName: "NEO4J_URI",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j URI for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.user",
-    canonicalName: "NEO4J_USER",
-    aliases: ["NEO4J_USERNAME"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j username for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.password",
-    canonicalName: "NEO4J_PASSWORD",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Neo4j password for platform graph-sync surfaces."
-  },
-  {
-    id: "platform.neo4j.sync-secret",
-    canonicalName: "NEO4J_SYNC_SECRET",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls."
-  },
-  {
-    id: "platform.neo4j.database",
-    canonicalName: "NEO4J_DATABASE",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/graph/neo4j",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-graph-sync",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces."
-  }
-];
-var PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS = [
-  {
-    id: "platform.pinecone.api-key",
-    canonicalName: "PINECONE_API_KEY",
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: true,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone API key for platform vector search."
-  },
-  {
-    id: "platform.pinecone.index-name",
-    canonicalName: "PINECONE_INDEX_NAME",
-    aliases: ["PINECONE_INDEX"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone index name."
-  },
-  {
-    id: "platform.pinecone.host",
-    canonicalName: "PINECONE_HOST",
-    aliases: ["PINECONE_INDEX_HOST"],
-    owner: "lucern_platform",
-    scope: "environment",
-    sourcePath: "/platform/vector/pinecone",
-    environmentPolicy: "environment_specific",
-    required: false,
-    secret: false,
-    public: false,
-    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
-    destinations: [
-      {
-        kind: "runtime_fetch",
-        target: "lucern-ai-runtime",
-        environmentPolicy: "environment_specific"
-      },
-      {
-        kind: "github_actions",
-        target: "LucernAI/lucern",
-        environmentPolicy: "environment_specific"
-      }
-    ],
-    description: "Lucern-owned Pinecone host/index host."
-  }
-];
+// src/infisical-runtime.platform-observability-secrets.ts
 var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
   {
     id: "platform.sentry.dsn",
@@ -15265,7 +15061,7 @@ var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
   {
     id: "platform.sentry.release",
     canonicalName: "SENTRY_RELEASE",
-    aliases: ["NEXT_PUBLIC_SENTRY_RELEASE"],
+    aliases: ["LUCERN_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"],
     owner: "provider",
     scope: "environment",
     sourcePath: "/platform/observability/sentry",
@@ -15279,7 +15075,11 @@ var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
         kind: "vercel",
         target: "lucern",
         environmentPolicy: "environment_specific",
-        writeNames: ["SENTRY_RELEASE", "NEXT_PUBLIC_SENTRY_RELEASE"]
+        writeNames: [
+          "LUCERN_RELEASE",
+          "SENTRY_RELEASE",
+          "NEXT_PUBLIC_SENTRY_RELEASE"
+        ]
       },
       {
         kind: "vercel",
@@ -15290,49 +15090,300 @@ var PLATFORM_SENTRY_SECRET_DEFINITIONS = [
     description: "Lucern-owned Sentry release name."
   }
 ];
-var PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS = [
+var PLATFORM_AXIOM_SECRET_DEFINITIONS = [
   {
-    id: "platform.deploy.vercel-token",
-    canonicalName: "VERCEL_TOKEN",
+    id: "platform.axiom.token",
+    canonicalName: "AXIOM_TOKEN",
+    aliases: ["LUCERN_AXIOM_TOKEN"],
     owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
     required: false,
     secret: true,
     public: false,
-    consumers: ["lucern-repo-ci"],
+    consumers: [
+      "lucern-cli",
+      "lucern-gateway",
+      "lucern-sdk",
+      "lucern-mcp",
+      "lucern-agent",
+      "lucern-railway-pdp",
+      "lucern-repo-ci",
+      "lucern-observability"
+    ],
     destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
       {
         kind: "github_actions",
         target: "LucernAI/lucern",
-        environmentPolicy: "same_all_environments"
+        environmentPolicy: "environment_specific"
       },
       {
         kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
       }
     ],
-    description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps."
+    description: "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
   },
   {
-    id: "platform.deploy.vercel-token.stack",
-    canonicalName: "STACK_VERCEL_TOKEN",
+    id: "platform.axiom.events-dataset",
+    canonicalName: "LUCERN_AXIOM_EVENTS_DATASET",
+    aliases: ["AXIOM_DATASET", "AXIOM_EVENTS_DATASET", "LUCERN_AXIOM_DATASET"],
     owner: "provider",
-    scope: "global",
-    sourcePath: "/platform/deploy/vercel",
-    environmentPolicy: "same_all_environments",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
     required: false,
-    secret: true,
+    secret: false,
     public: false,
-    consumers: ["lucern-repo-ci"],
+    consumers: [
+      "lucern-cli",
+      "lucern-gateway",
+      "lucern-sdk",
+      "lucern-mcp",
+      "lucern-agent",
+      "lucern-railway-pdp",
+      "lucern-repo-ci",
+      "lucern-observability"
+    ],
     destinations: [
       {
-        kind: "operator_local",
-        target: "secret-sync-writer",
-        environmentPolicy: "same_all_environments"
-      }
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+  },
+  {
+    id: "platform.axiom.logs-dataset",
+    canonicalName: "LUCERN_AXIOM_LOGS_DATASET",
+    aliases: ["AXIOM_LOGS_DATASET"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-observability", "lucern-gateway", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Axiom OpenTelemetry log dataset for Lucern services."
+  },
+  {
+    id: "platform.axiom.traces-dataset",
+    canonicalName: "LUCERN_AXIOM_TRACES_DATASET",
+    aliases: ["AXIOM_TRACES_DATASET"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-observability", "lucern-gateway", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Axiom OpenTelemetry trace dataset for Lucern services."
+  },
+  {
+    id: "platform.axiom.metrics-dataset",
+    canonicalName: "LUCERN_AXIOM_METRICS_DATASET",
+    aliases: ["AXIOM_METRICS_DATASET"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-observability", "lucern-gateway", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Axiom OpenTelemetry metric dataset for Lucern services."
+  },
+  {
+    id: "platform.axiom.api-url",
+    canonicalName: "LUCERN_AXIOM_API_URL",
+    aliases: ["AXIOM_URL"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: [
+      "lucern-cli",
+      "lucern-gateway",
+      "lucern-sdk",
+      "lucern-mcp",
+      "lucern-agent",
+      "lucern-repo-ci"
+    ],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-cli-mcp-sdk",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Axiom API URL. Defaults to https://api.axiom.co when unset."
+  },
+  {
+    id: "platform.axiom.otlp-endpoint",
+    canonicalName: "OTEL_EXPORTER_OTLP_ENDPOINT",
+    aliases: ["LUCERN_AXIOM_OTLP_ENDPOINT"],
+    owner: "provider",
+    scope: "environment",
+    sourcePath: "/platform/observability",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-gateway", "lucern-railway-pdp", "lucern-observability"],
+    destinations: [
+      {
+        kind: "vercel",
+        target: "lucern-gateway",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "operator_local",
+        target: "lucern-repo",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "OTLP endpoint used by services that emit OpenTelemetry logs, metrics, and traces to Axiom."
+  }
+];
+
+// src/infisical-runtime.platform-automation-secrets.ts
+var PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS = [
+  {
+    id: "platform.deploy.vercel-token",
+    canonicalName: "VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "same_all_environments"
+      },
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
+    ],
+    description: "Vercel API token for the future reviewed live writer. Never copy into tenant apps."
+  },
+  {
+    id: "platform.deploy.vercel-token.stack",
+    canonicalName: "STACK_VERCEL_TOKEN",
+    owner: "provider",
+    scope: "global",
+    sourcePath: "/platform/deploy/vercel",
+    environmentPolicy: "same_all_environments",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "operator_local",
+        target: "secret-sync-writer",
+        environmentPolicy: "same_all_environments"
+      }
     ],
     description: "Stack Vercel API token for manifest-scoped Stack tenant Vercel secret sync. Never copy into tenant apps."
   },
@@ -15882,38 +15933,247 @@ var PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS = [
   }
 ];
 
-// src/infisical-runtime.tenant-secrets.ts
-var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+// src/infisical-runtime.platform-ops-secrets.ts
+var PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS = [
   {
-    idSuffix: "clerk.publishable",
-    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
-    aliases: ["CLERK_PUBLISHABLE_KEY"],
-    required: true,
+    id: "platform.neo4j.uri",
+    canonicalName: "NEO4J_URI",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
     secret: false,
-    public: true,
-    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
-  },
-  {
-    idSuffix: "clerk.secret",
-    canonicalName: "CLERK_SECRET_KEY",
-    required: true,
-    secret: true,
     public: false,
-    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j URI for platform graph-sync surfaces."
   },
   {
-    idSuffix: "clerk.project",
-    canonicalName: "CLERK_PROJECT_ID",
-    required: true,
+    id: "platform.neo4j.user",
+    canonicalName: "NEO4J_USER",
+    aliases: ["NEO4J_USERNAME"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
     secret: false,
     public: false,
-    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j username for platform graph-sync surfaces."
   },
   {
-    idSuffix: "clerk.jwks",
-    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
-    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
-    required: false,
+    id: "platform.neo4j.password",
+    canonicalName: "NEO4J_PASSWORD",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Neo4j password for platform graph-sync surfaces."
+  },
+  {
+    id: "platform.neo4j.sync-secret",
+    canonicalName: "NEO4J_SYNC_SECRET",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Shared secret protecting Lucern-owned graph-sync HTTP/query proxy calls."
+  },
+  {
+    id: "platform.neo4j.database",
+    canonicalName: "NEO4J_DATABASE",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/graph/neo4j",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-graph-sync", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-graph-sync",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Optional Neo4j database name for Lucern-owned graph-sync surfaces."
+  }
+];
+var PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS = [
+  {
+    id: "platform.pinecone.api-key",
+    canonicalName: "PINECONE_API_KEY",
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: true,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone API key for platform vector search."
+  },
+  {
+    id: "platform.pinecone.index-name",
+    canonicalName: "PINECONE_INDEX_NAME",
+    aliases: ["PINECONE_INDEX"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone index name."
+  },
+  {
+    id: "platform.pinecone.host",
+    canonicalName: "PINECONE_HOST",
+    aliases: ["PINECONE_INDEX_HOST"],
+    owner: "lucern_platform",
+    scope: "environment",
+    sourcePath: "/platform/vector/pinecone",
+    environmentPolicy: "environment_specific",
+    required: false,
+    secret: false,
+    public: false,
+    consumers: ["lucern-ai-runtime", "lucern-repo-ci"],
+    destinations: [
+      {
+        kind: "runtime_fetch",
+        target: "lucern-ai-runtime",
+        environmentPolicy: "environment_specific"
+      },
+      {
+        kind: "github_actions",
+        target: "LucernAI/lucern",
+        environmentPolicy: "environment_specific"
+      }
+    ],
+    description: "Lucern-owned Pinecone host/index host."
+  }
+];
+
+// src/infisical-runtime.tenant-secrets.ts
+var TENANT_SHARED_SECRET_DEFINITION_TEMPLATES = [
+  {
+    idSuffix: "clerk.publishable",
+    canonicalName: "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY",
+    aliases: ["CLERK_PUBLISHABLE_KEY"],
+    required: true,
+    secret: false,
+    public: true,
+    description: "Tenant-owned Clerk browser key. For Stack this is the master clerk.stack.vc project shared by front-end, StackOS, and the engineering workspace."
+  },
+  {
+    idSuffix: "clerk.secret",
+    canonicalName: "CLERK_SECRET_KEY",
+    required: true,
+    secret: true,
+    public: false,
+    description: "Tenant-owned Clerk backend secret used only by that tenant's server runtimes."
+  },
+  {
+    idSuffix: "clerk.project",
+    canonicalName: "CLERK_PROJECT_ID",
+    required: true,
+    secret: false,
+    public: false,
+    description: "Tenant-owned Clerk project id used to resolve canonical Clerk aliases."
+  },
+  {
+    idSuffix: "clerk.jwks",
+    canonicalName: "CLERK_JWT_ISSUER_DOMAIN",
+    aliases: ["CLERK_ISSUER_URL", "CLERK_JWKS_URL"],
+    required: false,
     secret: false,
     public: false,
     description: "Tenant Clerk issuer/JWKS URL consumed by Convex auth.config.ts."
@@ -16798,6 +17058,7 @@ var INFISICAL_SECRET_DEFINITIONS = [
   ...PLATFORM_GRAPH_STORE_SECRET_DEFINITIONS,
   ...PLATFORM_VECTOR_STORE_SECRET_DEFINITIONS,
   ...PLATFORM_SENTRY_SECRET_DEFINITIONS,
+  ...PLATFORM_AXIOM_SECRET_DEFINITIONS,
   ...PLATFORM_DEPLOY_AUTOMATION_SECRET_DEFINITIONS,
   ...PLATFORM_LOCAL_OPERATOR_CONFIG_SECRET_DEFINITIONS,
   ...TENANT_SHARED_SECRET_DEFINITIONS,
@@ -17052,6 +17313,13 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "AWS_ACCESS_KEY_ID",
     "AWS_REGION",
     "AWS_SECRET_ACCESS_KEY",
+    "AXIOM_DATASET",
+    "AXIOM_EVENTS_DATASET",
+    "AXIOM_LOGS_DATASET",
+    "AXIOM_METRICS_DATASET",
+    "AXIOM_TOKEN",
+    "AXIOM_TRACES_DATASET",
+    "AXIOM_URL",
     "CLERK_AUTHORIZED_PARTIES",
     "CLERK_ISSUER_URL",
     "CLERK_JWKS_URL",
@@ -17124,6 +17392,14 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_KEY",
     "LUCERN_API_URL",
     "LUCERN_AUTH_BASE_URL",
+    "LUCERN_AXIOM_API_URL",
+    "LUCERN_AXIOM_DATASET",
+    "LUCERN_AXIOM_EVENTS_DATASET",
+    "LUCERN_AXIOM_LOGS_DATASET",
+    "LUCERN_AXIOM_METRICS_DATASET",
+    "LUCERN_AXIOM_OTLP_ENDPOINT",
+    "LUCERN_AXIOM_TOKEN",
+    "LUCERN_AXIOM_TRACES_DATASET",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
     "LUCERN_CLERK_WEBHOOK_SECRET",
@@ -17184,6 +17460,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PROJECT_ID",
     "LUCERN_PROXY_TOKEN_SECRET",
     "LUCERN_PUBLIC_URL",
+    "LUCERN_RELEASE",
     "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
     "LUCERN_RUN_LIVE_MCP",
     "LUCERN_SDK_INSTALL_SPEC",
@@ -17246,6 +17523,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "NODE_AUTH_TOKEN",
     "NPM_TOKEN",
     "OPENAI_API_KEY",
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
@@ -17298,6 +17576,13 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "AWS_ACCESS_KEY_ID",
     "AWS_REGION",
     "AWS_SECRET_ACCESS_KEY",
+    "AXIOM_DATASET",
+    "AXIOM_EVENTS_DATASET",
+    "AXIOM_LOGS_DATASET",
+    "AXIOM_METRICS_DATASET",
+    "AXIOM_TOKEN",
+    "AXIOM_TRACES_DATASET",
+    "AXIOM_URL",
     "CI",
     "CLAUDE_PROJECT_DIR",
     "CLERK_AUTHORIZED_PARTIES",
@@ -17386,6 +17671,14 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_KEY",
     "LUCERN_API_URL",
     "LUCERN_AUTH_BASE_URL",
+    "LUCERN_AXIOM_API_URL",
+    "LUCERN_AXIOM_DATASET",
+    "LUCERN_AXIOM_EVENTS_DATASET",
+    "LUCERN_AXIOM_LOGS_DATASET",
+    "LUCERN_AXIOM_METRICS_DATASET",
+    "LUCERN_AXIOM_OTLP_ENDPOINT",
+    "LUCERN_AXIOM_TOKEN",
+    "LUCERN_AXIOM_TRACES_DATASET",
     "LUCERN_BASE_URL",
     "LUCERN_CLERK_PROJECT_ID",
     "LUCERN_CLERK_WEBHOOK_SECRET",
@@ -17448,6 +17741,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_PROJECT_ID",
     "LUCERN_PROXY_TOKEN_SECRET",
     "LUCERN_PUBLIC_URL",
+    "LUCERN_RELEASE",
     "LUCERN_REQUIRE_DEPLOYMENT_HOST_REGISTRY",
     "LUCERN_RUN_LIVE_MCP",
     "LUCERN_SDK_INSTALL_SPEC",
@@ -17513,6 +17807,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "NODE_ENV",
     "NPM_TOKEN",
     "OPENAI_API_KEY",
+    "OTEL_EXPORTER_OTLP_ENDPOINT",
     "PERMIT_API_KEY",
     "PERMIT_API_URL",
     "PERMIT_PDP_URL",
@@ -17843,6 +18138,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "stack/frontend: Tenant-owned AWS secret access key for document/file ingestion. stack/stackos: Tenant-owned AWS secret access key for document/file ingestion."
     },
+    "AXIOM_TOKEN": {
+      "secretId": "platform.axiom.token",
+      "canonicalName": "AXIOM_TOKEN",
+      "envNames": [
+        "AXIOM_TOKEN",
+        "LUCERN_AXIOM_TOKEN"
+      ],
+      "aliases": [
+        "LUCERN_AXIOM_TOKEN"
+      ],
+      "writeNames": [
+        "AXIOM_TOKEN"
+      ],
+      "required": false,
+      "secret": true,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-cli",
+        "lucern-gateway",
+        "lucern-sdk",
+        "lucern-mcp",
+        "lucern-agent",
+        "lucern-railway-pdp",
+        "lucern-repo-ci",
+        "lucern-observability"
+      ],
+      "destinations": [
+        {
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ]
+        },
+        {
+          "kind": "github_actions",
+          "target": "LucernAI/lucern",
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "lucern-repo",
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ]
+        }
+      ],
+      "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+    },
     "CLERK_AUTHORIZED_PARTIES": {
       "secretId": "tenant.lucern-graph.clerk.authorized-parties",
       "canonicalName": "CLERK_AUTHORIZED_PARTIES",
@@ -19668,41 +20023,300 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "Canonical Lucern API gateway base URL. Older names remain aliases only. Canonical Lucern API gateway URL. Canonical Lucern API gateway URL. Canonical Lucern API gateway URL. Canonical Lucern API gateway URL. Canonical Lucern API gateway URL."
     },
-    "LUCERN_BASE_URL": {
-      "secretId": "tenant.stack-frontend.lucern.gateway-base-url",
-      "canonicalName": "LUCERN_BASE_URL",
+    "LUCERN_AXIOM_API_URL": {
+      "secretId": "platform.axiom.api-url",
+      "canonicalName": "LUCERN_AXIOM_API_URL",
       "envNames": [
-        "LUCERN_API_BASE_URL",
-        "LUCERN_BASE_URL",
-        "LUCERN_GATEWAY_BASE_URL"
+        "AXIOM_URL",
+        "LUCERN_AXIOM_API_URL"
       ],
       "aliases": [
-        "LUCERN_API_BASE_URL",
-        "LUCERN_GATEWAY_BASE_URL"
+        "AXIOM_URL"
       ],
       "writeNames": [
-        "LUCERN_BASE_URL"
+        "LUCERN_AXIOM_API_URL"
       ],
       "required": false,
       "secret": false,
       "public": false,
-      "sourcePath": "/tenants/stack",
+      "sourcePath": "/platform/observability",
       "environmentPolicy": "environment_specific",
       "consumers": [
-        "tenant-agent-runtime",
-        "tenant-vercel-app"
+        "lucern-cli",
+        "lucern-gateway",
+        "lucern-sdk",
+        "lucern-mcp",
+        "lucern-agent",
+        "lucern-repo-ci"
       ],
       "destinations": [
         {
-          "kind": "vercel",
-          "target": "ai-chatbot-diao",
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
           "writeNames": [
-            "LUCERN_BASE_URL"
+            "LUCERN_AXIOM_API_URL"
           ]
         },
         {
-          "kind": "convex",
-          "target": "rugged-lobster-664|wonderful-toucan-0",
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_AXIOM_API_URL"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "lucern-repo",
+          "writeNames": [
+            "LUCERN_AXIOM_API_URL"
+          ]
+        }
+      ],
+      "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+    },
+    "LUCERN_AXIOM_EVENTS_DATASET": {
+      "secretId": "platform.axiom.events-dataset",
+      "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+      "envNames": [
+        "AXIOM_DATASET",
+        "AXIOM_EVENTS_DATASET",
+        "LUCERN_AXIOM_DATASET",
+        "LUCERN_AXIOM_EVENTS_DATASET"
+      ],
+      "aliases": [
+        "AXIOM_DATASET",
+        "AXIOM_EVENTS_DATASET",
+        "LUCERN_AXIOM_DATASET"
+      ],
+      "writeNames": [
+        "LUCERN_AXIOM_EVENTS_DATASET"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-cli",
+        "lucern-gateway",
+        "lucern-sdk",
+        "lucern-mcp",
+        "lucern-agent",
+        "lucern-railway-pdp",
+        "lucern-repo-ci",
+        "lucern-observability"
+      ],
+      "destinations": [
+        {
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ]
+        },
+        {
+          "kind": "github_actions",
+          "target": "LucernAI/lucern",
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "lucern-repo",
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ]
+        }
+      ],
+      "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+    },
+    "LUCERN_AXIOM_LOGS_DATASET": {
+      "secretId": "platform.axiom.logs-dataset",
+      "canonicalName": "LUCERN_AXIOM_LOGS_DATASET",
+      "envNames": [
+        "AXIOM_LOGS_DATASET",
+        "LUCERN_AXIOM_LOGS_DATASET"
+      ],
+      "aliases": [
+        "AXIOM_LOGS_DATASET"
+      ],
+      "writeNames": [
+        "LUCERN_AXIOM_LOGS_DATASET"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-observability",
+        "lucern-gateway",
+        "lucern-repo-ci"
+      ],
+      "destinations": [
+        {
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
+          "writeNames": [
+            "LUCERN_AXIOM_LOGS_DATASET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_AXIOM_LOGS_DATASET"
+          ]
+        },
+        {
+          "kind": "github_actions",
+          "target": "LucernAI/lucern",
+          "writeNames": [
+            "LUCERN_AXIOM_LOGS_DATASET"
+          ]
+        }
+      ],
+      "description": "Axiom OpenTelemetry log dataset for Lucern services."
+    },
+    "LUCERN_AXIOM_METRICS_DATASET": {
+      "secretId": "platform.axiom.metrics-dataset",
+      "canonicalName": "LUCERN_AXIOM_METRICS_DATASET",
+      "envNames": [
+        "AXIOM_METRICS_DATASET",
+        "LUCERN_AXIOM_METRICS_DATASET"
+      ],
+      "aliases": [
+        "AXIOM_METRICS_DATASET"
+      ],
+      "writeNames": [
+        "LUCERN_AXIOM_METRICS_DATASET"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-observability",
+        "lucern-gateway",
+        "lucern-repo-ci"
+      ],
+      "destinations": [
+        {
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
+          "writeNames": [
+            "LUCERN_AXIOM_METRICS_DATASET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_AXIOM_METRICS_DATASET"
+          ]
+        },
+        {
+          "kind": "github_actions",
+          "target": "LucernAI/lucern",
+          "writeNames": [
+            "LUCERN_AXIOM_METRICS_DATASET"
+          ]
+        }
+      ],
+      "description": "Axiom OpenTelemetry metric dataset for Lucern services."
+    },
+    "LUCERN_AXIOM_TRACES_DATASET": {
+      "secretId": "platform.axiom.traces-dataset",
+      "canonicalName": "LUCERN_AXIOM_TRACES_DATASET",
+      "envNames": [
+        "AXIOM_TRACES_DATASET",
+        "LUCERN_AXIOM_TRACES_DATASET"
+      ],
+      "aliases": [
+        "AXIOM_TRACES_DATASET"
+      ],
+      "writeNames": [
+        "LUCERN_AXIOM_TRACES_DATASET"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-observability",
+        "lucern-gateway",
+        "lucern-repo-ci"
+      ],
+      "destinations": [
+        {
+          "kind": "runtime_fetch",
+          "target": "lucern-cli-mcp-sdk",
+          "writeNames": [
+            "LUCERN_AXIOM_TRACES_DATASET"
+          ]
+        },
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "LUCERN_AXIOM_TRACES_DATASET"
+          ]
+        },
+        {
+          "kind": "github_actions",
+          "target": "LucernAI/lucern",
+          "writeNames": [
+            "LUCERN_AXIOM_TRACES_DATASET"
+          ]
+        }
+      ],
+      "description": "Axiom OpenTelemetry trace dataset for Lucern services."
+    },
+    "LUCERN_BASE_URL": {
+      "secretId": "tenant.stack-frontend.lucern.gateway-base-url",
+      "canonicalName": "LUCERN_BASE_URL",
+      "envNames": [
+        "LUCERN_API_BASE_URL",
+        "LUCERN_BASE_URL",
+        "LUCERN_GATEWAY_BASE_URL"
+      ],
+      "aliases": [
+        "LUCERN_API_BASE_URL",
+        "LUCERN_GATEWAY_BASE_URL"
+      ],
+      "writeNames": [
+        "LUCERN_BASE_URL"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/tenants/stack",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "tenant-agent-runtime",
+        "tenant-vercel-app"
+      ],
+      "destinations": [
+        {
+          "kind": "vercel",
+          "target": "ai-chatbot-diao",
+          "writeNames": [
+            "LUCERN_BASE_URL"
+          ]
+        },
+        {
+          "kind": "convex",
+          "target": "rugged-lobster-664|wonderful-toucan-0",
           "writeNames": [
             "LUCERN_BASE_URL"
           ]
@@ -22069,6 +22683,47 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "description": "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation. stack/frontend: Tenant-owned OpenAI key for product runtime LLM calls. stack/stackos: Tenant-owned OpenAI key for product runtime LLM calls."
     },
+    "OTEL_EXPORTER_OTLP_ENDPOINT": {
+      "secretId": "platform.axiom.otlp-endpoint",
+      "canonicalName": "OTEL_EXPORTER_OTLP_ENDPOINT",
+      "envNames": [
+        "LUCERN_AXIOM_OTLP_ENDPOINT",
+        "OTEL_EXPORTER_OTLP_ENDPOINT"
+      ],
+      "aliases": [
+        "LUCERN_AXIOM_OTLP_ENDPOINT"
+      ],
+      "writeNames": [
+        "OTEL_EXPORTER_OTLP_ENDPOINT"
+      ],
+      "required": false,
+      "secret": false,
+      "public": false,
+      "sourcePath": "/platform/observability",
+      "environmentPolicy": "environment_specific",
+      "consumers": [
+        "lucern-gateway",
+        "lucern-railway-pdp",
+        "lucern-observability"
+      ],
+      "destinations": [
+        {
+          "kind": "vercel",
+          "target": "lucern-gateway",
+          "writeNames": [
+            "OTEL_EXPORTER_OTLP_ENDPOINT"
+          ]
+        },
+        {
+          "kind": "operator_local",
+          "target": "lucern-repo",
+          "writeNames": [
+            "OTEL_EXPORTER_OTLP_ENDPOINT"
+          ]
+        }
+      ],
+      "description": "OTLP endpoint used by services that emit OpenTelemetry logs, metrics, and traces to Axiom."
+    },
     "PINECONE_API_KEY": {
       "secretId": "platform.pinecone.api-key",
       "canonicalName": "PINECONE_API_KEY",
@@ -22683,13 +23338,16 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       "secretId": "platform.sentry.release",
       "canonicalName": "SENTRY_RELEASE",
       "envNames": [
+        "LUCERN_RELEASE",
         "NEXT_PUBLIC_SENTRY_RELEASE",
         "SENTRY_RELEASE"
       ],
       "aliases": [
+        "LUCERN_RELEASE",
         "NEXT_PUBLIC_SENTRY_RELEASE"
       ],
       "writeNames": [
+        "LUCERN_RELEASE",
         "NEXT_PUBLIC_SENTRY_RELEASE",
         "SENTRY_RELEASE"
       ],
@@ -22708,6 +23366,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "kind": "vercel",
           "target": "lucern",
           "writeNames": [
+            "LUCERN_RELEASE",
             "SENTRY_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE"
           ]
@@ -23101,6 +23760,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "AWS_ACCESS_KEY_ID": "AWS_ACCESS_KEY_ID",
     "AWS_REGION": "AWS_REGION",
     "AWS_SECRET_ACCESS_KEY": "AWS_SECRET_ACCESS_KEY",
+    "AXIOM_TOKEN": "AXIOM_TOKEN",
+    "LUCERN_AXIOM_TOKEN": "AXIOM_TOKEN",
     "CLERK_AUTHORIZED_PARTIES": "CLERK_AUTHORIZED_PARTIES",
     "CLERK_MOBILE_AUTHORIZED_PARTIES": "CLERK_AUTHORIZED_PARTIES",
     "CLERK_JWKS_URL": "CLERK_JWT_ISSUER_DOMAIN",
@@ -23181,6 +23842,18 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "LUCERN_API_BASE_URL": "LUCERN_BASE_URL",
     "LUCERN_API_URL": "LUCERN_API_URL",
     "LUCERN_BASE_URL": "LUCERN_BASE_URL",
+    "AXIOM_URL": "LUCERN_AXIOM_API_URL",
+    "LUCERN_AXIOM_API_URL": "LUCERN_AXIOM_API_URL",
+    "AXIOM_DATASET": "LUCERN_AXIOM_EVENTS_DATASET",
+    "AXIOM_EVENTS_DATASET": "LUCERN_AXIOM_EVENTS_DATASET",
+    "LUCERN_AXIOM_DATASET": "LUCERN_AXIOM_EVENTS_DATASET",
+    "LUCERN_AXIOM_EVENTS_DATASET": "LUCERN_AXIOM_EVENTS_DATASET",
+    "AXIOM_LOGS_DATASET": "LUCERN_AXIOM_LOGS_DATASET",
+    "LUCERN_AXIOM_LOGS_DATASET": "LUCERN_AXIOM_LOGS_DATASET",
+    "AXIOM_METRICS_DATASET": "LUCERN_AXIOM_METRICS_DATASET",
+    "LUCERN_AXIOM_METRICS_DATASET": "LUCERN_AXIOM_METRICS_DATASET",
+    "AXIOM_TRACES_DATASET": "LUCERN_AXIOM_TRACES_DATASET",
+    "LUCERN_AXIOM_TRACES_DATASET": "LUCERN_AXIOM_TRACES_DATASET",
     "LUCERN_GATEWAY_BASE_URL": "LUCERN_BASE_URL",
     "CLERK_WEBHOOK_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
     "CLERK_WEBHOOK_SIGNING_SECRET": "LUCERN_CLERK_WEBHOOK_SECRET",
@@ -23306,6 +23979,8 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "NODE_AUTH_TOKEN": "NPM_TOKEN",
     "NPM_TOKEN": "NPM_TOKEN",
     "OPENAI_API_KEY": "OPENAI_API_KEY",
+    "LUCERN_AXIOM_OTLP_ENDPOINT": "OTEL_EXPORTER_OTLP_ENDPOINT",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "OTEL_EXPORTER_OTLP_ENDPOINT",
     "PINECONE_API_KEY": "PINECONE_API_KEY",
     "PINECONE_HOST": "PINECONE_HOST",
     "PINECONE_INDEX_HOST": "PINECONE_HOST",
@@ -23317,6 +23992,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
     "SENTRY_ORG_SLUG": "SENTRY_ORG",
     "SENTRY_PROJECT": "SENTRY_PROJECT",
     "SENTRY_PROJECT_NEXTJS": "SENTRY_PROJECT",
+    "LUCERN_RELEASE": "SENTRY_RELEASE",
     "SENTRY_WEBHOOK_SECRET": "SENTRY_WEBHOOK_SECRET",
     "SOCKET_API_KEY": "SOCKET_API_KEY",
     "SOCKET_SECURITY_API_KEY": "SOCKET_API_KEY",
@@ -23852,13 +24528,16 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "secretId": "platform.sentry.release",
           "canonicalName": "SENTRY_RELEASE",
           "envNames": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE",
             "SENTRY_RELEASE"
           ],
           "aliases": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE"
           ],
           "writeNames": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE",
             "SENTRY_RELEASE"
           ],
@@ -23877,6 +24556,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
               "kind": "vercel",
               "target": "lucern",
               "writeNames": [
+                "LUCERN_RELEASE",
                 "SENTRY_RELEASE",
                 "NEXT_PUBLIC_SENTRY_RELEASE"
               ]
@@ -23905,49 +24585,109 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       ],
       "variables": [
         {
-          "secretId": "platform.clerk.jwks",
-          "canonicalName": "CLERK_JWKS_URL",
+          "secretId": "platform.axiom.token",
+          "canonicalName": "AXIOM_TOKEN",
           "envNames": [
-            "CLERK_JWKS_URL",
-            "CLERK_JWT_ISSUER_DOMAIN"
+            "AXIOM_TOKEN",
+            "LUCERN_AXIOM_TOKEN"
           ],
           "aliases": [
-            "CLERK_JWT_ISSUER_DOMAIN"
+            "LUCERN_AXIOM_TOKEN"
           ],
           "writeNames": [
-            "CLERK_JWKS_URL"
+            "AXIOM_TOKEN"
           ],
           "required": false,
-          "secret": false,
+          "secret": true,
           "public": false,
-          "sourcePath": "/platform/auth",
+          "sourcePath": "/platform/observability",
           "environmentPolicy": "environment_specific",
           "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
             "lucern-mcp",
-            "lucern-gateway"
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
           ],
           "destinations": [
             {
               "kind": "runtime_fetch",
-              "target": "lucern-mcp",
+              "target": "lucern-cli-mcp-sdk",
               "writeNames": [
-                "CLERK_JWKS_URL"
+                "AXIOM_TOKEN"
               ]
             },
             {
               "kind": "vercel",
               "target": "lucern-gateway",
               "writeNames": [
-                "CLERK_JWKS_URL"
+                "AXIOM_TOKEN"
               ]
-            }
-          ],
-          "description": "Optional Clerk JWKS/issuer override for server-side token verification."
-        },
-        {
-          "canonicalName": "CLERK_JWT_ISSUER_DOMAIN",
-          "envNames": [
-            "CLERK_JWT_ISSUER_DOMAIN"
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            }
+          ],
+          "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+        },
+        {
+          "secretId": "platform.clerk.jwks",
+          "canonicalName": "CLERK_JWKS_URL",
+          "envNames": [
+            "CLERK_JWKS_URL",
+            "CLERK_JWT_ISSUER_DOMAIN"
+          ],
+          "aliases": [
+            "CLERK_JWT_ISSUER_DOMAIN"
+          ],
+          "writeNames": [
+            "CLERK_JWKS_URL"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/auth",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-mcp",
+            "lucern-gateway"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-mcp",
+              "writeNames": [
+                "CLERK_JWKS_URL"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "CLERK_JWKS_URL"
+              ]
+            }
+          ],
+          "description": "Optional Clerk JWKS/issuer override for server-side token verification."
+        },
+        {
+          "canonicalName": "CLERK_JWT_ISSUER_DOMAIN",
+          "envNames": [
+            "CLERK_JWT_ISSUER_DOMAIN"
           ],
           "aliases": [],
           "writeNames": [
@@ -24208,6 +24948,265 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
         },
+        {
+          "secretId": "platform.axiom.api-url",
+          "canonicalName": "LUCERN_AXIOM_API_URL",
+          "envNames": [
+            "AXIOM_URL",
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "aliases": [
+            "AXIOM_URL"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            }
+          ],
+          "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+        },
+        {
+          "secretId": "platform.axiom.events-dataset",
+          "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+          "envNames": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET",
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            }
+          ],
+          "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+        },
+        {
+          "secretId": "platform.axiom.logs-dataset",
+          "canonicalName": "LUCERN_AXIOM_LOGS_DATASET",
+          "envNames": [
+            "AXIOM_LOGS_DATASET",
+            "LUCERN_AXIOM_LOGS_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_LOGS_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_LOGS_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-observability",
+            "lucern-gateway",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_LOGS_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_LOGS_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_LOGS_DATASET"
+              ]
+            }
+          ],
+          "description": "Axiom OpenTelemetry log dataset for Lucern services."
+        },
+        {
+          "secretId": "platform.axiom.metrics-dataset",
+          "canonicalName": "LUCERN_AXIOM_METRICS_DATASET",
+          "envNames": [
+            "AXIOM_METRICS_DATASET",
+            "LUCERN_AXIOM_METRICS_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_METRICS_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_METRICS_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-observability",
+            "lucern-gateway",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_METRICS_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_METRICS_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_METRICS_DATASET"
+              ]
+            }
+          ],
+          "description": "Axiom OpenTelemetry metric dataset for Lucern services."
+        },
+        {
+          "secretId": "platform.axiom.traces-dataset",
+          "canonicalName": "LUCERN_AXIOM_TRACES_DATASET",
+          "envNames": [
+            "AXIOM_TRACES_DATASET",
+            "LUCERN_AXIOM_TRACES_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_TRACES_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_TRACES_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-observability",
+            "lucern-gateway",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_TRACES_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_TRACES_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_TRACES_DATASET"
+              ]
+            }
+          ],
+          "description": "Axiom OpenTelemetry trace dataset for Lucern services."
+        },
         {
           "secretId": "platform.clerk.webhook-secret",
           "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
@@ -24825,17 +25824,58 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "description": "Lucern-owned Sentry DSN for browser/server error telemetry."
         },
         {
-          "secretId": "platform.sentry.environment",
-          "canonicalName": "SENTRY_ENVIRONMENT",
+          "secretId": "platform.axiom.otlp-endpoint",
+          "canonicalName": "OTEL_EXPORTER_OTLP_ENDPOINT",
           "envNames": [
-            "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
-            "SENTRY_ENVIRONMENT"
+            "LUCERN_AXIOM_OTLP_ENDPOINT",
+            "OTEL_EXPORTER_OTLP_ENDPOINT"
           ],
           "aliases": [
-            "NEXT_PUBLIC_SENTRY_ENVIRONMENT"
+            "LUCERN_AXIOM_OTLP_ENDPOINT"
           ],
           "writeNames": [
-            "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+            "OTEL_EXPORTER_OTLP_ENDPOINT"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-gateway",
+            "lucern-railway-pdp",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "OTEL_EXPORTER_OTLP_ENDPOINT"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "OTEL_EXPORTER_OTLP_ENDPOINT"
+              ]
+            }
+          ],
+          "description": "OTLP endpoint used by services that emit OpenTelemetry logs, metrics, and traces to Axiom."
+        },
+        {
+          "secretId": "platform.sentry.environment",
+          "canonicalName": "SENTRY_ENVIRONMENT",
+          "envNames": [
+            "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+            "SENTRY_ENVIRONMENT"
+          ],
+          "aliases": [
+            "NEXT_PUBLIC_SENTRY_ENVIRONMENT"
+          ],
+          "writeNames": [
+            "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
             "SENTRY_ENVIRONMENT"
           ],
           "required": false,
@@ -24871,13 +25911,16 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "secretId": "platform.sentry.release",
           "canonicalName": "SENTRY_RELEASE",
           "envNames": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE",
             "SENTRY_RELEASE"
           ],
           "aliases": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE"
           ],
           "writeNames": [
+            "LUCERN_RELEASE",
             "NEXT_PUBLIC_SENTRY_RELEASE",
             "SENTRY_RELEASE"
           ],
@@ -24896,6 +25939,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
               "kind": "vercel",
               "target": "lucern",
               "writeNames": [
+                "LUCERN_RELEASE",
                 "SENTRY_RELEASE",
                 "NEXT_PUBLIC_SENTRY_RELEASE"
               ]
@@ -24923,6 +25967,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         "platform-operator-credentials"
       ],
       "variables": [
+        {
+          "secretId": "platform.axiom.token",
+          "canonicalName": "AXIOM_TOKEN",
+          "envNames": [
+            "AXIOM_TOKEN",
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "aliases": [
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ],
+          "required": false,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            }
+          ],
+          "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+        },
         {
           "canonicalName": "LUCERN_API_KEY",
           "envNames": [
@@ -24971,6 +26075,121 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "destinations": [],
           "description": "Canonical Lucern API gateway URL."
         },
+        {
+          "secretId": "platform.axiom.api-url",
+          "canonicalName": "LUCERN_AXIOM_API_URL",
+          "envNames": [
+            "AXIOM_URL",
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "aliases": [
+            "AXIOM_URL"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            }
+          ],
+          "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+        },
+        {
+          "secretId": "platform.axiom.events-dataset",
+          "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+          "envNames": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET",
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            }
+          ],
+          "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+        },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
           "envNames": [
@@ -25050,6 +26269,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         "platform-operator-credentials"
       ],
       "variables": [
+        {
+          "secretId": "platform.axiom.token",
+          "canonicalName": "AXIOM_TOKEN",
+          "envNames": [
+            "AXIOM_TOKEN",
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "aliases": [
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ],
+          "required": false,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            }
+          ],
+          "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+        },
         {
           "canonicalName": "LUCERN_API_KEY",
           "envNames": [
@@ -25147,6 +26426,121 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           ],
           "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
         },
+        {
+          "secretId": "platform.axiom.api-url",
+          "canonicalName": "LUCERN_AXIOM_API_URL",
+          "envNames": [
+            "AXIOM_URL",
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "aliases": [
+            "AXIOM_URL"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_API_URL"
+              ]
+            }
+          ],
+          "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+        },
+        {
+          "secretId": "platform.axiom.events-dataset",
+          "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+          "envNames": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET",
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "aliases": [
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET"
+          ],
+          "writeNames": [
+            "LUCERN_AXIOM_EVENTS_DATASET"
+          ],
+          "required": false,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            }
+          ],
+          "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+        },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
           "envNames": [
@@ -25439,6 +26833,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         "platform-operator-credentials"
       ],
       "variables": [
+        {
+          "secretId": "platform.axiom.token",
+          "canonicalName": "AXIOM_TOKEN",
+          "envNames": [
+            "AXIOM_TOKEN",
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "aliases": [
+            "LUCERN_AXIOM_TOKEN"
+          ],
+          "writeNames": [
+            "AXIOM_TOKEN"
+          ],
+          "required": false,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/observability",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
+            "lucern-mcp",
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "AXIOM_TOKEN"
+              ]
+            }
+          ],
+          "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+        },
         {
           "secretId": "platform.clerk.jwks",
           "canonicalName": "CLERK_JWKS_URL",
@@ -25531,19 +26985,120 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
             "LUCERN_KEY"
           ],
           "aliases": [
-            "LUCERN_KEY"
+            "LUCERN_KEY"
+          ],
+          "writeNames": [
+            "LUCERN_API_KEY"
+          ],
+          "required": false,
+          "secret": true,
+          "public": false,
+          "sourcePath": "/platform/runtime",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-mcp",
+            "lucern-repo-ci"
+          ],
+          "destinations": [
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_API_KEY"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_API_KEY"
+              ]
+            },
+            {
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
+              "writeNames": [
+                "LUCERN_API_KEY"
+              ]
+            }
+          ],
+          "description": "Lucern-owned operator API key for gateway calls from trusted local tooling. Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+        },
+        {
+          "canonicalName": "LUCERN_API_URL",
+          "envNames": [
+            "LUCERN_API_BASE_URL",
+            "LUCERN_API_URL",
+            "LUCERN_BASE_URL"
+          ],
+          "aliases": [
+            "LUCERN_API_BASE_URL",
+            "LUCERN_BASE_URL"
+          ],
+          "writeNames": [
+            "LUCERN_API_URL"
+          ],
+          "required": true,
+          "secret": false,
+          "public": false,
+          "sourcePath": "/platform/runtime",
+          "environmentPolicy": "environment_specific",
+          "consumers": [
+            "lucern-cli",
+            "lucern-gateway",
+            "lucern-mcp",
+            "lucern-web"
+          ],
+          "destinations": [
+            {
+              "kind": "vercel",
+              "target": "lucern",
+              "writeNames": [
+                "LUCERN_API_URL"
+              ]
+            },
+            {
+              "kind": "vercel",
+              "target": "lucern-gateway",
+              "writeNames": [
+                "LUCERN_API_URL"
+              ]
+            },
+            {
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
+              "writeNames": [
+                "LUCERN_API_URL"
+              ]
+            }
+          ],
+          "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
+        },
+        {
+          "secretId": "platform.axiom.api-url",
+          "canonicalName": "LUCERN_AXIOM_API_URL",
+          "envNames": [
+            "AXIOM_URL",
+            "LUCERN_AXIOM_API_URL"
+          ],
+          "aliases": [
+            "AXIOM_URL"
           ],
           "writeNames": [
-            "LUCERN_API_KEY"
+            "LUCERN_AXIOM_API_URL"
           ],
           "required": false,
-          "secret": true,
+          "secret": false,
           "public": false,
-          "sourcePath": "/platform/runtime",
+          "sourcePath": "/platform/observability",
           "environmentPolicy": "environment_specific",
           "consumers": [
             "lucern-cli",
+            "lucern-gateway",
+            "lucern-sdk",
             "lucern-mcp",
+            "lucern-agent",
             "lucern-repo-ci"
           ],
           "destinations": [
@@ -25551,75 +27106,89 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
               "kind": "runtime_fetch",
               "target": "lucern-cli-mcp-sdk",
               "writeNames": [
-                "LUCERN_API_KEY"
+                "LUCERN_AXIOM_API_URL"
               ]
             },
             {
-              "kind": "operator_local",
-              "target": "lucern-repo",
+              "kind": "vercel",
+              "target": "lucern-gateway",
               "writeNames": [
-                "LUCERN_API_KEY"
+                "LUCERN_AXIOM_API_URL"
               ]
             },
             {
-              "kind": "github_actions",
-              "target": "LucernAI/lucern",
+              "kind": "operator_local",
+              "target": "lucern-repo",
               "writeNames": [
-                "LUCERN_API_KEY"
+                "LUCERN_AXIOM_API_URL"
               ]
             }
           ],
-          "description": "Lucern-owned operator API key for gateway calls from trusted local tooling. Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+          "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
         },
         {
-          "canonicalName": "LUCERN_API_URL",
+          "secretId": "platform.axiom.events-dataset",
+          "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
           "envNames": [
-            "LUCERN_API_BASE_URL",
-            "LUCERN_API_URL",
-            "LUCERN_BASE_URL"
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET",
+            "LUCERN_AXIOM_EVENTS_DATASET"
           ],
           "aliases": [
-            "LUCERN_API_BASE_URL",
-            "LUCERN_BASE_URL"
+            "AXIOM_DATASET",
+            "AXIOM_EVENTS_DATASET",
+            "LUCERN_AXIOM_DATASET"
           ],
           "writeNames": [
-            "LUCERN_API_URL"
+            "LUCERN_AXIOM_EVENTS_DATASET"
           ],
-          "required": true,
+          "required": false,
           "secret": false,
           "public": false,
-          "sourcePath": "/platform/runtime",
+          "sourcePath": "/platform/observability",
           "environmentPolicy": "environment_specific",
           "consumers": [
             "lucern-cli",
             "lucern-gateway",
+            "lucern-sdk",
             "lucern-mcp",
-            "lucern-web"
+            "lucern-agent",
+            "lucern-railway-pdp",
+            "lucern-repo-ci",
+            "lucern-observability"
           ],
           "destinations": [
             {
-              "kind": "vercel",
-              "target": "lucern",
+              "kind": "runtime_fetch",
+              "target": "lucern-cli-mcp-sdk",
               "writeNames": [
-                "LUCERN_API_URL"
+                "LUCERN_AXIOM_EVENTS_DATASET"
               ]
             },
             {
               "kind": "vercel",
               "target": "lucern-gateway",
               "writeNames": [
-                "LUCERN_API_URL"
+                "LUCERN_AXIOM_EVENTS_DATASET"
               ]
             },
             {
-              "kind": "runtime_fetch",
-              "target": "lucern-cli-mcp-sdk",
+              "kind": "github_actions",
+              "target": "LucernAI/lucern",
               "writeNames": [
-                "LUCERN_API_URL"
+                "LUCERN_AXIOM_EVENTS_DATASET"
+              ]
+            },
+            {
+              "kind": "operator_local",
+              "target": "lucern-repo",
+              "writeNames": [
+                "LUCERN_AXIOM_EVENTS_DATASET"
               ]
             }
           ],
-          "description": "Canonical Lucern API gateway URL. Canonical Lucern API gateway base URL. Older names remain aliases only."
+          "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
         },
         {
           "canonicalName": "LUCERN_CLI_SESSION_TTL_MS",
@@ -30849,6 +32418,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Lucern-owned Anthropic key for platform AI jobs, benchmarks, and controlled operator automation."
       },
+      {
+        "secretId": "platform.axiom.token",
+        "canonicalName": "AXIOM_TOKEN",
+        "envNames": [
+          "AXIOM_TOKEN",
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "writeNames": [
+          "AXIOM_TOKEN"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          }
+        ],
+        "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+      },
       {
         "secretId": "platform.mc.convex-deploy-key",
         "canonicalName": "CONVEX_MC_DEPLOY_KEY",
@@ -31182,137 +32811,345 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "LANGFUSE_HOST"
         ],
         "aliases": [
-          "LANGFUSE_BASEURL",
-          "LANGFUSE_HOST"
+          "LANGFUSE_BASEURL",
+          "LANGFUSE_HOST"
+        ],
+        "writeNames": [
+          "LANGFUSE_BASE_URL"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability/langfuse",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-observability",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "LANGFUSE_BASE_URL"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LANGFUSE_BASE_URL"
+            ]
+          }
+        ],
+        "description": "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases."
+      },
+      {
+        "secretId": "platform.langfuse.public-key",
+        "canonicalName": "LANGFUSE_PUBLIC_KEY",
+        "envNames": [
+          "LANGFUSE_PUBLIC_KEY"
+        ],
+        "aliases": [],
+        "writeNames": [
+          "LANGFUSE_PUBLIC_KEY"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability/langfuse",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-observability",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "LANGFUSE_PUBLIC_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LANGFUSE_PUBLIC_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+      },
+      {
+        "secretId": "platform.langfuse.secret-key",
+        "canonicalName": "LANGFUSE_SECRET_KEY",
+        "envNames": [
+          "LANGFUSE_SECRET_KEY"
+        ],
+        "aliases": [],
+        "writeNames": [
+          "LANGFUSE_SECRET_KEY"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/observability/langfuse",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-observability",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "LANGFUSE_SECRET_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LANGFUSE_SECRET_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+      },
+      {
+        "secretId": "platform.operator.api-key",
+        "canonicalName": "LUCERN_API_KEY",
+        "envNames": [
+          "LUCERN_API_KEY",
+          "LUCERN_KEY"
+        ],
+        "aliases": [
+          "LUCERN_KEY"
+        ],
+        "writeNames": [
+          "LUCERN_API_KEY"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/runtime",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-mcp",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_API_KEY"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_API_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_API_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+      },
+      {
+        "secretId": "platform.axiom.events-dataset",
+        "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+        "envNames": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET",
+          "LUCERN_AXIOM_EVENTS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET"
         ],
         "writeNames": [
-          "LANGFUSE_BASE_URL"
+          "LUCERN_AXIOM_EVENTS_DATASET"
         ],
         "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/observability/langfuse",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
-          "lucern-observability",
-          "lucern-repo-ci"
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LANGFUSE_BASE_URL"
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LANGFUSE_BASE_URL"
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
             ]
           }
         ],
-        "description": "Canonical Langfuse API origin. BASEURL/HOST are compatibility aliases."
+        "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
       },
       {
-        "secretId": "platform.langfuse.public-key",
-        "canonicalName": "LANGFUSE_PUBLIC_KEY",
+        "secretId": "platform.axiom.logs-dataset",
+        "canonicalName": "LUCERN_AXIOM_LOGS_DATASET",
         "envNames": [
-          "LANGFUSE_PUBLIC_KEY"
+          "AXIOM_LOGS_DATASET",
+          "LUCERN_AXIOM_LOGS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_LOGS_DATASET"
         ],
-        "aliases": [],
         "writeNames": [
-          "LANGFUSE_PUBLIC_KEY"
+          "LUCERN_AXIOM_LOGS_DATASET"
         ],
         "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/observability/langfuse",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
           "lucern-observability",
+          "lucern-gateway",
           "lucern-repo-ci"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LANGFUSE_PUBLIC_KEY"
+              "LUCERN_AXIOM_LOGS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_LOGS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LANGFUSE_PUBLIC_KEY"
+              "LUCERN_AXIOM_LOGS_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+        "description": "Axiom OpenTelemetry log dataset for Lucern services."
       },
       {
-        "secretId": "platform.langfuse.secret-key",
-        "canonicalName": "LANGFUSE_SECRET_KEY",
+        "secretId": "platform.axiom.metrics-dataset",
+        "canonicalName": "LUCERN_AXIOM_METRICS_DATASET",
         "envNames": [
-          "LANGFUSE_SECRET_KEY"
+          "AXIOM_METRICS_DATASET",
+          "LUCERN_AXIOM_METRICS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_METRICS_DATASET"
         ],
-        "aliases": [],
         "writeNames": [
-          "LANGFUSE_SECRET_KEY"
+          "LUCERN_AXIOM_METRICS_DATASET"
         ],
         "required": false,
-        "secret": true,
+        "secret": false,
         "public": false,
-        "sourcePath": "/platform/observability/langfuse",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
           "lucern-observability",
+          "lucern-gateway",
           "lucern-repo-ci"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LANGFUSE_SECRET_KEY"
+              "LUCERN_AXIOM_METRICS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_METRICS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LANGFUSE_SECRET_KEY"
+              "LUCERN_AXIOM_METRICS_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+        "description": "Axiom OpenTelemetry metric dataset for Lucern services."
       },
       {
-        "secretId": "platform.operator.api-key",
-        "canonicalName": "LUCERN_API_KEY",
+        "secretId": "platform.axiom.traces-dataset",
+        "canonicalName": "LUCERN_AXIOM_TRACES_DATASET",
         "envNames": [
-          "LUCERN_API_KEY",
-          "LUCERN_KEY"
+          "AXIOM_TRACES_DATASET",
+          "LUCERN_AXIOM_TRACES_DATASET"
         ],
         "aliases": [
-          "LUCERN_KEY"
+          "AXIOM_TRACES_DATASET"
         ],
         "writeNames": [
-          "LUCERN_API_KEY"
+          "LUCERN_AXIOM_TRACES_DATASET"
         ],
         "required": false,
-        "secret": true,
+        "secret": false,
         "public": false,
-        "sourcePath": "/platform/runtime",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-cli",
-          "lucern-mcp",
+          "lucern-observability",
+          "lucern-gateway",
           "lucern-repo-ci"
         ],
         "destinations": [
@@ -31320,25 +33157,25 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
             "kind": "runtime_fetch",
             "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           },
           {
-            "kind": "operator_local",
-            "target": "lucern-repo",
+            "kind": "vercel",
+            "target": "lucern-gateway",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+        "description": "Axiom OpenTelemetry trace dataset for Lucern services."
       },
       {
         "secretId": "platform.gateway.mode",
@@ -35777,6 +37614,66 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
       }
     ],
     "operator_local:lucern-repo": [
+      {
+        "secretId": "platform.axiom.token",
+        "canonicalName": "AXIOM_TOKEN",
+        "envNames": [
+          "AXIOM_TOKEN",
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "writeNames": [
+          "AXIOM_TOKEN"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          }
+        ],
+        "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+      },
       {
         "secretId": "platform.mc.convex-deploy-key",
         "canonicalName": "CONVEX_MC_DEPLOY_KEY",
@@ -36078,6 +37975,121 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
       },
+      {
+        "secretId": "platform.axiom.api-url",
+        "canonicalName": "LUCERN_AXIOM_API_URL",
+        "envNames": [
+          "AXIOM_URL",
+          "LUCERN_AXIOM_API_URL"
+        ],
+        "aliases": [
+          "AXIOM_URL"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_API_URL"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          }
+        ],
+        "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+      },
+      {
+        "secretId": "platform.axiom.events-dataset",
+        "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+        "envNames": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET",
+          "LUCERN_AXIOM_EVENTS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_EVENTS_DATASET"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          }
+        ],
+        "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+      },
       {
         "secretId": "platform.convex-deploy.local-names",
         "canonicalName": "LUCERN_CONVEX_DEPLOYMENT_NAME",
@@ -36398,35 +38410,76 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
           "LUCERN_WORKTREE_ID"
         ],
         "writeNames": [
-          "LUCERN_TENANT_ID"
+          "LUCERN_TENANT_ID"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/runtime",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-mcp",
+          "tenant-agent-runtime"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_TENANT_ID"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_TENANT_ID"
+            ]
+          }
+        ],
+        "description": "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves."
+      },
+      {
+        "secretId": "platform.axiom.otlp-endpoint",
+        "canonicalName": "OTEL_EXPORTER_OTLP_ENDPOINT",
+        "envNames": [
+          "LUCERN_AXIOM_OTLP_ENDPOINT",
+          "OTEL_EXPORTER_OTLP_ENDPOINT"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_OTLP_ENDPOINT"
+        ],
+        "writeNames": [
+          "OTEL_EXPORTER_OTLP_ENDPOINT"
         ],
         "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/runtime",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-cli",
-          "lucern-mcp",
-          "tenant-agent-runtime"
+          "lucern-gateway",
+          "lucern-railway-pdp",
+          "lucern-observability"
         ],
         "destinations": [
           {
-            "kind": "runtime_fetch",
-            "target": "lucern-cli-mcp-sdk",
+            "kind": "vercel",
+            "target": "lucern-gateway",
             "writeNames": [
-              "LUCERN_TENANT_ID"
+              "OTEL_EXPORTER_OTLP_ENDPOINT"
             ]
           },
           {
             "kind": "operator_local",
             "target": "lucern-repo",
             "writeNames": [
-              "LUCERN_TENANT_ID"
+              "OTEL_EXPORTER_OTLP_ENDPOINT"
             ]
           }
         ],
-        "description": "SDK, CLI, and agent context selectors. These identify scope and must not grant access by themselves."
+        "description": "OTLP endpoint used by services that emit OpenTelemetry logs, metrics, and traces to Axiom."
       }
     ],
     "operator_local:mc-credential-maintenance": [
@@ -37235,227 +39288,549 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LANGFUSE_PUBLIC_KEY"
+              "LANGFUSE_PUBLIC_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+      },
+      {
+        "secretId": "platform.langfuse.secret-key",
+        "canonicalName": "LANGFUSE_SECRET_KEY",
+        "envNames": [
+          "LANGFUSE_SECRET_KEY"
+        ],
+        "aliases": [],
+        "writeNames": [
+          "LANGFUSE_SECRET_KEY"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/observability/langfuse",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-observability",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "LANGFUSE_SECRET_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LANGFUSE_SECRET_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+      },
+      {
+        "secretId": "platform.ai.openai-api-key",
+        "canonicalName": "OPENAI_API_KEY",
+        "envNames": [
+          "OPENAI_API_KEY"
+        ],
+        "aliases": [],
+        "writeNames": [
+          "OPENAI_API_KEY"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/ai",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "OPENAI_API_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "OPENAI_API_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation."
+      },
+      {
+        "secretId": "platform.pinecone.api-key",
+        "canonicalName": "PINECONE_API_KEY",
+        "envNames": [
+          "PINECONE_API_KEY"
+        ],
+        "aliases": [],
+        "writeNames": [
+          "PINECONE_API_KEY"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/vector/pinecone",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "PINECONE_API_KEY"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "PINECONE_API_KEY"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Pinecone API key for platform vector search."
+      },
+      {
+        "secretId": "platform.pinecone.host",
+        "canonicalName": "PINECONE_HOST",
+        "envNames": [
+          "PINECONE_HOST",
+          "PINECONE_INDEX_HOST"
+        ],
+        "aliases": [
+          "PINECONE_INDEX_HOST"
+        ],
+        "writeNames": [
+          "PINECONE_HOST"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/vector/pinecone",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "PINECONE_HOST"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "PINECONE_HOST"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Pinecone host/index host."
+      },
+      {
+        "secretId": "platform.pinecone.index-name",
+        "canonicalName": "PINECONE_INDEX_NAME",
+        "envNames": [
+          "PINECONE_INDEX",
+          "PINECONE_INDEX_NAME"
+        ],
+        "aliases": [
+          "PINECONE_INDEX"
+        ],
+        "writeNames": [
+          "PINECONE_INDEX_NAME"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/vector/pinecone",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-ai-runtime",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-ai-runtime",
+            "writeNames": [
+              "PINECONE_INDEX_NAME"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "PINECONE_INDEX_NAME"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Pinecone index name."
+      }
+    ],
+    "runtime_fetch:lucern-cli-mcp-sdk": [
+      {
+        "secretId": "platform.axiom.token",
+        "canonicalName": "AXIOM_TOKEN",
+        "envNames": [
+          "AXIOM_TOKEN",
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "writeNames": [
+          "AXIOM_TOKEN"
+        ],
+        "required": false,
+        "secret": true,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "AXIOM_TOKEN"
             ]
           }
         ],
-        "description": "Lucern-owned Langfuse public key paired with LANGFUSE_SECRET_KEY."
+        "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
       },
       {
-        "secretId": "platform.langfuse.secret-key",
-        "canonicalName": "LANGFUSE_SECRET_KEY",
+        "secretId": "platform.operator.api-key",
+        "canonicalName": "LUCERN_API_KEY",
         "envNames": [
-          "LANGFUSE_SECRET_KEY"
+          "LUCERN_API_KEY",
+          "LUCERN_KEY"
+        ],
+        "aliases": [
+          "LUCERN_KEY"
         ],
-        "aliases": [],
         "writeNames": [
-          "LANGFUSE_SECRET_KEY"
+          "LUCERN_API_KEY"
         ],
         "required": false,
         "secret": true,
         "public": false,
-        "sourcePath": "/platform/observability/langfuse",
+        "sourcePath": "/platform/runtime",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
-          "lucern-observability",
+          "lucern-cli",
+          "lucern-mcp",
           "lucern-repo-ci"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LANGFUSE_SECRET_KEY"
+              "LUCERN_API_KEY"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_API_KEY"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LANGFUSE_SECRET_KEY"
+              "LUCERN_API_KEY"
             ]
           }
         ],
-        "description": "Lucern-owned Langfuse secret key for prompt sync, prompt reads, and AI tracing."
+        "description": "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
       },
       {
-        "secretId": "platform.ai.openai-api-key",
-        "canonicalName": "OPENAI_API_KEY",
+        "secretId": "platform.runtime.api-base-url",
+        "canonicalName": "LUCERN_API_URL",
         "envNames": [
-          "OPENAI_API_KEY"
+          "LUCERN_API_BASE_URL",
+          "LUCERN_API_URL",
+          "LUCERN_BASE_URL"
+        ],
+        "aliases": [
+          "LUCERN_API_BASE_URL",
+          "LUCERN_BASE_URL"
         ],
-        "aliases": [],
         "writeNames": [
-          "OPENAI_API_KEY"
+          "LUCERN_API_URL"
         ],
-        "required": false,
-        "secret": true,
+        "required": true,
+        "secret": false,
         "public": false,
-        "sourcePath": "/platform/ai",
+        "sourcePath": "/platform/runtime",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
-          "lucern-repo-ci"
+          "lucern-web",
+          "lucern-gateway",
+          "lucern-mcp",
+          "lucern-cli"
         ],
         "destinations": [
           {
-            "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "kind": "vercel",
+            "target": "lucern",
             "writeNames": [
-              "OPENAI_API_KEY"
+              "LUCERN_API_URL"
             ]
           },
           {
-            "kind": "github_actions",
-            "target": "LucernAI/lucern",
+            "kind": "vercel",
+            "target": "lucern-gateway",
             "writeNames": [
-              "OPENAI_API_KEY"
+              "LUCERN_API_URL"
+            ]
+          },
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_API_URL"
             ]
           }
         ],
-        "description": "Lucern-owned OpenAI key for platform AI jobs, benchmarks, and controlled operator automation."
+        "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
       },
       {
-        "secretId": "platform.pinecone.api-key",
-        "canonicalName": "PINECONE_API_KEY",
+        "secretId": "platform.axiom.api-url",
+        "canonicalName": "LUCERN_AXIOM_API_URL",
         "envNames": [
-          "PINECONE_API_KEY"
+          "AXIOM_URL",
+          "LUCERN_AXIOM_API_URL"
+        ],
+        "aliases": [
+          "AXIOM_URL"
         ],
-        "aliases": [],
         "writeNames": [
-          "PINECONE_API_KEY"
+          "LUCERN_AXIOM_API_URL"
         ],
         "required": false,
-        "secret": true,
+        "secret": false,
         "public": false,
-        "sourcePath": "/platform/vector/pinecone",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
           "lucern-repo-ci"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "PINECONE_API_KEY"
+              "LUCERN_AXIOM_API_URL"
             ]
           },
           {
-            "kind": "github_actions",
-            "target": "LucernAI/lucern",
+            "kind": "vercel",
+            "target": "lucern-gateway",
             "writeNames": [
-              "PINECONE_API_KEY"
+              "LUCERN_AXIOM_API_URL"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
             ]
           }
         ],
-        "description": "Lucern-owned Pinecone API key for platform vector search."
+        "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
       },
       {
-        "secretId": "platform.pinecone.host",
-        "canonicalName": "PINECONE_HOST",
+        "secretId": "platform.axiom.events-dataset",
+        "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
         "envNames": [
-          "PINECONE_HOST",
-          "PINECONE_INDEX_HOST"
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET",
+          "LUCERN_AXIOM_EVENTS_DATASET"
         ],
         "aliases": [
-          "PINECONE_INDEX_HOST"
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET"
         ],
         "writeNames": [
-          "PINECONE_HOST"
+          "LUCERN_AXIOM_EVENTS_DATASET"
         ],
         "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/vector/pinecone",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
-          "lucern-repo-ci"
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "PINECONE_HOST"
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "PINECONE_HOST"
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned Pinecone host/index host."
+        "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
       },
       {
-        "secretId": "platform.pinecone.index-name",
-        "canonicalName": "PINECONE_INDEX_NAME",
+        "secretId": "platform.axiom.logs-dataset",
+        "canonicalName": "LUCERN_AXIOM_LOGS_DATASET",
         "envNames": [
-          "PINECONE_INDEX",
-          "PINECONE_INDEX_NAME"
+          "AXIOM_LOGS_DATASET",
+          "LUCERN_AXIOM_LOGS_DATASET"
         ],
         "aliases": [
-          "PINECONE_INDEX"
+          "AXIOM_LOGS_DATASET"
         ],
         "writeNames": [
-          "PINECONE_INDEX_NAME"
+          "LUCERN_AXIOM_LOGS_DATASET"
         ],
         "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/vector/pinecone",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-ai-runtime",
+          "lucern-observability",
+          "lucern-gateway",
           "lucern-repo-ci"
         ],
         "destinations": [
           {
             "kind": "runtime_fetch",
-            "target": "lucern-ai-runtime",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "PINECONE_INDEX_NAME"
+              "LUCERN_AXIOM_LOGS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_LOGS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "PINECONE_INDEX_NAME"
+              "LUCERN_AXIOM_LOGS_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned Pinecone index name."
-      }
-    ],
-    "runtime_fetch:lucern-cli-mcp-sdk": [
+        "description": "Axiom OpenTelemetry log dataset for Lucern services."
+      },
       {
-        "secretId": "platform.operator.api-key",
-        "canonicalName": "LUCERN_API_KEY",
+        "secretId": "platform.axiom.metrics-dataset",
+        "canonicalName": "LUCERN_AXIOM_METRICS_DATASET",
         "envNames": [
-          "LUCERN_API_KEY",
-          "LUCERN_KEY"
+          "AXIOM_METRICS_DATASET",
+          "LUCERN_AXIOM_METRICS_DATASET"
         ],
         "aliases": [
-          "LUCERN_KEY"
+          "AXIOM_METRICS_DATASET"
         ],
         "writeNames": [
-          "LUCERN_API_KEY"
+          "LUCERN_AXIOM_METRICS_DATASET"
         ],
         "required": false,
-        "secret": true,
+        "secret": false,
         "public": false,
-        "sourcePath": "/platform/runtime",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-cli",
-          "lucern-mcp",
+          "lucern-observability",
+          "lucern-gateway",
           "lucern-repo-ci"
         ],
         "destinations": [
@@ -37463,76 +39838,73 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
             "kind": "runtime_fetch",
             "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_METRICS_DATASET"
             ]
           },
           {
-            "kind": "operator_local",
-            "target": "lucern-repo",
+            "kind": "vercel",
+            "target": "lucern-gateway",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_METRICS_DATASET"
             ]
           },
           {
             "kind": "github_actions",
             "target": "LucernAI/lucern",
             "writeNames": [
-              "LUCERN_API_KEY"
+              "LUCERN_AXIOM_METRICS_DATASET"
             ]
           }
         ],
-        "description": "Lucern-owned operator API key for trusted CLI/MCP/CI calls. Source it from /platform/runtime; do not persist it into local user credential files."
+        "description": "Axiom OpenTelemetry metric dataset for Lucern services."
       },
       {
-        "secretId": "platform.runtime.api-base-url",
-        "canonicalName": "LUCERN_API_URL",
+        "secretId": "platform.axiom.traces-dataset",
+        "canonicalName": "LUCERN_AXIOM_TRACES_DATASET",
         "envNames": [
-          "LUCERN_API_BASE_URL",
-          "LUCERN_API_URL",
-          "LUCERN_BASE_URL"
+          "AXIOM_TRACES_DATASET",
+          "LUCERN_AXIOM_TRACES_DATASET"
         ],
         "aliases": [
-          "LUCERN_API_BASE_URL",
-          "LUCERN_BASE_URL"
+          "AXIOM_TRACES_DATASET"
         ],
         "writeNames": [
-          "LUCERN_API_URL"
+          "LUCERN_AXIOM_TRACES_DATASET"
         ],
-        "required": true,
+        "required": false,
         "secret": false,
         "public": false,
-        "sourcePath": "/platform/runtime",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-web",
+          "lucern-observability",
           "lucern-gateway",
-          "lucern-mcp",
-          "lucern-cli"
+          "lucern-repo-ci"
         ],
         "destinations": [
           {
-            "kind": "vercel",
-            "target": "lucern",
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "LUCERN_API_URL"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           },
           {
             "kind": "vercel",
             "target": "lucern-gateway",
             "writeNames": [
-              "LUCERN_API_URL"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           },
           {
-            "kind": "runtime_fetch",
-            "target": "lucern-cli-mcp-sdk",
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
             "writeNames": [
-              "LUCERN_API_URL"
+              "LUCERN_AXIOM_TRACES_DATASET"
             ]
           }
         ],
-        "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
+        "description": "Axiom OpenTelemetry trace dataset for Lucern services."
       },
       {
         "secretId": "platform.runtime.environment",
@@ -40361,47 +42733,111 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         "secretId": "platform.sentry.release",
         "canonicalName": "SENTRY_RELEASE",
         "envNames": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE",
           "SENTRY_RELEASE"
         ],
         "aliases": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE"
         ],
         "writeNames": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE",
           "SENTRY_RELEASE"
         ],
         "required": false,
-        "secret": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability/sentry",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-web",
+          "lucern-gateway",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "vercel",
+            "target": "lucern",
+            "writeNames": [
+              "LUCERN_RELEASE",
+              "SENTRY_RELEASE",
+              "NEXT_PUBLIC_SENTRY_RELEASE"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "SENTRY_RELEASE"
+            ]
+          }
+        ],
+        "description": "Lucern-owned Sentry release name."
+      }
+    ],
+    "vercel:lucern-gateway": [
+      {
+        "secretId": "platform.axiom.token",
+        "canonicalName": "AXIOM_TOKEN",
+        "envNames": [
+          "AXIOM_TOKEN",
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_TOKEN"
+        ],
+        "writeNames": [
+          "AXIOM_TOKEN"
+        ],
+        "required": false,
+        "secret": true,
         "public": false,
-        "sourcePath": "/platform/observability/sentry",
+        "sourcePath": "/platform/observability",
         "environmentPolicy": "environment_specific",
         "consumers": [
-          "lucern-web",
+          "lucern-cli",
           "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
           "lucern-observability"
         ],
         "destinations": [
           {
-            "kind": "vercel",
-            "target": "lucern",
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
             "writeNames": [
-              "SENTRY_RELEASE",
-              "NEXT_PUBLIC_SENTRY_RELEASE"
+              "AXIOM_TOKEN"
             ]
           },
           {
             "kind": "vercel",
             "target": "lucern-gateway",
             "writeNames": [
-              "SENTRY_RELEASE"
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "AXIOM_TOKEN"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "AXIOM_TOKEN"
             ]
           }
         ],
-        "description": "Lucern-owned Sentry release name."
-      }
-    ],
-    "vercel:lucern-gateway": [
+        "description": "Axiom ingest/query token for Lucern operational telemetry. Runtime code must treat it as write/query telemetry authority, not graph-state authority."
+      },
       {
         "secretId": "platform.clerk.jwks",
         "canonicalName": "CLERK_JWKS_URL",
@@ -40688,6 +43124,265 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Canonical Lucern API gateway base URL. Older names remain aliases only."
       },
+      {
+        "secretId": "platform.axiom.api-url",
+        "canonicalName": "LUCERN_AXIOM_API_URL",
+        "envNames": [
+          "AXIOM_URL",
+          "LUCERN_AXIOM_API_URL"
+        ],
+        "aliases": [
+          "AXIOM_URL"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_API_URL"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_API_URL"
+            ]
+          }
+        ],
+        "description": "Axiom API URL. Defaults to https://api.axiom.co when unset."
+      },
+      {
+        "secretId": "platform.axiom.events-dataset",
+        "canonicalName": "LUCERN_AXIOM_EVENTS_DATASET",
+        "envNames": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET",
+          "LUCERN_AXIOM_EVENTS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_DATASET",
+          "AXIOM_EVENTS_DATASET",
+          "LUCERN_AXIOM_DATASET"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_EVENTS_DATASET"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-cli",
+          "lucern-gateway",
+          "lucern-sdk",
+          "lucern-mcp",
+          "lucern-agent",
+          "lucern-railway-pdp",
+          "lucern-repo-ci",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "LUCERN_AXIOM_EVENTS_DATASET"
+            ]
+          }
+        ],
+        "description": "Primary Axiom event dataset for non-sensitive CLI, gateway, SDK retry, PDP, deploy, and agent-run telemetry."
+      },
+      {
+        "secretId": "platform.axiom.logs-dataset",
+        "canonicalName": "LUCERN_AXIOM_LOGS_DATASET",
+        "envNames": [
+          "AXIOM_LOGS_DATASET",
+          "LUCERN_AXIOM_LOGS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_LOGS_DATASET"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_LOGS_DATASET"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-observability",
+          "lucern-gateway",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_LOGS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_LOGS_DATASET"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_AXIOM_LOGS_DATASET"
+            ]
+          }
+        ],
+        "description": "Axiom OpenTelemetry log dataset for Lucern services."
+      },
+      {
+        "secretId": "platform.axiom.metrics-dataset",
+        "canonicalName": "LUCERN_AXIOM_METRICS_DATASET",
+        "envNames": [
+          "AXIOM_METRICS_DATASET",
+          "LUCERN_AXIOM_METRICS_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_METRICS_DATASET"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_METRICS_DATASET"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-observability",
+          "lucern-gateway",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_METRICS_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_METRICS_DATASET"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_AXIOM_METRICS_DATASET"
+            ]
+          }
+        ],
+        "description": "Axiom OpenTelemetry metric dataset for Lucern services."
+      },
+      {
+        "secretId": "platform.axiom.traces-dataset",
+        "canonicalName": "LUCERN_AXIOM_TRACES_DATASET",
+        "envNames": [
+          "AXIOM_TRACES_DATASET",
+          "LUCERN_AXIOM_TRACES_DATASET"
+        ],
+        "aliases": [
+          "AXIOM_TRACES_DATASET"
+        ],
+        "writeNames": [
+          "LUCERN_AXIOM_TRACES_DATASET"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-observability",
+          "lucern-gateway",
+          "lucern-repo-ci"
+        ],
+        "destinations": [
+          {
+            "kind": "runtime_fetch",
+            "target": "lucern-cli-mcp-sdk",
+            "writeNames": [
+              "LUCERN_AXIOM_TRACES_DATASET"
+            ]
+          },
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "LUCERN_AXIOM_TRACES_DATASET"
+            ]
+          },
+          {
+            "kind": "github_actions",
+            "target": "LucernAI/lucern",
+            "writeNames": [
+              "LUCERN_AXIOM_TRACES_DATASET"
+            ]
+          }
+        ],
+        "description": "Axiom OpenTelemetry trace dataset for Lucern services."
+      },
       {
         "secretId": "platform.clerk.webhook-secret",
         "canonicalName": "LUCERN_CLERK_WEBHOOK_SECRET",
@@ -41247,6 +43942,47 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         ],
         "description": "Lucern-owned Sentry DSN for browser/server error telemetry."
       },
+      {
+        "secretId": "platform.axiom.otlp-endpoint",
+        "canonicalName": "OTEL_EXPORTER_OTLP_ENDPOINT",
+        "envNames": [
+          "LUCERN_AXIOM_OTLP_ENDPOINT",
+          "OTEL_EXPORTER_OTLP_ENDPOINT"
+        ],
+        "aliases": [
+          "LUCERN_AXIOM_OTLP_ENDPOINT"
+        ],
+        "writeNames": [
+          "OTEL_EXPORTER_OTLP_ENDPOINT"
+        ],
+        "required": false,
+        "secret": false,
+        "public": false,
+        "sourcePath": "/platform/observability",
+        "environmentPolicy": "environment_specific",
+        "consumers": [
+          "lucern-gateway",
+          "lucern-railway-pdp",
+          "lucern-observability"
+        ],
+        "destinations": [
+          {
+            "kind": "vercel",
+            "target": "lucern-gateway",
+            "writeNames": [
+              "OTEL_EXPORTER_OTLP_ENDPOINT"
+            ]
+          },
+          {
+            "kind": "operator_local",
+            "target": "lucern-repo",
+            "writeNames": [
+              "OTEL_EXPORTER_OTLP_ENDPOINT"
+            ]
+          }
+        ],
+        "description": "OTLP endpoint used by services that emit OpenTelemetry logs, metrics, and traces to Axiom."
+      },
       {
         "secretId": "platform.sentry.environment",
         "canonicalName": "SENTRY_ENVIRONMENT",
@@ -41294,13 +44030,16 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
         "secretId": "platform.sentry.release",
         "canonicalName": "SENTRY_RELEASE",
         "envNames": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE",
           "SENTRY_RELEASE"
         ],
         "aliases": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE"
         ],
         "writeNames": [
+          "LUCERN_RELEASE",
           "NEXT_PUBLIC_SENTRY_RELEASE",
           "SENTRY_RELEASE"
         ],
@@ -41319,6 +44058,7 @@ var GENERATED_INFISICAL_RUNTIME_ENV = {
             "kind": "vercel",
             "target": "lucern",
             "writeNames": [
+              "LUCERN_RELEASE",
               "SENTRY_RELEASE",
               "NEXT_PUBLIC_SENTRY_RELEASE"
             ]