fix(e2e): guard unmapped spec folders and share the binary cache key

#### Description

- Move `/api/v2/rule_views` routes from role gates to `CheckResources`
on `rule:list`, dashboard views parity.
- Migration 143 backfills rule tuples for managed roles, the first PR in
the stack to check a rule scope.
- Integration tests cover a viewer on all four routes and a custom role
without `rule:list`.

#### Issues closed by this PR

Part of SigNoz/pulse-pod#286
Part of SigNoz/pulse-pod#355

#### Additional Information

Third of five stacked PRs splitting #12927. Stacked on #13250.

.github/workflows/cacheci.yml

@@ -46,8 +46,34 @@ jobs:
           docker build -f "$RUNNER_TEMP/inject.Dockerfile" "$RUNNER_TEMP/cacheci"
       - name: build
         run: |
-          docker build -f cmd/enterprise/Dockerfile.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
+          docker build -f cmd/enterprise/Dockerfile.integration --tag signoz:integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
           docker build -f cmd/enterprise/Dockerfile.with-web.integration --build-arg TARGETARCH=amd64 --build-arg ZEUSURL=http://zeus:8080 .
+      # e2eci runs this server binary for changes that leave the server as it
+      # is here, and builds only the web.
+      - name: e2e-signoz-key
+        id: e2e-signoz-key
+        run: |
+          echo "key=$(tests/e2e/scripts/signoz-key.sh)" >> "$GITHUB_OUTPUT"
+      - name: e2e-signoz
+        run: |
+          mkdir -p "$RUNNER_TEMP/e2e-signoz"
+          id=$(docker create signoz:integration)
+          docker cp "$id":/root/signoz "$RUNNER_TEMP/e2e-signoz/signoz"
+          docker rm "$id"
+      - name: save-e2e-signoz
+        uses: actions/cache/save@v4
+        with:
+          path: ${{ runner.temp }}/e2e-signoz
+          key: ${{ steps.e2e-signoz-key.outputs.key }}
+      # Older keys only match commits main has moved past.
+      - name: prune-e2e-signoz
+        env:
+          GH_TOKEN: ${{ github.token }}
+          KEY: ${{ steps.e2e-signoz-key.outputs.key }}
+        run: |
+          gh cache list --repo "$GITHUB_REPOSITORY" --key e2e-signoz- --json key --jq '.[].key' \
+            | grep -vxF "$KEY" \
+            | xargs -r -n 1 gh cache delete --repo "$GITHUB_REPOSITORY"
       # docker cp instead of --output type=local (the local exporter stalls on
       # multi-GB outputs); tarballs instead of raw trees so the host never hits
       # the permission and symlink semantics that broke docker cp.

.github/workflows/e2eci.yaml

@@ -12,6 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       e2e: ${{ steps.changes.outputs.e2e }}
+      shards: ${{ steps.plan.outputs.shards }}
     steps:
       - name: changes
         id: changes
@@ -21,6 +22,7 @@ jobs:
           FORCE: ${{ contains(github.event.pull_request.labels.*.name, 'safe-to-e2e') }}
         run: |
           CHANGED_FILES=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename | select(startswith("tests/integration/") | not)')
+          printf '%s\n' "$CHANGED_FILES" > "$RUNNER_TEMP/changed.txt"
           PATTERN='^(frontend/|tests/|\.github/workflows/e2eci\.yaml$|cmd/enterprise/Dockerfile\.with-web\.integration$)'
 
           if [ "$FORCE" = "true" ]; then
@@ -30,6 +32,42 @@ jobs:
           else
             echo "e2e=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: checkout
+        if: steps.changes.outputs.e2e == 'true'
+        uses: actions/checkout@v4
+      - name: install-pnpm
+        if: steps.changes.outputs.e2e == 'true'
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10
+      - name: node
+        if: steps.changes.outputs.e2e == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: pnpm-install
+        if: steps.changes.outputs.e2e == 'true'
+        run: |
+          cd tests/e2e && pnpm install --frozen-lockfile
+      - name: plan
+        id: plan
+        if: steps.changes.outputs.e2e == 'true'
+        env:
+          FORCE: ${{ contains(github.event.pull_request.labels.*.name, 'safe-to-e2e') }}
+        run: |
+          cd tests/e2e
+          if [ "$FORCE" = "true" ]; then
+            node scripts/plan.mjs --all < /dev/null
+          else
+            node scripts/plan.mjs < "$RUNNER_TEMP/changed.txt"
+          fi
+      - name: upload-plan
+        if: steps.changes.outputs.e2e == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-plan
+          path: tests/e2e/artifacts/plan/
+          retention-days: 5
   fmtlint:
     needs: changes
     if: needs.changes.outputs.e2e == 'true'
@@ -40,7 +78,7 @@ jobs:
       - name: node
         uses: actions/setup-node@v4
         with:
-          node-version: lts/*
+          node-version: 22
       - name: install-pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -60,9 +98,9 @@ jobs:
       matrix:
         project:
           - chromium
-        shard: [1, 2, 3, 4]
+        shard: ${{ fromJSON(needs.changes.outputs.shards) }}
     needs: changes
-    if: needs.changes.outputs.e2e == 'true'
+    if: needs.changes.outputs.e2e == 'true' && needs.changes.outputs.shards != '[]'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -95,10 +133,11 @@ jobs:
         background: true
         run: |
           cd tests && uv sync
+      # The frontend builds on Node 22, as in jsci and the with-web image.
       - name: node
         uses: actions/setup-node@v4
         with:
-          node-version: lts/*
+          node-version: 22
       - name: install-pnpm
         uses: pnpm/action-setup@v6
         with:
@@ -106,10 +145,44 @@ jobs:
       - name: pnpm-install
         run: |
           cd tests/e2e && pnpm install --frozen-lockfile
+      - name: signoz-key
+        id: signoz-key
+        run: |
+          echo "key=$(tests/e2e/scripts/signoz-key.sh)" >> "$GITHUB_OUTPUT"
+      # A hit means the change leaves the server as it is on main, so only the
+      # web build is new.
+      - name: signoz-binary
+        id: signoz-binary
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ runner.temp }}/e2e-signoz
+          key: ${{ steps.signoz-key.outputs.key }}
+      - name: signoz-image
+        id: signoz-image
+        if: steps.signoz-binary.outputs.cache-hit == 'true'
+        background: true
+        env:
+          NODE_OPTIONS: --max-old-space-size=8192
+        run: |
+          cd frontend && pnpm install --frozen-lockfile && pnpm build
+          cp -r build "$RUNNER_TEMP/e2e-signoz/web"
+          cp -r ../templates "$RUNNER_TEMP/e2e-signoz/templates"
+          cat > "$RUNNER_TEMP/e2e-signoz/Dockerfile" <<'EOF'
+          FROM golang:1.25-bookworm
+          ENV HOME=/root
+          WORKDIR /root
+          COPY signoz /root/signoz
+          COPY templates /root/templates
+          COPY web /root/web
+          RUN chmod 755 /root /root/signoz
+          ENTRYPOINT ["/root/signoz", "server"]
+          EOF
+          docker build --tag signoz:integration "$RUNNER_TEMP/e2e-signoz"
       # Restore-only: the cacheci workflow owns cache saves. Seeds the
       # BuildKit cache mounts so the in-test image build is incremental.
       - name: restore
         id: restore
+        if: steps.signoz-binary.outputs.cache-hit != 'true'
         uses: actions/cache/restore@v4
         with:
           path: ${{ runner.temp }}/cacheci
@@ -117,7 +190,7 @@ jobs:
           restore-keys: |
             tests-secondary
       - name: inject
-        if: steps.restore.outputs.cache-matched-key != ''
+        if: steps.signoz-binary.outputs.cache-hit != 'true' && steps.restore.outputs.cache-matched-key != ''
         run: |
           cat > "$RUNNER_TEMP/inject.Dockerfile" <<'EOF'
           FROM busybox:1.37
@@ -143,19 +216,30 @@ jobs:
           docker rm pw
           echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ms-playwright" >> "$GITHUB_ENV"
           cd tests/e2e && pnpm playwright install-deps ${{ matrix.project }}
+      # ponytail: bring-up waits for the whole image. Starting the databases
+      # first would overlap them with the web build, about 1 min more.
+      - name: wait-signoz-image
+        if: steps.signoz-binary.outputs.cache-hit == 'true'
+        wait: signoz-image
       - name: bring-up-stack
         run: |
           cd tests && \
             uv run pytest \
             --basetemp=./tmp/ \
             -vv --reuse --with-web \
+            ${{ steps.signoz-binary.outputs.cache-hit == 'true' && '--prebuilt-signoz' || '' }} \
             e2e/bootstrap/setup.py::test_setup
       - name: wait-playwright-browsers
         wait: playwright-browsers
+      - name: download-plan
+        uses: actions/download-artifact@v4
+        with:
+          name: e2e-plan
+          path: tests/e2e/artifacts/plan
       - name: playwright-test
         run: |
           cd tests/e2e && \
-            pnpm playwright test --project=${{ matrix.project }} --shard=${{ matrix.shard }}/4
+            pnpm playwright test --project=${{ matrix.project }} --test-list artifacts/plan/shard-${{ matrix.shard }}.txt
       - name: teardown-stack
         if: always()
         run: |

.github/workflows/integrationci.yaml

@@ -106,8 +106,8 @@ jobs:
       - name: webdriver
         if: matrix.suite == 'callbackauthn' || matrix.suite == 'basepath'
         run: |
-          wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo apt-key add -
-          echo "deb http://dl.google.com/linux/chrome/deb/ stable main" | sudo tee -a /etc/apt/sources.list.d/google-chrome.list
+          wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | sudo gpg --batch --yes --dearmor -o /usr/share/keyrings/google-chrome.gpg
+          echo "deb [signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" | sudo tee -a /etc/apt/sources.list.d/google-chrome.list
           sudo apt-get update -qqy
           sudo apt-get -qqy install google-chrome-stable
           CHROME_VERSION=$(google-chrome-stable --version)

.mockery.yml

@@ -16,6 +16,14 @@ packages:
       filename: "maintenance.go"
       structname: 'Mock{{.InterfaceName}}'
       pkgname: '{{.SrcPackageName}}test'
+  github.com/SigNoz/signoz/pkg/types/telemetrytypes:
+    interfaces:
+      SchemaMetadataStore:
+    config:
+      dir: '{{.InterfaceDir}}/telemetrytypestest'
+      filename: "schema_metadata_store.go"
+      structname: 'Mock{{.InterfaceName}}'
+      pkgname: '{{.SrcPackageName}}test'
   github.com/SigNoz/signoz/pkg/tokenizer:
     config:
       all: true

conf/example.yaml

@@ -178,6 +178,9 @@ querier:
   # range with padding to include slightly delayed log exports. Logs only; set
   # to 0 to disable.
   log_trace_id_window_padding: 5m
+  schemametadatastore:
+    # How long found schema metadata stays cached; 0 caches it for the life of the process.
+    cache_ttl: 0s
 
 ##################### TelemetryStore #####################
 telemetrystore:

docs/api/openapi.yml

@@ -25153,9 +25153,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: List rule saved views
       tags:
       - rules
@@ -25211,9 +25211,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Create rule saved view
       tags:
       - rules
@@ -25265,9 +25265,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Delete rule saved view
       tags:
       - rules
@@ -25334,9 +25334,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Update rule saved view
       tags:
       - rules

docs/contributing/tests/e2e.md

@@ -319,6 +319,24 @@ cp .env.example .env      # fill SIGNOZ_E2E_USERNAME / PASSWORD
 yarn test:staging
 ```
 
+### Which specs run on a PR
+
+`e2eci` runs the specs a change can reach plus the `@smoke` set, on as many shards as their recorded durations need.
+
+- A frontend change is traced up the import graph to the routes it reaches. `affected.json` maps each route's page to the spec folders that visit it. Pages under the `@smoke` key are covered by the smoke set alone.
+- A changed spec runs itself. A changed driver, helper or fixture runs every spec that imports it.
+- The full suite runs when a change reaches the app shell, sits outside the module graph (a lockfile, `package.json`, a public asset), touches the server or CI, or reaches a page `affected.json` doesn't name. It also runs while any spec folder outside `routing/` has no entry in `affected.json`.
+- `scripts/plan.mjs` packs the selected spec files into shards using the per-test durations in `durations.json`.
+
+When you add a spec folder, add it to `affected.json` with the pages its specs visit. Tag a describe with `{ tag: '@smoke' }` only for a core path every PR should check.
+
+```bash
+pnpm plan                 # what your branch would run, against origin/main
+pnpm test:smoke           # the smoke set
+pnpm durations            # refresh durations.json from the last 10 green e2eci runs
+pnpm test:scripts         # check the spec selection
+```
+
 ## How to configure different options for E2E tests?
 
 ### Environment variables
@@ -357,6 +375,7 @@ The same pytest flags integration tests expose work here, since E2E reuses the s
 - `--teardown` — tear everything down.
 - `--clean` — prune the docker build caches, forcing the next image build to start cold.
 - `--with-web` — build the frontend into the SigNoz container. **Required for E2E**; integration tests don't need it.
+- `--prebuilt-signoz` — run the `signoz:integration` image already in the local image store instead of building it. The image must be built with `ZEUSURL=http://zeus:8080`. CI uses it when main's server binary matches the change.
 - `--sqlstore-provider`, `--postgres-version`, `--clickhouse-version`, etc. — see `docs/contributing/tests/integration.md`.
 
 ## What should I remember?

frontend/public/locales/en-GB/channels.json

@@ -103,7 +103,7 @@
   "placeholder_slack_description": "Description",
   "placeholder_pager_description": "Description",
   "help_pager_client": "Shows up as event source in Pagerduty",
-  "help_pager_client_url": "Shows up as event source link in Pagerduty",
+  "help_pager_client_url": "Shows up as event source link in Pagerduty. Leave empty to link to this SigNoz instance",
   "help_pager_class": "The class/type of the event",
   "help_pager_details": "Specify a key-value format (must be a valid json)",
   "help_pager_group": "A cluster or grouping of sources",

frontend/public/locales/en/channels.json

@@ -169,7 +169,7 @@
   "placeholder_opsgenie_message": "Message",
   "placeholder_opsgenie_priority": "Priority",
   "help_pager_client": "Shows up as event source in Pagerduty",
-  "help_pager_client_url": "Shows up as event source link in Pagerduty",
+  "help_pager_client_url": "Shows up as event source link in Pagerduty. Leave empty to link to this SigNoz instance",
   "help_pager_class": "The class/type of the event",
   "help_pager_details": "Specify a key-value format (must be a valid json)",
   "help_pager_group": "A cluster or grouping of sources",

frontend/src/container/CreateAlertChannels/defaults.ts

@@ -85,7 +85,6 @@ export const PagerInitialConfig: Partial<AlertmanagertypesChannelPagerdutyConfig
 	{{- end }}`,
 		severity: '{{ (index .Alerts 0).Labels.severity }}',
 		client: 'SigNoz Alert Manager',
-		clientUrl: 'https://enter-signoz-host-n-port-here/alerts',
 		details: {
 			firing: `{{ .Alerts.Firing | toJson }}`,
 			resolved: `{{ .Alerts.Resolved | toJson }}`,

frontend/src/pages/AlertList/NotificationChannels/__tests__/ChannelFormSave.test.tsx

@@ -486,4 +486,66 @@ describe('ChannelForm save', () => {
 		},
 		TEST_TIMEOUT,
 	);
+
+	it(
+		"drops the previous type's templates when switching type",
+		async () => {
+			let body: Record<string, unknown> | undefined;
+			server.use(
+				rest.post(
+					'http://localhost/api/v2/notification_channels',
+					async (req, res, ctx) => {
+						body = await req.json();
+						return res(ctx.status(201), ctx.json({ status: 'success', data: {} }));
+					},
+				),
+			);
+
+			render(<ChannelForm onDone={jest.fn()} />);
+
+			const user = userEvent.setup({ delay: null, pointerEventsCheck: 0 });
+			await user.click(await screen.findByTestId('channel-type-select', {}, FIND));
+			await user.click(await screen.findByRole('option', { name: /^Telegram$/ }));
+
+			expect(screen.getByTestId('telegram-title-textarea')).toHaveValue('');
+
+			await user.type(
+				screen.getByTestId('channel-name-textbox'),
+				'telegram alerts',
+			);
+			await user.type(screen.getByTestId('telegram-bot-token-textbox'), '123:abc');
+			await user.type(screen.getByTestId('telegram-chat-id-textbox'), '-100123');
+
+			const save = screen.getByTestId('save-channel-button');
+			await waitFor(
+				() => expect(save).toHaveAttribute('aria-disabled', 'false'),
+				FIND,
+			);
+			await user.click(save);
+
+			await waitFor(() => expect(body).toBeDefined(), FIND);
+			expect(
+				(body as { config: { spec: Record<string, unknown> } }).config.spec,
+			).toStrictEqual({
+				botToken: '123:abc',
+				chatId: -100123,
+				sendResolved: true,
+			});
+		},
+		TEST_TIMEOUT,
+	);
+
+	it(
+		'leaves the pagerduty client url empty so the backend links to this instance',
+		async () => {
+			render(<ChannelForm onDone={jest.fn()} />);
+
+			const user = userEvent.setup({ delay: null, pointerEventsCheck: 0 });
+			await user.click(await screen.findByTestId('channel-type-select', {}, FIND));
+			await user.click(await screen.findByRole('option', { name: /^Pagerduty$/ }));
+
+			expect(screen.getByTestId('pager-client-url-textarea')).toHaveValue('');
+		},
+		TEST_TIMEOUT,
+	);
 });

frontend/src/pages/AlertList/NotificationChannels/components/ChannelForm/useChannelFormState.ts

@@ -86,9 +86,25 @@ export function useChannelFormState({
 
 			setTypeState(nextType);
 
+			const nextDefaults = ChannelInitialConfig[nextType];
+
+			// the previous type's templates would otherwise be sent as the new
+			// type's values; sendResolved is a general setting and is kept.
+			// '' not undefined: a field mounting on undefined falls back to the
+			// draft's defaults, and blanks are dropped on save anyway
+			Object.keys(ChannelInitialConfig[type])
+				.filter((field) => field !== 'sendResolved' && !(field in nextDefaults))
+				.forEach((field) => {
+					form.setValue(
+						field as keyof ChannelFormValues,
+						'' as ChannelFormValues[keyof ChannelFormValues],
+						{ shouldDirty: true },
+					);
+				});
+
 			// shouldDirty, because the type lives outside the form: without it
 			// picking a different type leaves the form pristine and unsavable.
-			Object.entries(ChannelInitialConfig[nextType]).forEach(([field, value]) => {
+			Object.entries(nextDefaults).forEach(([field, value]) => {
 				form.setValue(
 					field as keyof ChannelFormValues,
 					value as ChannelFormValues[keyof ChannelFormValues],

frontend/src/pages/DashboardPage/DashboardContainer/PanelEditor/ConfigPane/controls/drawings/tileDrawings.tsx

@@ -164,12 +164,12 @@ export const TILE_DRAWINGS = {
 			<path d="M4 20 C 20 20, 22 12, 32 12 S 44 4, 60 4" />
 		</TileSvg>
 	),
-	barsSideBySide: (
+	barsOverlap: (
 		<TileSvg>
-			<rect x={10} y={10} width={7} height={12} {...FILLED} opacity={0.5} />
-			<rect x={18} y={4} width={7} height={18} {...FILLED} />
-			<rect x={36} y={12} width={7} height={10} {...FILLED} opacity={0.5} />
-			<rect x={44} y={7} width={7} height={15} {...FILLED} />
+			<rect x={14} y={6} width={11} height={16} {...FILLED} opacity={0.5} />
+			<rect x={14} y={12} width={11} height={10} {...FILLED} />
+			<rect x={38} y={10} width={11} height={12} {...FILLED} opacity={0.5} />
+			<rect x={38} y={14} width={11} height={8} {...FILLED} />
 		</TileSvg>
 	),
 	barsStacked: (

frontend/src/pages/DashboardPage/DashboardContainer/PanelEditor/ConfigPane/sections/VisualizationSection/VisualizationSection.tsx

@@ -56,7 +56,7 @@ function VisualizationSection({
 		value?.timePreference ?? DashboardtypesTimePreferenceDTO.global_time;
 	const barLayout = value?.stackedBarChart
 		? BarLayout.STACKED
-		: BarLayout.SIDE_BY_SIDE;
+		: BarLayout.OVERLAP;
 	const stack = value?.stack ?? defaultValue?.stack;
 
 	return (

frontend/src/pages/DashboardPage/DashboardContainer/PanelEditor/ConfigPane/sections/VisualizationSection/options.ts

@@ -4,15 +4,15 @@ import type { ConfigTileItem } from '../../controls/ConfigTiles/ConfigTiles';
 import { TILE_DRAWINGS } from '../../controls/drawings/tileDrawings';
 
 export enum BarLayout {
-	SIDE_BY_SIDE = 'side',
+	OVERLAP = 'overlap',
 	STACKED = 'stacked',
 }
 
 export const BAR_LAYOUT_OPTIONS: ConfigTileItem<BarLayout>[] = [
 	{
-		value: BarLayout.SIDE_BY_SIDE,
-		label: 'Side by side',
-		drawing: TILE_DRAWINGS.barsSideBySide,
+		value: BarLayout.OVERLAP,
+		label: 'Overlap',
+		drawing: TILE_DRAWINGS.barsOverlap,
 	},
 	{
 		value: BarLayout.STACKED,
@@ -22,8 +22,7 @@ export const BAR_LAYOUT_OPTIONS: ConfigTileItem<BarLayout>[] = [
 ];
 
 export const BAR_LAYOUT_HELP: Record<BarLayout, string> = {
-	[BarLayout.SIDE_BY_SIDE]:
-		'Each series gets its own bar, side by side, for easy comparison.',
+	[BarLayout.OVERLAP]: 'Each series is drawn from zero and may hide others.',
 	[BarLayout.STACKED]:
 		'Bars sit on top of each other, so the height shows the total.',
 };

pkg/apiserver/signozapiserver/ruler.go

@@ -149,61 +149,97 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
-		ID:                  "ListRuleViews",
-		Tags:                []string{"rules"},
-		Summary:             "List rule saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Response:            new(ruletypes.ListableRuleViews),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRuleViews",
+			Tags:                []string{"rules"},
+			Summary:             "List rule saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Response:            new(ruletypes.ListableRuleViews),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
-		ID:                  "CreateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Create rule saved view",
-		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(ruletypes.PostableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Create rule saved view",
+			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(ruletypes.PostableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
-		ID:                  "UpdateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Update rule saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(ruletypes.UpdatableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Update rule saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(ruletypes.UpdatableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
-		ID:                  "DeleteRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Delete rule saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Delete rule saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/modules/promote/implpromote/module_test.go

@@ -538,7 +538,7 @@ func TestTracesNumberIndexExpr_MatchesQuerierFilters(t *testing.T) {
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			sb := sqlbuilder.NewSelectBuilder()
-			conditions, _, err := querybuilder.Conditions(context.Background(), queryInfo, tracestelemetryschema.NewStorage(), &key, testCase.operator, testCase.value, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {&key}}, false, sb)
+			conditions, _, err := querybuilder.Conditions(context.Background(), queryInfo, tracestelemetryschema.NewStorage(nil), &key, testCase.operator, testCase.value, map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {&key}}, false, sb)
 			require.NoError(t, err)
 			sb.Where(conditions...)
 			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)

pkg/modules/tracedetail/impltracedetail/store.go

@@ -64,11 +64,11 @@ type traceStore struct {
 	flagger        flagger.Flagger
 }
 
-func NewTraceStore(ts telemetrystore.TelemetryStore, metadataStore telemetrytypes.MetadataStore, fl flagger.Flagger) *traceStore {
+func NewTraceStore(ts telemetrystore.TelemetryStore, metadataStore telemetrytypes.MetadataStore, schemaMetadataStore telemetrytypes.SchemaMetadataStore, fl flagger.Flagger) *traceStore {
 	return &traceStore{
 		telemetryStore: ts,
 		metadataStore:  metadataStore,
-		storage:        tracestelemetryschema.NewStorage(),
+		storage:        tracestelemetryschema.NewStorage(schemaMetadataStore),
 		flagger:        fl,
 	}
 }

pkg/modules/tracedetail/impltracedetail/store_test.go

@@ -49,7 +49,7 @@ func newTestStore(matcher sqlmock.QueryMatcher) *spantypestest.TraceStoreTest {
 
 func newTestStoreWithMetadata(matcher sqlmock.QueryMatcher, metadataStore telemetrytypes.MetadataStore, fl flagger.Flagger) *spantypestest.TraceStoreTest {
 	ts := telemetrystoretest.New(telemetrystore.Config{}, matcher)
-	return spantypestest.New(impltracedetail.NewTraceStore(ts, metadataStore, fl), ts.Mock())
+	return spantypestest.New(impltracedetail.NewTraceStore(ts, metadataStore, nil, fl), ts.Mock())
 }
 
 func TestGetTraceBounds(t *testing.T) {

pkg/querier/config_test.go

@@ -0,0 +1,46 @@
+package querier
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/config"
+	"github.com/SigNoz/signoz/pkg/config/configtest"
+	"github.com/SigNoz/signoz/pkg/factory"
+)
+
+func TestSchemaMetadataStoreCacheTTLFromEnv(t *testing.T) {
+	testCases := []struct {
+		name string
+		env  map[string]string
+		want time.Duration
+	}{
+		{
+			name: "Unset_CachesForProcessLifetime",
+			want: 0,
+		},
+		{
+			name: "Nanosecond_ExpiresImmediately",
+			env:  map[string]string{"SIGNOZ_QUERIER_SCHEMAMETADATASTORE_CACHE__TTL": "1ns"},
+			want: time.Nanosecond,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			for key, value := range testCase.env {
+				t.Setenv(key, value)
+			}
+			conf, err := config.New(context.Background(), configtest.NewResolverConfig(), []factory.ConfigFactory{NewConfigFactory()})
+			require.NoError(t, err)
+
+			actual := Config{}
+			require.NoError(t, conf.Unmarshal("querier", &actual))
+			assert.Equal(t, testCase.want, actual.SchemaMetadataStore.CacheTTL)
+		})
+	}
+}

pkg/query-service/rules/managertestfactory.go

@@ -114,13 +114,14 @@ func NewTestManager(t *testing.T, testOpts *TestManagerOptions) *Manager {
 
 	// Create querier with test values
 	metadataStore := telemetrymetadata.NewTelemetryMetaStore(providerSettings, telemetryStore, flagger)
+	schemaMetadataStore := telemetrymetadata.NewSchemaMetadataStore(telemetryStore, 0)
 	cfg := statementbuilder.Config{}
 	ctx := context.Background()
-	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, flagger).New(ctx, providerSettings, cfg)
+	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, schemaMetadataStore, flagger).New(ctx, providerSettings, cfg)
 	require.NoError(t, err)
-	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, flagger).New(ctx, providerSettings, cfg)
+	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, schemaMetadataStore, flagger).New(ctx, providerSettings, cfg)
 	require.NoError(t, err)
-	traceOperatorStmtBuilder, err := tracesstatementbuilder.NewOperatorFactory(telemetryStore, metadataStore, flagger).New(ctx, providerSettings, cfg)
+	traceOperatorStmtBuilder, err := tracesstatementbuilder.NewOperatorFactory(telemetryStore, metadataStore, schemaMetadataStore, flagger).New(ctx, providerSettings, cfg)
 	require.NoError(t, err)
 	logStmtBuilder, err := logsstatementbuilder.NewFactory(telemetryStore, metadataStore, flagger).New(ctx, providerSettings, cfg)
 	require.NoError(t, err)

pkg/query-service/rules/setups_test.go

@@ -104,7 +104,7 @@ func prepareQuerierForTraces(t *testing.T, telemetryStore telemetrystore.Telemet
 	metadataStore.KeysMap = keysMap
 
 	fl := flaggertest.New(t)
-	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(context.Background(), providerSettings, statementbuilder.Config{})
+	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, nil, fl).New(context.Background(), providerSettings, statementbuilder.Config{})
 	require.NoError(t, err)
 
 	return querier.New(
@@ -140,7 +140,7 @@ func prepareQuerierForAITraces(t *testing.T, telemetryStore telemetrystore.Telem
 	metadataStore.KeysMap = keysMap
 
 	fl := flaggertest.New(t)
-	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(context.Background(), providerSettings, statementbuilder.Config{})
+	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, nil, fl).New(context.Background(), providerSettings, statementbuilder.Config{})
 	require.NoError(t, err)
 
 	return querier.New(

pkg/signoz/handler_test.go

@@ -65,7 +65,7 @@ func TestNewHandlers(t *testing.T) {
 	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
 	require.NoError(t, err)
 	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), spanMapperRegistry, providerSettings)
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, spanMapperModule)
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)

pkg/signoz/module.go

@@ -108,6 +108,7 @@ func NewModules(
 	querier querier.Querier,
 	telemetryStore telemetrystore.TelemetryStore,
 	telemetryMetadataStore telemetrytypes.MetadataStore,
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore,
 	authNs map[authtypes.AuthNProvider]authn.AuthN,
 	authz authz.AuthZ,
 	cache cache.Cache,
@@ -161,7 +162,7 @@ func NewModules(
 		LogsPipeline:         impllogspipeline.NewModule(sqlstore),
 		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore, providerSettings.Logger),
 		CloudIntegration:     cloudIntegrationModule,
-		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore, telemetryMetadataStore, fl), providerSettings, config.TraceDetail),
+		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore, telemetryMetadataStore, schemaMetadataStore, fl), providerSettings, config.TraceDetail),
 		SpanMapper:           spanMapper,
 		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), querier),
 		Tag:                  tagModule,

pkg/signoz/module_test.go

@@ -73,7 +73,7 @@ func TestNewModules(t *testing.T) {
 	require.NoError(t, err)
 	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), spanMapperRegistry, providerSettings)
 
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), spanMapperModule)
 
 	reflectVal := reflect.ValueOf(modules)
 	for i := 0; i < reflectVal.NumField(); i++ {

pkg/signoz/provider.go

@@ -270,6 +270,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddRoutePolicyTuplesFactory(sqlstore),
 		sqlmigration.NewRenameSavedViewDeprecatedTraceFieldsFactory(),
 		sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
+		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
 	)
 }
 

pkg/signoz/signoz.go

@@ -102,7 +102,7 @@ type SigNoz struct {
 }
 
 // newQueryStack assembles the query stack once and returns, in order: the shared
-// telemetry metadata store (reused elsewhere in signoz.New), the per-signal
+// telemetry metadata and schema metadata stores (reused elsewhere in signoz.New), the per-signal
 // statement builders (trace, ai-trace, log, audit, metric, meter, trace-operator),
 // and the bucket cache. It is the only place that imports the concrete
 // statement-builder sub-packages.
@@ -115,6 +115,7 @@ func newQueryStack(
 	fl flagger.Flagger,
 ) (
 	telemetrytypes.MetadataStore,
+	telemetrytypes.SchemaMetadataStore,
 	qbtypes.StatementBuilder[qbtypes.TraceAggregation],
 	qbtypes.StatementBuilder[qbtypes.TraceAggregation],
 	qbtypes.StatementBuilder[qbtypes.LogAggregation],
@@ -128,38 +129,39 @@ func newQueryStack(
 	metadataStore := telemetrymetadata.NewTelemetryMetaStore(settings, telemetryStore, fl)
 
 	cfg := config.Querier.Config
-	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(ctx, settings, cfg)
+	schemaMetadataStore := telemetrymetadata.NewSchemaMetadataStore(telemetryStore, cfg.SchemaMetadataStore.CacheTTL)
+	traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, schemaMetadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
-	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(ctx, settings, cfg)
+	aiTraceStmtBuilder, err := aistatementbuilder.NewFactory(telemetryStore, metadataStore, schemaMetadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
-	traceOperatorStmtBuilder, err := tracesstatementbuilder.NewOperatorFactory(telemetryStore, metadataStore, fl).New(ctx, settings, cfg)
+	traceOperatorStmtBuilder, err := tracesstatementbuilder.NewOperatorFactory(telemetryStore, metadataStore, schemaMetadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
 	logStmtBuilder, err := logsstatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
 	auditStmtBuilder, err := auditstatementbuilder.NewFactory(metadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
 	metricStmtBuilder, err := metricsstatementbuilder.NewFactory(metadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
 	meterStmtBuilder, err := meterstatementbuilder.NewFactory(metadataStore, fl).New(ctx, settings, cfg)
 	if err != nil {
-		return nil, nil, nil, nil, nil, nil, nil, nil, nil, err
+		return nil, nil, nil, nil, nil, nil, nil, nil, nil, nil, err
 	}
 
 	bucketCache := querier.NewBucketCache(settings, cache, config.Querier.CacheTTL, config.Querier.FluxInterval)
 
-	return metadataStore, traceStmtBuilder, aiTraceStmtBuilder, logStmtBuilder, auditStmtBuilder, metricStmtBuilder, meterStmtBuilder, traceOperatorStmtBuilder, bucketCache, nil
+	return metadataStore, schemaMetadataStore, traceStmtBuilder, aiTraceStmtBuilder, logStmtBuilder, auditStmtBuilder, metricStmtBuilder, meterStmtBuilder, traceOperatorStmtBuilder, bucketCache, nil
 }
 
 func New(
@@ -323,7 +325,7 @@ func New(
 
 	// Assemble the query stack (metadata store, statement builders, bucket cache) once,
 	// and reuse the single metadata store everywhere downstream.
-	telemetryMetadataStore, traceStmtBuilder, aiTraceStmtBuilder, logStmtBuilder, auditStmtBuilder, metricStmtBuilder, meterStmtBuilder, traceOperatorStmtBuilder, bucketCache, err := newQueryStack(ctx, providerSettings, config, telemetrystore, cache, flagger)
+	telemetryMetadataStore, schemaMetadataStore, traceStmtBuilder, aiTraceStmtBuilder, logStmtBuilder, auditStmtBuilder, metricStmtBuilder, meterStmtBuilder, traceOperatorStmtBuilder, bucketCache, err := newQueryStack(ctx, providerSettings, config, telemetrystore, cache, flagger)
 	if err != nil {
 		return nil, err
 	}
@@ -535,7 +537,7 @@ func New(
 	}
 	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), spanMapperRegistry, providerSettings)
 
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, schemaMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, spanMapperModule)
 
 	// Initialize ruler from the variant-specific provider factories
 	rulerInstance, err := factory.NewProviderFromNamedMap(ctx, providerSettings, config.Ruler, rulerProviderFactories(cache, alertmanager, sqlstore, telemetrystore, telemetryMetadataStore, prometheus, orgGetter, modules.RuleStateHistory, querier, queryParser), "signoz")

pkg/sqlmigration/143_add_rule_tuples.go

@@ -0,0 +1,140 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addRuleTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addRuleTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addRuleTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	crudVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+
+	tuples := make([]migrationTuple, 0, 12)
+	for _, verb := range crudVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "rule", verb},
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "rule", verb},
+		)
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "rule", verb})
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addRuleTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/statementbuilder/aistatementbuilder/statement_builder.go

@@ -17,9 +17,10 @@ import (
 func NewFactory(
 	telemetryStore telemetrystore.TelemetryStore,
 	metadataStore telemetrytypes.MetadataStore,
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore,
 	fl flagger.Flagger,
 ) factory.ProviderFactory[qbtypes.StatementBuilder[qbtypes.TraceAggregation], statementbuilder.Config] {
-	return scopedtraces.NewFactory(factory.MustNewName("ai"), Scope(), telemetryStore, metadataStore, fl)
+	return scopedtraces.NewFactory(factory.MustNewName("ai"), Scope(), telemetryStore, metadataStore, schemaMetadataStore, fl)
 }
 
 // Scope describes gen_ai for the scoped trace builder: an AI trace has >=1 gen_ai

pkg/statementbuilder/aistatementbuilder/statement_builder_test.go

@@ -107,7 +107,7 @@ func newTestBuilderWithKeys(t *testing.T, keysMap map[string][]*telemetrytypes.T
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = keysMap
 
-	stmtBuilder, err := NewFactory(nil, mockMetadataStore, flaggertest.New(t)).
+	stmtBuilder, err := NewFactory(nil, mockMetadataStore, nil, flaggertest.New(t)).
 		New(context.Background(), settings, statementbuilder.Config{SkipResourceFingerprint: statementbuilder.SkipResourceFingerprint{Threshold: 100000}})
 	require.NoError(t, err)
 	return stmtBuilder

pkg/statementbuilder/config.go

@@ -1,6 +1,8 @@
 package statementbuilder
 
 import (
+	"time"
+
 	"github.com/SigNoz/signoz/pkg/errors"
 )
 
@@ -11,6 +13,12 @@ type SkipResourceFingerprint struct {
 	Threshold uint64 `yaml:"threshold" mapstructure:"threshold"`
 }
 
+// SchemaMetadataStore configures the schema metadata store.
+type SchemaMetadataStore struct {
+	// CacheTTL is how long found entries stay cached; 0 caches them for the life of the process.
+	CacheTTL time.Duration `yaml:"cache_ttl" mapstructure:"cache_ttl"`
+}
+
 // Config represents the configuration for the statement builders.
 type Config struct {
 	// SkipResourceFingerprint configures when the resource fingerprint subquery is skipped in favor of main-table filtering.
@@ -21,6 +29,8 @@ type Config struct {
 	// SearchMaxScanRowsJSONBody is the same budget for body_v2, where each row costs far
 	// more: toString() rebuilds every document and no skip index prunes (0 disables).
 	SearchMaxScanRowsJSONBody int64 `yaml:"search_max_scan_rows_json_body" mapstructure:"search_max_scan_rows_json_body"`
+	// SchemaMetadataStore configures the schema metadata store.
+	SchemaMetadataStore SchemaMetadataStore `yaml:"schemametadatastore" mapstructure:"schemametadatastore"`
 }
 
 func NewConfig() Config {
@@ -45,5 +55,8 @@ func (c Config) Validate() error {
 	if c.SearchMaxScanRowsJSONBody < 0 {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "search_max_scan_rows_json_body must not be negative, got %v", c.SearchMaxScanRowsJSONBody)
 	}
+	if c.SchemaMetadataStore.CacheTTL < 0 {
+		return errors.NewInvalidInputf(errors.CodeInvalidInput, "schemametadatastore.cache_ttl must not be negative, got %v", c.SchemaMetadataStore.CacheTTL)
+	}
 	return nil
 }

pkg/statementbuilder/scopedtracesstatementbuilder/statement_builder.go

@@ -50,16 +50,17 @@ func NewFactory(
 	scope TraceScope,
 	telemetryStore telemetrystore.TelemetryStore,
 	metadataStore telemetrytypes.MetadataStore,
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore,
 	fl flagger.Flagger,
 ) factory.ProviderFactory[qbtypes.StatementBuilder[qbtypes.TraceAggregation], statementbuilder.Config] {
 	return factory.NewProviderFactory(
 		name,
 		func(ctx context.Context, settings factory.ProviderSettings, cfg statementbuilder.Config) (qbtypes.StatementBuilder[qbtypes.TraceAggregation], error) {
-			traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, fl).New(ctx, settings, cfg)
+			traceStmtBuilder, err := tracesstatementbuilder.NewFactory(telemetryStore, metadataStore, schemaMetadataStore, fl).New(ctx, settings, cfg)
 			if err != nil {
 				return nil, err
 			}
-			return NewScopedTraceStatementBuilder(settings, metadataStore, tracestelemetryschema.NewStorage(), scope, traceStmtBuilder, fl), nil
+			return NewScopedTraceStatementBuilder(settings, metadataStore, tracestelemetryschema.NewStorage(schemaMetadataStore), scope, traceStmtBuilder, fl), nil
 		},
 	)
 }

pkg/statementbuilder/tracesstatementbuilder/bulk_attributes_test.go

@@ -17,6 +17,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -26,7 +27,9 @@ var jsonAttrColRe = regexp.MustCompile(`,\s*attributes\s*(,| FROM )`)
 func newBulkTestBuilder(t *testing.T, releaseTime time.Time) *traceQueryStatementBuilder {
 	t.Helper()
 	fl := flaggertest.WithBooleanFlags(t, map[string]bool{flagger.FeatureUseTraceAttributesJSON.String(): true})
-	storage := tracestelemetryschema.NewStorage()
+	schemaMetadataStore := telemetrytypestest.NewMockSchemaMetadataStore(t)
+	schemaMetadataStore.EXPECT().GetBaseColumnEvolutions(mock.Anything, telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute).Return(tracestelemetryschema.MockAttributeEvolutionData(releaseTime), nil).Maybe()
+	storage := tracestelemetryschema.NewStorage(schemaMetadataStore)
 	store := telemetrytypestest.NewMockMetadataStore()
 	store.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	store.KeysMap["http.route"] = []*telemetrytypes.TelemetryFieldKey{{
@@ -148,3 +151,153 @@ func TestGroupByAttributeHomeAcrossRollout(t *testing.T) {
 		})
 	}
 }
+
+func TestUnknownAttributeFollowsRollout(t *testing.T) {
+	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
+	rel := releaseTime.UnixMilli()
+	day := int64(24 * time.Hour / time.Millisecond)
+
+	b := newBulkTestBuilder(t, releaseTime)
+
+	testCases := []struct {
+		name            string
+		startMs         uint64
+		endMs           uint64
+		wantContains    []string
+		wantNotContains []string
+	}{
+		{
+			name:            "BeforeRollout_ReadsLegacyMap",
+			startMs:         uint64(rel - 2*day),
+			endMs:           uint64(rel - day),
+			wantContains:    []string{"attributes_string['unknown.attr'] = ?", "mapContains(attributes_string, 'unknown.attr')"},
+			wantNotContains: []string{"attributes.`unknown.attr`"},
+		},
+		{
+			name:            "StraddlingRollout_JSONThenLegacyFallback",
+			startMs:         uint64(rel - day),
+			endMs:           uint64(rel + day),
+			wantContains:    []string{"attributes.`unknown.attr` IS NOT NULL", "attributes.`unknown.attr`::String", "attributes_string['unknown.attr']"},
+			wantNotContains: nil,
+		},
+		{
+			name:            "AfterRollout_ReadsJSONOnly",
+			startMs:         uint64(rel + day),
+			endMs:           uint64(rel + 2*day),
+			wantContains:    []string{"attributes.`unknown.attr`::String = ?"},
+			wantNotContains: []string{"attributes_string"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stmt, err := b.Build(
+				context.Background(), valuer.UUID{}, testCase.startMs, testCase.endMs,
+				qbtypes.RequestTypeTimeSeries,
+				qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+					Signal:       telemetrytypes.SignalTraces,
+					StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+					Aggregations: []qbtypes.TraceAggregation{{Expression: "count()"}},
+					Filter:       &qbtypes.Filter{Expression: "unknown.attr = 'x'"},
+					GroupBy: []qbtypes.GroupByKey{{TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
+						Name: "unknown.attr",
+					}}},
+					Limit: 10,
+				},
+				nil,
+			)
+			require.NoError(t, err)
+			for _, want := range testCase.wantContains {
+				assert.Contains(t, stmt.Query, want)
+			}
+			for _, unwanted := range testCase.wantNotContains {
+				assert.NotContains(t, stmt.Query, unwanted)
+			}
+			assert.Contains(t, strings.Join(stmt.Warnings, "\n"), "not found in metadata")
+		})
+	}
+}
+
+func TestUnknownAttributeFollowsRolloutAfterRelease(t *testing.T) {
+	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
+	startMs := uint64(releaseTime.Add(24 * time.Hour).UnixMilli())
+	endMs := uint64(releaseTime.Add(48 * time.Hour).UnixMilli())
+
+	b := newBulkTestBuilder(t, releaseTime)
+
+	testCases := []struct {
+		name            string
+		requestType     qbtypes.RequestType
+		query           qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]
+		wantContains    []string
+		wantNotContains []string
+	}{
+		{
+			name:        "AggregationArgument_ReadsJSONOnly",
+			requestType: qbtypes.RequestTypeTimeSeries,
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
+				Aggregations: []qbtypes.TraceAggregation{{Expression: "sum(unknown.num)"}},
+			},
+			wantContains:    []string{"attributes.`unknown.num`"},
+			wantNotContains: []string{"attributes_number['unknown.num']"},
+		},
+		{
+			name:        "RawSelectAndOrder_ReadsJSONOnly",
+			requestType: qbtypes.RequestTypeRaw,
+			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
+				Signal:       telemetrytypes.SignalTraces,
+				SelectFields: []telemetrytypes.TelemetryFieldKey{{Name: "unknown.attr"}},
+				Order:        []qbtypes.OrderBy{{Key: qbtypes.OrderByKey{TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{Name: "unknown.attr"}}, Direction: qbtypes.OrderDirectionAsc}},
+				Limit:        10,
+			},
+			wantContains:    []string{"attributes.`unknown.attr`"},
+			wantNotContains: []string{"attributes_string['unknown.attr']"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stmt, err := b.Build(context.Background(), valuer.UUID{}, startMs, endMs, testCase.requestType, testCase.query, nil)
+			require.NoError(t, err)
+			for _, want := range testCase.wantContains {
+				assert.Contains(t, stmt.Query, want)
+			}
+			for _, unwanted := range testCase.wantNotContains {
+				assert.NotContains(t, stmt.Query, unwanted)
+			}
+		})
+	}
+}
+
+func TestTraceOperatorUnknownAttributeFollowsRollout(t *testing.T) {
+	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
+	startMs := uint64(releaseTime.Add(24 * time.Hour).UnixMilli())
+	endMs := uint64(releaseTime.Add(48 * time.Hour).UnixMilli())
+
+	fl := flaggertest.WithBooleanFlags(t, map[string]bool{flagger.FeatureUseTraceAttributesJSON.String(): true})
+	schemaMetadataStore := telemetrytypestest.NewMockSchemaMetadataStore(t)
+	schemaMetadataStore.EXPECT().GetBaseColumnEvolutions(mock.Anything, telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute).Return(tracestelemetryschema.MockAttributeEvolutionData(releaseTime), nil).Maybe()
+	storage := tracestelemetryschema.NewStorage(schemaMetadataStore)
+	store := telemetrytypestest.NewMockMetadataStore()
+	store.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
+	store.ColumnEvolutionMetadataMap["traces:attribute:__all__"] = tracestelemetryschema.MockAttributeEvolutionData(releaseTime)
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
+	traceStmtBuilder := NewTraceQueryStatementBuilder(instrumentationtest.New().ToProviderSettings(), store, storage, aggExprRewriter, nil, fl, false, 100000)
+	b := NewTraceOperatorStatementBuilder(instrumentationtest.New().ToProviderSettings(), store, storage, traceStmtBuilder, aggExprRewriter, fl)
+
+	operator := qbtypes.QueryBuilderTraceOperator{Expression: "A => B", Limit: 10}
+	require.NoError(t, operator.ParseExpression())
+	compositeQuery := &qbtypes.CompositeQuery{Queries: []qbtypes.QueryEnvelope{
+		{Type: qbtypes.QueryTypeBuilder, Spec: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{Name: "A", Signal: telemetrytypes.SignalTraces, Filter: &qbtypes.Filter{Expression: "unknown.attr = 'x'"}}},
+		{Type: qbtypes.QueryTypeBuilder, Spec: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{Name: "B", Signal: telemetrytypes.SignalTraces, Filter: &qbtypes.Filter{Expression: "unknown.other = 'y'"}}},
+	}}
+
+	stmt, err := b.Build(context.Background(), valuer.UUID{}, startMs, endMs, qbtypes.RequestTypeRaw, operator, compositeQuery)
+	require.NoError(t, err)
+	assert.Contains(t, stmt.Query, "attributes.`unknown.attr`::String = ?")
+	assert.Contains(t, stmt.Query, "attributes.`unknown.other`::String = ?")
+	assert.NotContains(t, stmt.Query, "attributes_string['unknown.attr']")
+	assert.NotContains(t, stmt.Query, "attributes_string['unknown.other']")
+}

pkg/statementbuilder/tracesstatementbuilder/statement_builder.go

@@ -49,12 +49,13 @@ var _ qbtypes.StatementBuilder[qbtypes.TraceAggregation] = (*traceQueryStatement
 func NewFactory(
 	telemetryStore telemetrystore.TelemetryStore,
 	metadataStore telemetrytypes.MetadataStore,
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore,
 	fl flagger.Flagger,
 ) factory.ProviderFactory[qbtypes.StatementBuilder[qbtypes.TraceAggregation], statementbuilder.Config] {
 	return factory.NewProviderFactory(
 		factory.MustNewName("traces"),
 		func(_ context.Context, settings factory.ProviderSettings, cfg statementbuilder.Config) (qbtypes.StatementBuilder[qbtypes.TraceAggregation], error) {
-			storage := tracestelemetryschema.NewStorage()
+			storage := tracestelemetryschema.NewStorage(schemaMetadataStore)
 			aggExprRewriter := querybuilder.NewAggExprRewriter(settings, nil, storage, fl, telemetrytypes.SignalTraces)
 			return NewTraceQueryStatementBuilder(
 				settings, metadataStore, storage, aggExprRewriter, telemetryStore, fl,

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -465,7 +465,7 @@ func TestStatementBuilder(t *testing.T) {
 	}
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -764,7 +764,7 @@ func TestStatementBuilderListQuery(t *testing.T) {
 	}
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -1026,7 +1026,7 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			fl := flaggertest.New(t)
-			storage := tracestelemetryschema.NewStorage()
+			storage := tracestelemetryschema.NewStorage(nil)
 			mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 			mockMetadataStore.KeysMap = c.keysMap
 			if mockMetadataStore.KeysMap == nil {
@@ -1099,7 +1099,7 @@ func TestStatementBuilderGroupByResourceEvolution(t *testing.T) {
 	}
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -1264,7 +1264,7 @@ func TestStatementBuilderTraceQuery(t *testing.T) {
 	}
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -1900,7 +1900,7 @@ func newSkipResourceFingerprintBuilder(
 	t.Helper()
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
@@ -1926,7 +1926,7 @@ func TestStatementBuilderGroupByUnseenKey(t *testing.T) {
 	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -1966,7 +1966,7 @@ func TestStatementBuilderAggregationUnseenKey(t *testing.T) {
 	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -2039,7 +2039,7 @@ func TestStatementBuilderSemconvFamilies(t *testing.T) {
 			fl := flaggertest.WithBooleanFlags(t, map[string]bool{
 				flagger.FeatureResolveSemconvFamilies.String(): c.flag,
 			})
-			storage := tracestelemetryschema.NewStorage()
+			storage := tracestelemetryschema.NewStorage(nil)
 			mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 			mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 			aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)
@@ -2071,7 +2071,7 @@ func TestStatementBuilderSemconvSingleSpelling(t *testing.T) {
 	fl := flaggertest.WithBooleanFlags(t, map[string]bool{
 		flagger.FeatureResolveSemconvFamilies.String(): true,
 	})
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = map[string][]*telemetrytypes.TelemetryFieldKey{
 		"deployment.environment": {{

pkg/statementbuilder/tracesstatementbuilder/trace_operator_cte_builder_test.go

@@ -20,7 +20,7 @@ func newTestTraceOperatorStatementBuilder(t *testing.T) *traceOperatorStatementB
 	t.Helper()
 	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)
 	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalTraces)

pkg/statementbuilder/tracesstatementbuilder/trace_operator_statement_builder.go

@@ -36,12 +36,13 @@ var _ qbtypes.TraceOperatorStatementBuilder = (*traceOperatorStatementBuilder)(n
 func NewOperatorFactory(
 	telemetryStore telemetrystore.TelemetryStore,
 	metadataStore telemetrytypes.MetadataStore,
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore,
 	fl flagger.Flagger,
 ) factory.ProviderFactory[qbtypes.TraceOperatorStatementBuilder, statementbuilder.Config] {
 	return factory.NewProviderFactory(
 		factory.MustNewName("traceoperator"),
 		func(_ context.Context, settings factory.ProviderSettings, cfg statementbuilder.Config) (qbtypes.TraceOperatorStatementBuilder, error) {
-			storage := tracestelemetryschema.NewStorage()
+			storage := tracestelemetryschema.NewStorage(schemaMetadataStore)
 			aggExprRewriter := querybuilder.NewAggExprRewriter(settings, nil, storage, fl, telemetrytypes.SignalTraces)
 			traceStmtBuilder := NewTraceQueryStatementBuilder(
 				settings, metadataStore, storage, aggExprRewriter, telemetryStore, fl,

pkg/statementbuilder/tracesstatementbuilder/trace_time_range_test.go

@@ -22,7 +22,7 @@ func TestTraceTimeRangeOptimization(t *testing.T) {
 	releaseTime := time.Date(2025, 5, 22, 22, 0, 0, 0, time.UTC)
 
 	fl := flaggertest.New(t)
-	storage := tracestelemetryschema.NewStorage()
+	storage := tracestelemetryschema.NewStorage(nil)
 	mockMetadataStore := telemetrytypestest.NewMockMetadataStore()
 
 	mockMetadataStore.KeysMap = tracestelemetryschema.BuildCompleteFieldKeyMap(releaseTime)

pkg/telemetrymetadata/metadata.go

@@ -2442,10 +2442,10 @@ func (t *telemetryMetaStore) fetchMeterSourceMetricsTemporalityAndType(ctx conte
 	return temporalities, types, nil
 }
 
-func (k *telemetryMetaStore) fetchEvolutionEntryFromClickHouse(ctx context.Context, selectors []*telemetrytypes.EvolutionSelector) ([]*telemetrytypes.EvolutionEntry, error) {
+func fetchEvolutionEntryFromClickHouse(ctx context.Context, telemetryStore telemetrystore.TelemetryStore, table string, selectors []*telemetrytypes.EvolutionSelector) ([]*telemetrytypes.EvolutionEntry, error) {
 	sb := sqlbuilder.NewSelectBuilder()
 	sb.Select("signal", "column_name", "column_type", "field_context", "field_name", "version", "release_time")
-	sb.From(fmt.Sprintf("%s.%s", k.relatedMetadataDBName, k.columnEvolutionMetadataTblName))
+	sb.From(table)
 	sb.OrderBy("release_time ASC")
 
 	var clauses []string
@@ -2467,7 +2467,7 @@ func (k *telemetryMetaStore) fetchEvolutionEntryFromClickHouse(ctx context.Conte
 	query, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
 
 	var entries []*telemetrytypes.EvolutionEntry
-	rows, err := k.telemetrystore.ClickhouseDB().Query(ctx, query, args...)
+	rows, err := telemetryStore.ClickhouseDB().Query(ctx, query, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -2517,7 +2517,7 @@ func (k *telemetryMetaStore) updateColumnEvolutionMetadataForKeys(ctx context.Co
 		metadataKeySelectors = append(metadataKeySelectors, selector)
 	}
 
-	evolutions, err := k.fetchEvolutionEntryFromClickHouse(ctx, metadataKeySelectors)
+	evolutions, err := fetchEvolutionEntryFromClickHouse(ctx, k.telemetrystore, fmt.Sprintf("%s.%s", k.relatedMetadataDBName, k.columnEvolutionMetadataTblName), metadataKeySelectors)
 	if err != nil {
 		return errors.Newf(errors.TypeInternal, errors.CodeInternal, "failed to fetch evolution from clickhouse %s", err.Error())
 	}

pkg/telemetrymetadata/schema_metadata_store.go

@@ -0,0 +1,49 @@
+package telemetrymetadata
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+)
+
+var CodeFailLoadBaseColumnEvolutions = errors.MustNewCode("fail_load_base_column_evolutions")
+
+type schemaMetadataStore struct {
+	telemetryStore       telemetrystore.TelemetryStore
+	cacheTTL             time.Duration
+	baseColumnEvolutions sync.Map
+}
+
+type cachedEvolutions struct {
+	entries   []*telemetrytypes.EvolutionEntry
+	fetchedAt time.Time
+}
+
+// A zero cacheTTL caches for the life of the process.
+func NewSchemaMetadataStore(telemetryStore telemetrystore.TelemetryStore, cacheTTL time.Duration) telemetrytypes.SchemaMetadataStore {
+	return &schemaMetadataStore{telemetryStore: telemetryStore, cacheTTL: cacheTTL}
+}
+
+// An empty result is not cached: the migrator can add the entries at runtime.
+func (s *schemaMetadataStore) GetBaseColumnEvolutions(ctx context.Context, signal telemetrytypes.Signal, fieldContext telemetrytypes.FieldContext) ([]*telemetrytypes.EvolutionEntry, error) {
+	selector := &telemetrytypes.EvolutionSelector{Signal: signal, FieldContext: fieldContext, FieldName: telemetrytypes.EvolutionFieldNameAll}
+	if cached, ok := s.baseColumnEvolutions.Load(selector.QualifiedName()); ok {
+		if cached := cached.(cachedEvolutions); s.cacheTTL == 0 || time.Since(cached.fetchedAt) < s.cacheTTL {
+			return cached.entries, nil
+		}
+	}
+
+	entries, err := fetchEvolutionEntryFromClickHouse(ctx, s.telemetryStore, fmt.Sprintf("%s.%s", DBName, ColumnEvolutionMetadataTableName), []*telemetrytypes.EvolutionSelector{selector})
+	if err != nil {
+		return nil, errors.WrapInternalf(err, CodeFailLoadBaseColumnEvolutions, "failed to fetch the base column evolutions of %s", selector.QualifiedName())
+	}
+	if len(entries) > 0 {
+		s.baseColumnEvolutions.Store(selector.QualifiedName(), cachedEvolutions{entries: entries, fetchedAt: time.Now()})
+	}
+	return entries, nil
+}

pkg/telemetrymetadata/schema_metadata_store_test.go

@@ -0,0 +1,88 @@
+package telemetrymetadata
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	cmock "github.com/SigNoz/clickhouse-go-mock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+)
+
+var evolutionColumns = []cmock.ColumnType{
+	{Name: "signal", Type: "String"},
+	{Name: "column_name", Type: "String"},
+	{Name: "column_type", Type: "String"},
+	{Name: "field_context", Type: "String"},
+	{Name: "field_name", Type: "String"},
+	{Name: "version", Type: "UInt32"},
+	{Name: "release_time", Type: "Float64"},
+}
+
+func expectBaseColumnEvolutionsQuery(mock cmock.ClickConnMockCommon, rows [][]any) {
+	mock.ExpectQuery(`SELECT signal, column_name, column_type, field_context, field_name, version, release_time FROM signoz_metadata\.distributed_column_evolution_metadata`).
+		WithArgs(telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute, "__all__", "__all__").
+		WillReturnRows(cmock.NewRows(evolutionColumns, rows))
+}
+
+func TestGetBaseColumnEvolutionsReadsCache(t *testing.T) {
+	mockTelemetryStore := telemetrystoretest.New(telemetrystore.Config{}, &regexMatcher{})
+	mock := mockTelemetryStore.Mock()
+	store := NewSchemaMetadataStore(mockTelemetryStore, 0)
+
+	releaseTime := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC)
+	expectBaseColumnEvolutionsQuery(mock, [][]any{
+		{"traces", "attributes", "JSON()", "attribute", "__all__", uint32(0), float64(releaseTime.UnixNano())},
+	})
+
+	for range 2 {
+		entries, err := store.GetBaseColumnEvolutions(context.Background(), telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute)
+		require.NoError(t, err)
+		require.Len(t, entries, 1)
+		assert.Equal(t, "attributes", entries[0].ColumnName)
+		assert.Equal(t, releaseTime, entries[0].ReleaseTime.UTC())
+	}
+	require.NoError(t, mock.ExpectationsWereMet())
+}
+
+func TestGetBaseColumnEvolutionsRefetchesEmptyResult(t *testing.T) {
+	mockTelemetryStore := telemetrystoretest.New(telemetrystore.Config{}, &regexMatcher{})
+	mock := mockTelemetryStore.Mock()
+	store := NewSchemaMetadataStore(mockTelemetryStore, 0)
+	get := func() []*telemetrytypes.EvolutionEntry {
+		entries, err := store.GetBaseColumnEvolutions(context.Background(), telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute)
+		require.NoError(t, err)
+		return entries
+	}
+
+	expectBaseColumnEvolutionsQuery(mock, nil)
+	assert.Empty(t, get())
+
+	expectBaseColumnEvolutionsQuery(mock, [][]any{
+		{"traces", "attributes", "JSON()", "attribute", "__all__", uint32(0), float64(time.Now().UnixNano())},
+	})
+	assert.Len(t, get(), 1)
+	assert.Len(t, get(), 1, "a found result is cached")
+	require.NoError(t, mock.ExpectationsWereMet())
+}
+
+func TestGetBaseColumnEvolutionsRefetchesExpiredEntry(t *testing.T) {
+	mockTelemetryStore := telemetrystoretest.New(telemetrystore.Config{}, &regexMatcher{})
+	mock := mockTelemetryStore.Mock()
+	store := NewSchemaMetadataStore(mockTelemetryStore, time.Nanosecond)
+
+	rows := [][]any{{"traces", "attributes", "JSON()", "attribute", "__all__", uint32(0), float64(time.Now().UnixNano())}}
+	expectBaseColumnEvolutionsQuery(mock, rows)
+	expectBaseColumnEvolutionsQuery(mock, rows)
+	for range 2 {
+		entries, err := store.GetBaseColumnEvolutions(context.Background(), telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute)
+		require.NoError(t, err)
+		assert.Len(t, entries, 1)
+	}
+	require.NoError(t, mock.ExpectationsWereMet())
+}

pkg/telemetryschema/tracestelemetryschema/compile_test.go

@@ -288,7 +288,7 @@ func TestConditionFor(t *testing.T) {
 		},
 	}
 
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	for _, tc := range testCases {
 		sb := sqlbuilder.NewSelectBuilder()
@@ -374,7 +374,7 @@ func TestConditionForResourceWithEvolution(t *testing.T) {
 		},
 	}
 
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	for _, tc := range testCases {
 		sb := sqlbuilder.NewSelectBuilder()
@@ -396,7 +396,7 @@ func TestConditionForResourceWithEvolution(t *testing.T) {
 // undeclared (Dynamic) paths and genuinely NULL when absent.
 func TestConditionForScopeIntrinsicFields(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	testCases := []struct {
 		name        string
@@ -482,7 +482,7 @@ func TestConditionForScopeIntrinsicFields(t *testing.T) {
 // user input and queries anyway, emitting a warning instead of failing.
 func TestConditionForSynthesizedKeys(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	// no metadata matches -> the builder must synthesize from user input
 	var noMatches map[string][]*telemetrytypes.TelemetryFieldKey
@@ -692,7 +692,7 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 // attribute, with or without a metadata entry for the column.
 func TestIntrinsicColumnFirst(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	q := qbtypes.QueryInfo{StartNs: 1761437108000000000, EndNs: 1761458708000000000}
 	attr := func(name string, dataType telemetrytypes.FieldDataType) *telemetrytypes.TelemetryFieldKey {
 		return &telemetrytypes.TelemetryFieldKey{Name: name, Signal: telemetrytypes.SignalTraces, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: dataType}

pkg/telemetryschema/tracestelemetryschema/family_test.go

@@ -51,7 +51,7 @@ func TestConditionForFamilyMergesMembersCurrentFirst(t *testing.T) {
 		}},
 	}
 	fl := familyFlagOn(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	// The requested spelling is the old name; precedence must still be
 	// current-first.
@@ -87,7 +87,7 @@ func TestConditionForFamilyNegativeKeepsKeylessRows(t *testing.T) {
 		}},
 	}
 	fl := familyFlagOn(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	sb := sqlbuilder.NewSelectBuilder()
 	conds, _, err := querybuilder.Conditions(context.Background(), querybuilder.NewQueryInfo(context.Background(), valuer.UUID{}, fl, telemetrytypes.SignalTraces, nil, startNs, endNs), storage, &telemetrytypes.TelemetryFieldKey{Name: "deployment.environment.name"}, qbtypes.FilterOperatorNotEqual, "production", fieldKeys, false, sb)
@@ -122,7 +122,7 @@ func TestConditionForFamilyExists(t *testing.T) {
 		}},
 	}
 	fl := familyFlagOn(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	sb := sqlbuilder.NewSelectBuilder()
 	conds, _, err := querybuilder.Conditions(context.Background(), querybuilder.NewQueryInfo(context.Background(), valuer.UUID{}, fl, telemetrytypes.SignalTraces, nil, startNs, endNs), storage, &telemetrytypes.TelemetryFieldKey{Name: "deployment.environment.name"}, qbtypes.FilterOperatorNotExists, nil, fieldKeys, false, sb)
@@ -157,7 +157,7 @@ func TestConditionForFamilyOffByDefault(t *testing.T) {
 		}},
 	}
 	fl := flaggertest.New(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	sb := sqlbuilder.NewSelectBuilder()
 	conds, _, err := querybuilder.Conditions(context.Background(), querybuilder.NewQueryInfo(context.Background(), valuer.UUID{}, fl, telemetrytypes.SignalTraces, nil, startNs, endNs), storage, &telemetrytypes.TelemetryFieldKey{Name: "deployment.environment.name"}, qbtypes.FilterOperatorEqual, "production", fieldKeys, false, sb)
@@ -193,7 +193,7 @@ func TestConditionForSingleMemberIsUnchanged(t *testing.T) {
 	}
 	delete(fieldKeys, "deployment.environment")
 	fl := familyFlagOn(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	sb := sqlbuilder.NewSelectBuilder()
 	conds, _, err := querybuilder.Conditions(context.Background(), querybuilder.NewQueryInfo(context.Background(), valuer.UUID{}, fl, telemetrytypes.SignalTraces, nil, startNs, endNs), storage, &telemetrytypes.TelemetryFieldKey{Name: "deployment.environment.name"}, qbtypes.FilterOperatorEqual, "production", fieldKeys, false, sb)
@@ -226,7 +226,7 @@ func TestColumnExpressionForFamilyGroupBy(t *testing.T) {
 		}},
 	}
 	fl := familyFlagOn(t)
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	expr, err := querybuilder.ResolveColumn(context.Background(), querybuilder.NewQueryInfo(context.Background(), valuer.UUID{}, fl, telemetrytypes.SignalTraces, nil, startNs, endNs), storage, &telemetrytypes.TelemetryFieldKey{Name: "deployment.environment.name"}, telemetrytypes.FieldDataTypeString, fieldKeys)
 	require.NoError(t, err)

pkg/telemetryschema/tracestelemetryschema/span_scope_simple_test.go

@@ -15,7 +15,7 @@ import (
 
 func TestSpanScopeFilterExpression(t *testing.T) {
 	// Test that span scope fields work in filter expressions
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	tests := []struct {
 		name              string
@@ -125,7 +125,7 @@ func TestSpanScopeWithResourceFilter(t *testing.T) {
 			// For now, just verify the expression parses correctly
 			// In a real implementation, we'd need to check that the resource filter
 			// is properly skipped when span scope fields are present
-			storage := NewStorage()
+			storage := NewStorage(nil)
 
 			// Prepare field keys for the test
 			fieldKeys := make(map[string][]*telemetrytypes.TelemetryFieldKey)

pkg/telemetryschema/tracestelemetryschema/storage.go

@@ -162,12 +162,14 @@ var (
 	}
 )
 
-type storage struct{}
+type storage struct {
+	schemaMetadataStore telemetrytypes.SchemaMetadataStore
+}
 
 var _ qbtypes.Storage = (*storage)(nil)
 
-func NewStorage() qbtypes.Storage {
-	return &storage{}
+func NewStorage(schemaMetadataStore telemetrytypes.SchemaMetadataStore) qbtypes.Storage {
+	return &storage{schemaMetadataStore: schemaMetadataStore}
 }
 
 func (m *storage) getColumn(
@@ -562,9 +564,35 @@ func (m *storage) Fallback(ctx context.Context, q qbtypes.QueryInfo, key *teleme
 		literal := telemetrytypes.NewTelemetryFieldKey(key.FieldContext.StringValue()+"."+key.Name, key.FieldContext, key.FieldDataType)
 		keys = append(querybuilder.SynthesizeKeys(key, value), querybuilder.SynthesizeKeys(literal, value)...)
 	}
+	if err := m.addBaseColumnEvolutions(ctx, q, keys); err != nil {
+		return nil, err
+	}
 	return querybuilder.WrapAsLogicalFields(key.Name, keys), nil
 }
 
+func (m *storage) addBaseColumnEvolutions(ctx context.Context, q qbtypes.QueryInfo, keys []*telemetrytypes.TelemetryFieldKey) error {
+	if !q.TraceAttrsJSONOn || m.schemaMetadataStore == nil {
+		return nil
+	}
+	var attributeKeys []*telemetrytypes.TelemetryFieldKey
+	for _, key := range keys {
+		if key.FieldContext == telemetrytypes.FieldContextAttribute && len(key.Evolutions) == 0 {
+			attributeKeys = append(attributeKeys, key)
+		}
+	}
+	if len(attributeKeys) == 0 {
+		return nil
+	}
+	evolutions, err := m.schemaMetadataStore.GetBaseColumnEvolutions(ctx, telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute)
+	if err != nil {
+		return err
+	}
+	for _, key := range attributeKeys {
+		key.Evolutions = evolutions
+	}
+	return nil
+}
+
 // stampColumnType gives an untyped column key the data type its column reads
 // as, so the intrinsic-column step can compare it with same-named metadata.
 func stampColumnType(key *telemetrytypes.TelemetryFieldKey, columns []*schema.Column) *telemetrytypes.TelemetryFieldKey {

pkg/telemetryschema/tracestelemetryschema/storage_attributes_json_test.go

@@ -8,8 +8,10 @@ import (
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
 	"github.com/huandu/go-sqlbuilder"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -44,7 +46,7 @@ func attrKey(name string, dt telemetrytypes.FieldDataType, evo []*telemetrytypes
 // cast, straddling a dual-read multiIf with the JSON column first.
 func TestFieldForAttributeJSONEvolution(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	testCases := []struct {
@@ -79,7 +81,7 @@ func TestFieldForAttributeJSONEvolution(t *testing.T) {
 // entry is registered: a key with no evolutions resolves to the Map column for every window.
 func TestFieldForAttributeNoEvolutionParity(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	for _, dt := range []struct {
 		dataType telemetrytypes.FieldDataType
@@ -101,7 +103,7 @@ func TestFieldForAttributeNoEvolutionParity(t *testing.T) {
 // every window.
 func TestAttributeJSONFlagOffParity(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 	windows := map[string][2]uint64{
 		"BeforeRelease":     attrWindowBefore,
@@ -154,7 +156,7 @@ func TestAttributeJSONFlagOffParity(t *testing.T) {
 // numeric comparisons keep numeric semantics; existence never tests the ::String cast.
 func TestConditionForAttributeJSON(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	testCases := []struct {
@@ -261,7 +263,7 @@ func TestConditionForAttributeJSON(t *testing.T) {
 // home is excluded (De Morgan), including rows that predate the JSON column.
 func TestConditionForAttributeJSONNotExistsDualRead(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	key := attrKey("user.id", telemetrytypes.FieldDataTypeString, evo)
@@ -281,7 +283,7 @@ func TestConditionForAttributeJSONNotExistsDualRead(t *testing.T) {
 // path is NULL rather than a spurious ”/0, and the numeric branch keeps its toFloat64 coercion.
 func TestColumnExpressionForAttributeJSON(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	t.Run("group by string", func(t *testing.T) {
@@ -304,7 +306,7 @@ func TestColumnExpressionForAttributeJSON(t *testing.T) {
 // attribute filter must not emit the "ambiguous key" warning.
 func TestAttributeJSONNoAmbiguityWarning(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	key := attrKey("user.id", telemetrytypes.FieldDataTypeString, evo)
@@ -320,7 +322,7 @@ func TestAttributeJSONNoAmbiguityWarning(t *testing.T) {
 // warning. In the JSON column the two branches share the raw path; only the cast differs.
 func TestConditionForAttributeJSONTypeCollision(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	strKey := attrKey("http.status_code", telemetrytypes.FieldDataTypeString, evo)
@@ -350,7 +352,7 @@ func TestConditionForAttributeJSONTypeCollision(t *testing.T) {
 // as its actual stored type.
 func TestColumnExpressionForAttributeJSONTypeCollision(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	strKey := attrKey("http.status_code", telemetrytypes.FieldDataTypeString, evo)
@@ -374,7 +376,7 @@ func TestColumnExpressionForAttributeJSONTypeCollision(t *testing.T) {
 // coverage.
 func TestColumnExpressionForAttributeJSONTypeCollisionNumericAgg(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	numKey := attrKey("http.status_code", telemetrytypes.FieldDataTypeNumber, evo)
@@ -396,7 +398,7 @@ func TestColumnExpressionForAttributeJSONTypeCollisionNumericAgg(t *testing.T) {
 // columns (attributes_string / attributes_number), each with its own mapContains guard.
 func TestConditionForAttributeMapTypeCollisionParity(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	strKey := attrKey("http.status_code", telemetrytypes.FieldDataTypeString, evo)
@@ -440,7 +442,7 @@ func TestColumnForUnspecifiedAttributeNoBranchFlip(t *testing.T) {
 // evolution: a key without it (the pre-rollout system) is byte-identical to today.
 func TestConditionForAttributeJSONNegativeOperatorParity(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	build := func(t *testing.T, key telemetrytypes.TelemetryFieldKey, window [2]uint64, op qbtypes.FilterOperator, value any) string {
@@ -520,7 +522,7 @@ func TestConditionForAttributeJSONNegativeOperatorParity(t *testing.T) {
 // EXISTS/NOT EXISTS must still exclude a key absent from every home, rather than matching it.
 func TestConditionForAttributeJSONStraddleAbsentKeyExclusion(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockAttributeEvolutionData(attrJSONRelease)
 
 	build := func(t *testing.T, key telemetrytypes.TelemetryFieldKey, op qbtypes.FilterOperator, value any) string {
@@ -551,3 +553,139 @@ func TestConditionForAttributeJSONStraddleAbsentKeyExclusion(t *testing.T) {
 		assert.Contains(t, sql, ", NULL) IS NULL")
 	})
 }
+
+func TestConditionForAttributeJSONUnknownKey(t *testing.T) {
+	evolutions := MockAttributeEvolutionData(attrJSONRelease)
+	bare := telemetrytypes.TelemetryFieldKey{Name: "unknown.attr"}
+
+	testCases := []struct {
+		name            string
+		window          [2]uint64
+		flagOff         bool
+		evolutions      []*telemetrytypes.EvolutionEntry
+		key             telemetrytypes.TelemetryFieldKey
+		operator        qbtypes.FilterOperator
+		value           any
+		wantContains    []string
+		wantNotContains []string
+	}{
+		{
+			name:            "BeforeRollout_ReadsMap",
+			window:          attrWindowBefore,
+			evolutions:      evolutions,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes_string['unknown.attr'] = ?"},
+			wantNotContains: []string{"attributes.`unknown.attr`"},
+		},
+		{
+			name:            "AfterRollout_ReadsJSON",
+			window:          attrWindowAfter,
+			evolutions:      evolutions,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes.`unknown.attr`::String = ?"},
+			wantNotContains: []string{"attributes_string"},
+		},
+		{
+			name:         "StraddlingRollout_ReadsJSONThenMap",
+			window:       attrWindowStraddle,
+			evolutions:   evolutions,
+			key:          bare,
+			operator:     qbtypes.FilterOperatorEqual,
+			value:        "x",
+			wantContains: []string{"multiIf(attributes.`unknown.attr` IS NOT NULL, attributes.`unknown.attr`::String, mapContains(attributes_string, 'unknown.attr'), attributes_string['unknown.attr'], NULL) = ?"},
+		},
+		{
+			name:            "AfterRollout_NumberOperand_ReadsJSON",
+			window:          attrWindowAfter,
+			evolutions:      evolutions,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           float64(1),
+			wantContains:    []string{"toFloat64OrNull(attributes.`unknown.attr`::String) = ?"},
+			wantNotContains: []string{"attributes_number"},
+		},
+		{
+			name:            "AfterRollout_Exists_ReadsJSONOnly",
+			window:          attrWindowAfter,
+			evolutions:      evolutions,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorExists,
+			wantContains:    []string{"attributes.`unknown.attr` IS NOT NULL"},
+			wantNotContains: []string{"mapContains"},
+		},
+		{
+			name:            "AfterRollout_AttributeContext_ReadsJSONForBothSpellings",
+			window:          attrWindowAfter,
+			evolutions:      evolutions,
+			key:             telemetrytypes.TelemetryFieldKey{Name: "unknown.attr", FieldContext: telemetrytypes.FieldContextAttribute},
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes.`unknown.attr`::String = ?", "attributes.`attribute.unknown.attr`::String = ?"},
+			wantNotContains: []string{"attributes_string"},
+		},
+		{
+			name:            "AfterRollout_SpanContext_ReadsJSONAttribute",
+			window:          attrWindowAfter,
+			evolutions:      evolutions,
+			key:             telemetrytypes.TelemetryFieldKey{Name: "unknown.attr", FieldContext: telemetrytypes.FieldContextSpan},
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes.`unknown.attr`::String = ?"},
+			wantNotContains: []string{"attributes_string"},
+		},
+		{
+			name:            "NoEvolutions_ReadsMap",
+			window:          attrWindowAfter,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes_string['unknown.attr'] = ?"},
+			wantNotContains: []string{"attributes.`unknown.attr`"},
+		},
+		{
+			name:            "FlagOff_ReadsMap",
+			window:          attrWindowAfter,
+			flagOff:         true,
+			evolutions:      evolutions,
+			key:             bare,
+			operator:        qbtypes.FilterOperatorEqual,
+			value:           "x",
+			wantContains:    []string{"attributes_string['unknown.attr'] = ?"},
+			wantNotContains: []string{"attributes.`unknown.attr`"},
+		},
+		{
+			name:         "ResourceContext_IgnoresAttributeEvolutions",
+			window:       attrWindowAfter,
+			evolutions:   evolutions,
+			key:          telemetrytypes.TelemetryFieldKey{Name: "unknown.attr", FieldContext: telemetrytypes.FieldContextResource},
+			operator:     qbtypes.FilterOperatorEqual,
+			value:        "x",
+			wantContains: []string{"resource.`unknown.attr`::String", "resources_string['unknown.attr']"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			schemaMetadataStore := telemetrytypestest.NewMockSchemaMetadataStore(t)
+			schemaMetadataStore.EXPECT().GetBaseColumnEvolutions(mock.Anything, telemetrytypes.SignalTraces, telemetrytypes.FieldContextAttribute).Return(testCase.evolutions, nil).Maybe()
+
+			q := qbtypes.QueryInfo{StartNs: testCase.window[0], EndNs: testCase.window[1], TraceAttrsJSONOn: !testCase.flagOff}
+			sb := sqlbuilder.NewSelectBuilder()
+			conds, _, err := querybuilder.Conditions(context.Background(), q, NewStorage(schemaMetadataStore), &testCase.key, testCase.operator, testCase.value, map[string][]*telemetrytypes.TelemetryFieldKey{}, false, sb)
+			require.NoError(t, err)
+			sb.Where(conds...)
+			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			for _, want := range testCase.wantContains {
+				assert.Contains(t, sql, want)
+			}
+			for _, unwanted := range testCase.wantNotContains {
+				assert.NotContains(t, sql, unwanted)
+			}
+		})
+	}
+}

pkg/telemetryschema/tracestelemetryschema/storage_attributes_promoted_test.go

@@ -24,7 +24,7 @@ var (
 // `attributes_promoted` alone after promotion — fanning out only across an evolution boundary.
 func TestFieldForAttributePromotedEvolution(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockPromotedAttributeEvolutionData("span.operation", promoJSONRelease, promoPromoRelease)
 
 	win := func(from, to string) [2]uint64 {
@@ -65,7 +65,7 @@ func TestFieldForAttributePromotedEvolution(t *testing.T) {
 // attributes_promoted_paths_tokenbf) — not the attributes column.
 func TestConditionForAttributePromoted(t *testing.T) {
 	ctx := context.Background()
-	storage := NewStorage()
+	storage := NewStorage(nil)
 	evo := MockPromotedAttributeEvolutionData("span.operation", promoJSONRelease, promoPromoRelease)
 	afterPromo := [2]uint64{
 		uint64(time.Date(2025, 7, 1, 0, 0, 0, 0, time.UTC).UnixNano()),

pkg/telemetryschema/tracestelemetryschema/storage_test.go

@@ -146,7 +146,7 @@ func TestGetFieldKeyName(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			storage := NewStorage()
+			storage := NewStorage(nil)
 			read, err := storage.Read(ctx, qbtypes.QueryInfo{StartNs: uint64(time.Date(2024, 6, 1, 0, 0, 0, 0, time.UTC).UnixNano()), EndNs: uint64(time.Date(2024, 6, 5, 0, 0, 0, 0, time.UTC).UnixNano())}, &tc.key)
 
 			if tc.expectedError != nil {
@@ -234,7 +234,7 @@ func TestFieldForResourceWithEvolution(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			storage := NewStorage()
+			storage := NewStorage(nil)
 			read, err := storage.Read(ctx, qbtypes.QueryInfo{StartNs: tc.tsStart, EndNs: tc.tsEnd}, &tc.key)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expectedResult, read.SQL)
@@ -294,7 +294,7 @@ func TestColumnExpressionForTemporalColumn(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			storage := NewStorage()
+			storage := NewStorage(nil)
 			result, err := querybuilder.ResolveColumn(ctx, qbtypes.QueryInfo{StartNs: tsStart, EndNs: tsEnd}, storage, &tc.key, tc.requiredDataType, nil)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expectedResult, result)
@@ -322,7 +322,7 @@ func TestColumnExpressionForTimestampAttributeCollision(t *testing.T) {
 		},
 	}
 
-	storage := NewStorage()
+	storage := NewStorage(nil)
 
 	t.Run("bare timestamp resolves to the intrinsic column alone", func(t *testing.T) {
 		bare := telemetrytypes.TelemetryFieldKey{Name: "timestamp"}
@@ -431,7 +431,7 @@ func TestColumnExpressionForScopeDeclaredPath(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			storage := NewStorage()
+			storage := NewStorage(nil)
 			result, err := querybuilder.ResolveColumn(ctx, qbtypes.QueryInfo{}, storage, &tc.key, telemetrytypes.FieldDataTypeUnspecified, tc.keys)
 			require.NoError(t, err)
 			assert.Equal(t, tc.expectedResult, result)

pkg/types/telemetrytypes/evolution_metadata.go

@@ -4,6 +4,8 @@ import (
 	"time"
 )
 
+const EvolutionFieldNameAll = "__all__"
+
 type EvolutionEntry struct {
 	Signal       Signal       `json:"signal"`
 	ColumnName   string       `json:"column_name"`

pkg/types/telemetrytypes/store.go

@@ -7,6 +7,10 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
+type SchemaMetadataStore interface {
+	GetBaseColumnEvolutions(ctx context.Context, signal Signal, fieldContext FieldContext) ([]*EvolutionEntry, error)
+}
+
 // MetadataStore is the interface for the telemetry metadata store.
 type MetadataStore interface {
 	// GetKeys returns a map of field keys types.TelemetryFieldKey by name, there can be multiple keys with the same name

pkg/types/telemetrytypes/telemetrytypestest/schema_metadata_store.go

@@ -0,0 +1,122 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package telemetrytypestest
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewMockSchemaMetadataStore creates a new instance of MockSchemaMetadataStore. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockSchemaMetadataStore(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockSchemaMetadataStore {
+	if helper, ok := t.(interface{ Helper() }); ok {
+		helper.Helper()
+	}
+
+	mock := &MockSchemaMetadataStore{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() {
+		if helper, ok := t.(interface{ Helper() }); ok {
+			helper.Helper()
+		}
+		mock.AssertExpectations(t)
+	})
+
+	return mock
+}
+
+// MockSchemaMetadataStore is an autogenerated mock type for the SchemaMetadataStore type
+type MockSchemaMetadataStore struct {
+	mock.Mock
+}
+
+type MockSchemaMetadataStore_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockSchemaMetadataStore) EXPECT() *MockSchemaMetadataStore_Expecter {
+	return &MockSchemaMetadataStore_Expecter{mock: &_m.Mock}
+}
+
+// GetBaseColumnEvolutions provides a mock function for the type MockSchemaMetadataStore
+func (_mock *MockSchemaMetadataStore) GetBaseColumnEvolutions(ctx context.Context, signal telemetrytypes.Signal, fieldContext telemetrytypes.FieldContext) ([]*telemetrytypes.EvolutionEntry, error) {
+	ret := _mock.Called(ctx, signal, fieldContext)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetBaseColumnEvolutions")
+	}
+
+	var r0 []*telemetrytypes.EvolutionEntry
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, telemetrytypes.Signal, telemetrytypes.FieldContext) ([]*telemetrytypes.EvolutionEntry, error)); ok {
+		return returnFunc(ctx, signal, fieldContext)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, telemetrytypes.Signal, telemetrytypes.FieldContext) []*telemetrytypes.EvolutionEntry); ok {
+		r0 = returnFunc(ctx, signal, fieldContext)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]*telemetrytypes.EvolutionEntry)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, telemetrytypes.Signal, telemetrytypes.FieldContext) error); ok {
+		r1 = returnFunc(ctx, signal, fieldContext)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// MockSchemaMetadataStore_GetBaseColumnEvolutions_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetBaseColumnEvolutions'
+type MockSchemaMetadataStore_GetBaseColumnEvolutions_Call struct {
+	*mock.Call
+}
+
+// GetBaseColumnEvolutions is a helper method to define mock.On call
+//   - ctx context.Context
+//   - signal telemetrytypes.Signal
+//   - fieldContext telemetrytypes.FieldContext
+func (_e *MockSchemaMetadataStore_Expecter) GetBaseColumnEvolutions(ctx any, signal any, fieldContext any) *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call {
+	return &MockSchemaMetadataStore_GetBaseColumnEvolutions_Call{Call: _e.mock.On("GetBaseColumnEvolutions", ctx, signal, fieldContext)}
+}
+
+func (_c *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call) Run(run func(ctx context.Context, signal telemetrytypes.Signal, fieldContext telemetrytypes.FieldContext)) *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 telemetrytypes.Signal
+		if args[1] != nil {
+			arg1 = args[1].(telemetrytypes.Signal)
+		}
+		var arg2 telemetrytypes.FieldContext
+		if args[2] != nil {
+			arg2 = args[2].(telemetrytypes.FieldContext)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call) Return(evolutionEntrys []*telemetrytypes.EvolutionEntry, err error) *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call {
+	_c.Call.Return(evolutionEntrys, err)
+	return _c
+}
+
+func (_c *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call) RunAndReturn(run func(ctx context.Context, signal telemetrytypes.Signal, fieldContext telemetrytypes.FieldContext) ([]*telemetrytypes.EvolutionEntry, error)) *MockSchemaMetadataStore_GetBaseColumnEvolutions_Call {
+	_c.Call.Return(run)
+	return _c
+}

tests/conftest.py

@@ -88,6 +88,12 @@ def pytest_addoption(parser: pytest.Parser):
         default=False,
         help="Build and run with web. Run pytest --basetemp=./tmp/ -vv --with-web src/bootstrap/setup::test_setup to setup your local dev environment with web.",
     )
+    parser.addoption(
+        "--prebuilt-signoz",
+        action="store_true",
+        default=False,
+        help="Run the signoz:integration image already in the local image store instead of building it. The image must be built with ZEUSURL=http://zeus:8080.",
+    )
     parser.addoption(
         "--sqlstore-provider",
         action="store",

tests/e2e/affected.json

@@ -0,0 +1,54 @@
+{
+	"alerts": [
+		"frontend/src/pages/AlertList",
+		"frontend/src/pages/CreateAlert",
+		"frontend/src/pages/EditRules",
+		"frontend/src/pages/LogsModulePage",
+		"frontend/src/pages/TracesModulePage"
+	],
+	"dashboards": [
+		"frontend/src/pages/DashboardsListPage",
+		"frontend/src/pages/DashboardPage",
+		"frontend/src/pages/HomePage",
+		"frontend/src/pages/LogsModulePage"
+	],
+	"llm-o11y": ["frontend/src/pages/LLMObservability"],
+	"logs-explorer": ["frontend/src/pages/LogsModulePage"],
+	"query-builder": ["frontend/src/pages/LogsModulePage"],
+	"quick-filters": ["frontend/src/pages/LogsModulePage"],
+	"sso": ["frontend/src/pages/Login", "frontend/src/pages/Settings"],
+	"trace-details": ["frontend/src/pages/TraceDetailsV3"],
+	"@smoke": [
+		"frontend/src/modules/Servicemap",
+		"frontend/src/modules/Usage",
+		"frontend/src/pages/AIAssistantPage",
+		"frontend/src/pages/AllErrors",
+		"frontend/src/pages/ApiMonitoring",
+		"frontend/src/pages/Celery",
+		"frontend/src/pages/ErrorBoundaryFallback",
+		"frontend/src/pages/ErrorDetails",
+		"frontend/src/pages/ForgotPassword",
+		"frontend/src/pages/InfrastructureMonitoring",
+		"frontend/src/pages/IntegrationsDetailsPage",
+		"frontend/src/pages/IntegrationsModulePage",
+		"frontend/src/pages/License",
+		"frontend/src/pages/LogsSettings",
+		"frontend/src/pages/MessagingQueues",
+		"frontend/src/pages/MeterExplorer",
+		"frontend/src/pages/MetricsApplication",
+		"frontend/src/pages/MetricsExplorer",
+		"frontend/src/pages/OnboardingPageV2",
+		"frontend/src/pages/OrgOnboarding",
+		"frontend/src/pages/PublicDashboard",
+		"frontend/src/pages/ResetPassword",
+		"frontend/src/pages/ServiceTopLevelOperations",
+		"frontend/src/pages/Services",
+		"frontend/src/pages/SignUp",
+		"frontend/src/pages/Status",
+		"frontend/src/pages/Support",
+		"frontend/src/pages/UnAuthorized",
+		"frontend/src/pages/WorkspaceAccessRestricted",
+		"frontend/src/pages/WorkspaceLocked",
+		"frontend/src/pages/WorkspaceSuspended"
+	]
+}

tests/e2e/package.json

@@ -12,6 +12,10 @@
     "env:clean": "rm -rf ../tmp ../.pytest_cache .env.local artifacts && echo 'Cleaned. Run docker container prune if needed.'",
     "test": "playwright test",
     "test:local": "pnpm env:start && pnpm test",
+    "test:smoke": "playwright test --project=chromium --grep @smoke",
+    "plan": "node scripts/plan.mjs",
+    "test:scripts": "node scripts/affected.test.mjs",
+    "durations": "node scripts/durations.mjs",
     "test:staging": "SIGNOZ_E2E_BASE_URL=https://app.us.staging.signoz.cloud playwright test",
     "test:ui": "playwright test --ui",
     "test:headed": "playwright test --headed",

tests/e2e/scripts/affected.mjs

@@ -0,0 +1,190 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import ts from 'typescript';
+
+import { E2E_DIR, REPO_DIR } from './utils.mjs';
+
+const FEATURES = Object.entries(
+	JSON.parse(fs.readFileSync(path.join(E2E_DIR, 'affected.json'), 'utf8')),
+);
+export const FEATURE_NAMES = FEATURES.map(([feature]) => feature);
+const ROUTER = path.join(REPO_DIR, 'frontend/src/AppRoutes/pageComponents.ts');
+const ENTRY = path.join(REPO_DIR, 'frontend/src/index.tsx');
+const SPECS_DIR = path.join(E2E_DIR, 'tests');
+const E2E_SOURCE = /^tests\/e2e\/(tests|drivers|helpers|fixtures)\/.+\.ts$/;
+const SOURCE = /\.[cm]?[jt]sx?$/;
+const IGNORED = [
+	/\.md$/,
+	/^docs\//,
+	/^tests\/integration\//,
+	/^frontend\/\.(storybook|husky)\//,
+	/^frontend\/src\/(storybook|mocks-server)\//,
+	/^frontend\/(.*\/)?(__tests__|__mocks__)\//,
+	/^frontend\/.*\.(test|spec|stories)\.[jt]sx?$/,
+];
+
+const isIgnored = (file) => IGNORED.some((pattern) => pattern.test(file));
+const relative = (file) => path.relative(REPO_DIR, file);
+const isUnder = (file, root) =>
+	file === root || file.startsWith(`${root}/`) || file.startsWith(`${root}.`);
+
+function importersOf(tsconfigPath) {
+	const { config } = ts.readConfigFile(tsconfigPath, (file) =>
+		ts.sys.readFile(file),
+	);
+	const { options, fileNames } = ts.parseJsonConfigFileContent(
+		config,
+		ts.sys,
+		path.dirname(tsconfigPath),
+	);
+	const cache = ts.createModuleResolutionCache(
+		path.dirname(tsconfigPath),
+		(name) => name,
+		options,
+	);
+	const aliases = Object.entries(options.paths ?? {});
+	const aliasBase = options.pathsBasePath ?? path.dirname(tsconfigPath);
+
+	const resolve = (specifier, from) => {
+		const { resolvedModule } = ts.resolveModuleName(
+			specifier,
+			from,
+			options,
+			ts.sys,
+			cache,
+		);
+		if (resolvedModule) {
+			return resolvedModule.isExternalLibraryImport
+				? undefined
+				: path.resolve(resolvedModule.resolvedFileName);
+		}
+		// TypeScript resolves only modules, so styles and assets are matched here.
+		const candidates = specifier.startsWith('.')
+			? [path.resolve(path.dirname(from), specifier)]
+			: aliases.flatMap(([pattern, targets]) => {
+					const prefix = pattern.replace(/\*$/, '');
+					const matches = pattern.endsWith('*')
+						? specifier.startsWith(prefix)
+						: specifier === pattern;
+					return matches
+						? targets.map((target) =>
+								path.resolve(
+									aliasBase,
+									target.replace('*', specifier.slice(prefix.length)),
+								),
+							)
+						: [];
+				});
+		return candidates.find((candidate) =>
+			fs.statSync(candidate, { throwIfNoEntry: false })?.isFile(),
+		);
+	};
+
+	const importers = new Map();
+	for (const file of fileNames) {
+		const { importedFiles } = ts.preProcessFile(
+			fs.readFileSync(file, 'utf8'),
+			true,
+			true,
+		);
+		for (const { fileName } of importedFiles) {
+			const target = resolve(fileName, file);
+			if (target) {
+				if (!importers.has(target)) {
+					importers.set(target, new Set());
+				}
+				importers.get(target).add(path.resolve(file));
+			}
+		}
+	}
+	return importers;
+}
+
+// Walks importers up from `start`. `tops` are files nothing imports; `routes`
+// are files imported straight by the router.
+function climb(start, importers, isRouter) {
+	const seen = new Set([start]);
+	const queue = [start];
+	const tops = [];
+	const routes = [];
+	while (queue.length) {
+		const file = queue.pop();
+		const parents = importers.get(file) ?? new Set();
+		if (!parents.size) {
+			tops.push(file);
+		}
+		for (const parent of parents) {
+			if (isRouter(parent)) {
+				routes.push(file);
+			} else if (!seen.has(parent)) {
+				seen.add(parent);
+				queue.push(parent);
+			}
+		}
+	}
+	return { tops, routes };
+}
+
+// Spec files and feature folders a change can affect. `all` is set when any
+// changed file can't be traced to them.
+export function affected(changedFiles) {
+	const reasons = [];
+	const features = new Set();
+	const specs = new Set();
+	let frontend;
+	let e2e;
+
+	for (const changed of changedFiles) {
+		const file = path.join(REPO_DIR, changed);
+		// A deleted module or style's importers are in the change as well.
+		const isDeletedImport =
+			!fs.existsSync(file) &&
+			(SOURCE.test(changed) || changed.startsWith('frontend/src/'));
+		if (isIgnored(changed) || isDeletedImport) {
+			continue;
+		}
+		if (changed.startsWith('frontend/')) {
+			frontend ??= importersOf(path.join(REPO_DIR, 'frontend/tsconfig.json'));
+			const { tops, routes } = climb(
+				file,
+				frontend,
+				(parent) => parent === ROUTER,
+			);
+			// Other tops are dead code, tests or stories. A file outside the module
+			// graph (config, lockfile, public asset, scss partial) is never traced.
+			const isModule = SOURCE.test(changed) && changed.startsWith('frontend/src/');
+			if (tops.includes(ENTRY)) {
+				reasons.push(`${changed} reaches the app shell`);
+			} else if (tops.includes(file) && !isModule) {
+				reasons.push(`${changed} has no importer`);
+			}
+			for (const route of routes) {
+				const matched = FEATURES.filter(([, roots]) =>
+					roots.some((root) => isUnder(relative(route), root)),
+				);
+				if (!matched.length) {
+					reasons.push(`${changed} reaches ${relative(route)}, unmapped`);
+				}
+				matched.forEach(([feature]) => features.add(feature));
+			}
+		} else if (E2E_SOURCE.test(changed)) {
+			e2e ??= importersOf(path.join(E2E_DIR, 'tsconfig.json'));
+			for (const top of climb(file, e2e, () => false).tops) {
+				if (top.startsWith(`${SPECS_DIR}/`)) {
+					specs.add(path.relative(SPECS_DIR, top));
+				} else {
+					reasons.push(`${changed} reaches ${relative(top)}`);
+				}
+			}
+		} else {
+			reasons.push(`${changed} is not traced`);
+		}
+	}
+
+	return {
+		all: reasons.length > 0,
+		reasons,
+		features: [...features].sort((a, b) => a.localeCompare(b)),
+		specs: [...specs].sort((a, b) => a.localeCompare(b)),
+	};
+}

tests/e2e/scripts/affected.test.mjs

@@ -0,0 +1,34 @@
+import assert from 'node:assert/strict';
+
+import { affected } from './affected.mjs';
+
+assert.deepEqual(
+	affected(['frontend/src/pages/AlertList/index.tsx']).features,
+	['alerts'],
+	'a page change selects the features mapped to its route',
+);
+
+for (const file of [
+	'frontend/.storybook/preview.tsx',
+	'docs/api/openapi.yml',
+]) {
+	assert.deepEqual(
+		affected([file]),
+		{ all: false, reasons: [], features: [], specs: [] },
+		`${file} selects nothing`,
+	);
+}
+
+assert.deepEqual(
+	affected(['tests/e2e/helpers/sso.ts']).specs,
+	['sso/auth-domains.spec.ts'],
+	'a helper change selects the specs that import it',
+);
+
+for (const file of [
+	'frontend/pnpm-lock.yaml',
+	'frontend/src/index.tsx',
+	'pkg/signoz/signoz.go',
+]) {
+	assert.equal(affected([file]).all, true, `${file} runs everything`);
+}

tests/e2e/scripts/durations.mjs

@@ -0,0 +1,125 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+
+import { E2E_DIR, listTests, median, REPO_DIR, testKey } from './utils.mjs';
+
+// Reads reports already downloaded into `dir` when given; otherwise downloads
+// the Playwright artifacts of the last green e2eci runs.
+const { values: options, positionals } = parseArgs({
+	options: { runs: { type: 'string', default: '10' } },
+	allowPositionals: true,
+});
+
+const gh = (...args) =>
+	execFileSync('gh', args, {
+		cwd: REPO_DIR,
+		stdio: ['ignore', 'pipe', 'inherit'],
+	})
+		.toString()
+		.trim();
+
+const dir =
+	positionals[0] ?? fs.mkdtempSync(path.join(os.tmpdir(), 'e2e-durations-'));
+if (!positionals[0]) {
+	const runIds = gh(
+		'run',
+		'list',
+		'--workflow',
+		'e2eci.yaml',
+		'--status',
+		'success',
+		'--limit',
+		options.runs,
+		'--json',
+		'databaseId',
+		'--jq',
+		'.[].databaseId',
+	).split('\n');
+	for (const runId of runIds) {
+		try {
+			gh(
+				'run',
+				'download',
+				runId,
+				'--pattern',
+				'playwright-artifacts-*',
+				'--dir',
+				path.join(dir, runId),
+			);
+		} catch {
+			console.warn(`Skipped run ${runId}: its artifacts did not download.`);
+		}
+	}
+}
+
+const samples = new Map();
+const reports = fs
+	.readdirSync(dir, { recursive: true })
+	.filter((file) => file.endsWith('results.json'));
+for (const report of reports) {
+	const walk = (suite, titles) => {
+		for (const spec of suite.specs ?? []) {
+			for (const test of spec.tests) {
+				if (test.projectName !== 'chromium' || !test.results.length) {
+					continue;
+				}
+				const key = testKey({ file: spec.file, titles: [...titles, spec.title] });
+				const sample = samples.get(key) ?? { first: [], flaky: 0 };
+				sample.first.push(test.results[0].duration);
+				sample.flaky += test.status === 'flaky' ? 1 : 0;
+				samples.set(key, sample);
+			}
+		}
+		for (const child of suite.suites ?? []) {
+			walk(child, [...titles, child.title]);
+		}
+	};
+	for (const fileSuite of JSON.parse(fs.readFileSync(path.join(dir, report)))
+		.suites) {
+		walk(fileSuite, []);
+	}
+}
+if (!positionals[0]) {
+	fs.rmSync(dir, { recursive: true, force: true });
+}
+
+const durations = {};
+for (const key of listTests()
+	.map(testKey)
+	.sort((a, b) => a.localeCompare(b))) {
+	const sample = samples.get(key);
+	if (sample) {
+		durations[key] = {
+			ms: Math.round(median(sample.first)),
+			runs: sample.first.length,
+			flaky: sample.flaky,
+		};
+	}
+}
+fs.writeFileSync(
+	path.join(E2E_DIR, 'durations.json'),
+	`${JSON.stringify(durations, null, '\t')}\n`,
+);
+
+const entries = Object.entries(durations);
+const describe = ([key, { ms, runs, flaky }]) =>
+	`  ${(ms / 1000).toFixed(1).padStart(5)} s  ${flaky}/${runs} flaky  ${key}`;
+process.stdout.write(
+	[
+		`${entries.length} tests from ${reports.length} reports.`,
+		'Slowest:',
+		...entries
+			.sort((a, b) => b[1].ms - a[1].ms)
+			.slice(0, 10)
+			.map(describe),
+		'Flaky:',
+		...entries
+			.filter(([, { flaky }]) => flaky)
+			.sort((a, b) => b[1].flaky / b[1].runs - a[1].flaky / a[1].runs)
+			.map(describe),
+		'',
+	].join('\n'),
+);

tests/e2e/scripts/plan.mjs

@@ -0,0 +1,161 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+
+import { affected, FEATURE_NAMES } from './affected.mjs';
+import { E2E_DIR, listTests, median, REPO_DIR, testKey } from './utils.mjs';
+
+// Matches `workers` in playwright.config.ts on CI.
+const WORKERS = 2;
+
+const { values: options } = parseArgs({
+	options: {
+		all: { type: 'boolean', default: false },
+		out: { type: 'string', default: 'artifacts/plan' },
+		'max-shards': { type: 'string', default: '8' },
+		'shard-minutes': { type: 'string', default: '4' },
+	},
+});
+
+function changedFiles() {
+	if (!process.stdin.isTTY) {
+		return fs.readFileSync(0, 'utf8').split('\n').filter(Boolean);
+	}
+	const git = (...args) =>
+		execFileSync('git', args, { cwd: REPO_DIR })
+			.toString()
+			.split('\n')
+			.filter(Boolean);
+	const [base] = git('merge-base', 'origin/main', 'HEAD');
+	return [
+		...git('diff', '--name-only', base),
+		...git('ls-files', '--others', '--exclude-standard'),
+	];
+}
+
+const traced = options.all
+	? { all: true, reasons: ['--all'], features: [], specs: [] }
+	: affected(changedFiles());
+const tests = listTests();
+// A spec folder the map does not name would never run for a page change.
+const unmapped = [
+	...new Set(
+		tests
+			.filter((test) => !test.tags.includes('@smoke'))
+			.map((test) => test.file.split('/')[0]),
+	),
+].filter((folder) => !FEATURE_NAMES.includes(folder));
+const reasons = [
+	...traced.reasons,
+	...(traced.features.length || traced.specs.length
+		? unmapped.map(
+				(folder) => `tests/e2e/tests/${folder}/ has no entry in affected.json`,
+			)
+		: []),
+];
+const selection = { ...traced, all: reasons.length > 0, reasons };
+const chosen = new Set(
+	tests.filter(
+		(test) =>
+			selection.all ||
+			selection.specs.includes(test.file) ||
+			selection.features.includes(test.file.split('/')[0]),
+	),
+);
+if (chosen.size || selection.features.length || selection.specs.length) {
+	tests
+		.filter((test) => test.tags.includes('@smoke'))
+		.forEach((test) => chosen.add(test));
+}
+
+// A flaky test is expected to cost one extra attempt per flaky run.
+const durations = JSON.parse(
+	fs.readFileSync(path.join(E2E_DIR, 'durations.json'), 'utf8'),
+);
+const fallbackMs =
+	median(Object.values(durations).map((duration) => duration.ms)) || 30_000;
+const cost = (test) => {
+	const duration = durations[testKey(test)];
+	return duration
+		? duration.ms * (1 + duration.flaky / duration.runs)
+		: fallbackMs;
+};
+
+// Files stay whole so serial groups and worker-scoped seeds stay on one shard.
+const files = new Map();
+for (const test of chosen) {
+	const file = files.get(test.file) ?? { tests: [], ms: 0 };
+	file.tests.push(test);
+	file.ms += cost(test);
+	files.set(test.file, file);
+}
+const totalMs = [...files.values()].reduce((sum, file) => sum + file.ms, 0);
+const shardMs = Number(options['shard-minutes']) * 60_000 * WORKERS;
+const shardCount = files.size
+	? Math.min(Number(options['max-shards']), Math.ceil(totalMs / shardMs))
+	: 0;
+
+const shards = Array.from({ length: shardCount }, () => ({ ms: 0, tests: [] }));
+for (const file of [...files.values()].sort((a, b) => b.ms - a.ms)) {
+	const shard = shards.reduce((least, next) =>
+		next.ms < least.ms ? next : least,
+	);
+	shard.ms += file.ms;
+	shard.tests.push(...file.tests);
+}
+
+const out = path.resolve(E2E_DIR, options.out);
+fs.rmSync(out, { recursive: true, force: true });
+fs.mkdirSync(out, { recursive: true });
+shards.forEach((shard, index) => {
+	fs.writeFileSync(
+		path.join(out, `shard-${index + 1}.txt`),
+		shard.tests
+			.map((test) => `[chromium] › ${[test.file, ...test.titles].join(' › ')}`)
+			.join('\n') + '\n',
+	);
+});
+
+const minutes = (ms) => (ms / WORKERS / 60_000).toFixed(1);
+const scope = selection.all
+	? 'every spec'
+	: [...new Set([...selection.features, ...selection.specs, '@smoke'])].join(
+			', ',
+		);
+const summary = [
+	shardCount
+		? `**E2E plan:** ${chosen.size} of ${tests.length} tests on ${shardCount} shard${shardCount > 1 ? 's' : ''}, at most ${minutes(Math.max(...shards.map((shard) => shard.ms)))} min of tests per shard.`
+		: '**E2E plan:** no test reaches this change.',
+	shardCount ? `**Runs:** ${scope}` : '',
+	...selection.reasons
+		.slice(0, 5)
+		.map(
+			(reason, index) => `${index ? '' : '**Full suite because:** '}${reason}`,
+		),
+]
+	.filter(Boolean)
+	.join('\n\n');
+
+fs.writeFileSync(
+	path.join(out, 'plan.json'),
+	JSON.stringify(
+		{
+			...selection,
+			tests: chosen.size,
+			shards: shards.map((shard) => minutes(shard.ms)),
+		},
+		null,
+		'\t',
+	),
+);
+process.stdout.write(`${summary.replaceAll('**', '')}\n`);
+if (process.env.GITHUB_OUTPUT) {
+	fs.appendFileSync(
+		process.env.GITHUB_OUTPUT,
+		`shards=${JSON.stringify(shards.map((_, index) => index + 1))}\n`,
+	);
+}
+if (process.env.GITHUB_STEP_SUMMARY) {
+	fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${summary}\n`);
+}

tests/e2e/scripts/signoz-key.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo "e2e-signoz-$(git rev-parse HEAD:cmd HEAD:ee HEAD:pkg HEAD:go.mod HEAD:go.sum HEAD:.dockerignore HEAD:.github/workflows/cacheci.yml | sha256sum | cut -c1-32)"

tests/e2e/scripts/utils.mjs

@@ -0,0 +1,46 @@
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const E2E_DIR = path.resolve(
+	path.dirname(fileURLToPath(import.meta.url)),
+	'..',
+);
+export const REPO_DIR = path.resolve(E2E_DIR, '../..');
+
+export const testKey = ({ file, titles }) => [file, ...titles].join(' › ');
+
+export const median = (values) =>
+	values.length ? [...values].sort((a, b) => a - b)[values.length >> 1] : 0;
+
+export function listTests() {
+	const output = execFileSync(
+		path.join(E2E_DIR, 'node_modules/.bin/playwright'),
+		['test', '--list', '--project=chromium', '--reporter=json'],
+		{ cwd: E2E_DIR, maxBuffer: 64 * 1024 * 1024 },
+	);
+	const report = JSON.parse(output.toString());
+	if (report.errors?.length) {
+		throw new Error(report.errors.map((error) => error.message).join('\n'));
+	}
+	const tests = [];
+	const walk = (suite, titles) => {
+		for (const spec of suite.specs ?? []) {
+			if (spec.tests.some((test) => test.projectName === 'chromium')) {
+				tests.push({
+					file: spec.file,
+					titles: [...titles, spec.title],
+					// The JSON reporter drops the leading @.
+					tags: spec.tags.map((tag) => `@${tag}`),
+				});
+			}
+		}
+		for (const child of suite.suites ?? []) {
+			walk(child, [...titles, child.title]);
+		}
+	};
+	for (const fileSuite of report.suites) {
+		walk(fileSuite, []);
+	}
+	return tests;
+}

tests/e2e/tests/routing/guards.spec.ts

@@ -4,7 +4,7 @@ import { expect, PATH, test } from '../../drivers/routing';
 // told otherwise, which only shows when someone presses Back. Runs as `guest`:
 // an authenticated page would skip the chain under test.
 
-test.describe('Routing — auth guards', () => {
+test.describe('Routing — auth guards', { tag: '@smoke' }, () => {
 	test('TC-14 a deep-linked private route survives the login round trip', async ({
 		guest,
 	}) => {

tests/e2e/tests/routing/mount.spec.ts

@@ -2,7 +2,7 @@ import { expect, PATH, test } from '../../drivers/routing';
 
 // The shape of the router mount, which no other spec observes.
 
-test.describe('Routing: router mount', () => {
+test.describe('Routing: router mount', { tag: '@smoke' }, () => {
 	// Under a React transition the previous screen stays up instead of the
 	// Suspense fallback, so an uncached route renders no loader at all.
 	test('TC-18 an in-app navigation to an uncached route commits the Suspense fallback', async ({

tests/e2e/tests/routing/nav-blocker.spec.ts

@@ -16,47 +16,54 @@ test.describe.configure({ mode: 'serial' });
 const BLOCKED_ROLE_NAME = `routing-blocker-${uniqueAlphaSuffix()}`;
 const SAVED_ROLE_NAME = `routing-bypass-${uniqueAlphaSuffix()}`;
 
-test.describe('Routing — unsaved-changes navigation blocker', () => {
-	test.afterAll(async ({ browser }) => {
-		await onAdminPage(browser, (page) =>
-			routingDriver(page).roles.removeByName([BLOCKED_ROLE_NAME, SAVED_ROLE_NAME]),
-		);
-	});
+test.describe(
+	'Routing — unsaved-changes navigation blocker',
+	{ tag: '@smoke' },
+	() => {
+		test.afterAll(async ({ browser }) => {
+			await onAdminPage(browser, (page) =>
+				routingDriver(page).roles.removeByName([
+					BLOCKED_ROLE_NAME,
+					SAVED_ROLE_NAME,
+				]),
+			);
+		});
 
-	test('TC-16 a blocked navigation can be cancelled and then confirmed', async ({
-		routing,
-	}) => {
-		const { roles } = routing;
-		await roles.openCreateForm(BLOCKED_ROLE_NAME);
+		test('TC-16 a blocked navigation can be cancelled and then confirmed', async ({
+			routing,
+		}) => {
+			const { roles } = routing;
+			await roles.openCreateForm(BLOCKED_ROLE_NAME);
 
-		await roles.cancel();
-		await expect(roles.discardDialog()).toBeVisible();
+			await roles.cancel();
+			await expect(roles.discardDialog()).toBeVisible();
 
-		// Cancel drops the blocked transition rather than retrying it.
-		await roles
-			.discardDialog()
-			.getByRole('button', { name: 'Keep editing' })
-			.click();
-		await expect(roles.discardDialog()).toBeHidden();
-		expect(routing.url().pathname).toBe(PATH.roleCreate);
-		await expect(roles.nameInput()).toHaveValue(BLOCKED_ROLE_NAME);
+			// Cancel drops the blocked transition rather than retrying it.
+			await roles
+				.discardDialog()
+				.getByRole('button', { name: 'Keep editing' })
+				.click();
+			await expect(roles.discardDialog()).toBeHidden();
+			expect(routing.url().pathname).toBe(PATH.roleCreate);
+			await expect(roles.nameInput()).toHaveValue(BLOCKED_ROLE_NAME);
 
-		await roles.cancel();
-		await roles.discardDialog().getByRole('button', { name: 'Discard' }).click();
-		await routing.waitForPath(PATH.roles);
-	});
+			await roles.cancel();
+			await roles.discardDialog().getByRole('button', { name: 'Discard' }).click();
+			await routing.waitForPath(PATH.roles);
+		});
 
-	test('TC-17 saving bypasses the blocker for the next navigation', async ({
-		routing,
-	}) => {
-		const { roles } = routing;
-		await roles.openCreateForm(SAVED_ROLE_NAME);
+		test('TC-17 saving bypasses the blocker for the next navigation', async ({
+			routing,
+		}) => {
+			const { roles } = routing;
+			await roles.openCreateForm(SAVED_ROLE_NAME);
 
-		// `allowNextNavigation()` unarms the blocker for the push after a save.
-		await roles.save();
-		await routing.waitForPath(PATH.roles);
+			// `allowNextNavigation()` unarms the blocker for the push after a save.
+			await roles.save();
+			await routing.waitForPath(PATH.roles);
 
-		await expect(roles.discardDialog()).toHaveCount(0);
-		await expect(roles.settings()).toBeVisible();
-	});
-});
+			await expect(roles.discardDialog()).toHaveCount(0);
+			await expect(roles.settings()).toBeVisible();
+		});
+	},
+);

tests/e2e/tests/routing/navigation.spec.ts

@@ -3,7 +3,7 @@ import { dashboardListParams, expect, PATH, test } from '../../drivers/routing';
 // Imperative navigation: the `history.listen` counter behind `hasInAppHistory()`,
 // `useSafeNavigate`'s same-url suppression, and its `newTab` branch.
 
-test.describe('Routing — imperative navigation', () => {
+test.describe('Routing — imperative navigation', { tag: '@smoke' }, () => {
 	test('TC-05 Back from a detail page restores the list with its params', async ({
 		routing,
 		dashboard,

tests/e2e/tests/routing/route-matching.spec.ts

@@ -4,7 +4,7 @@ import { expect, PATH, test } from '../../drivers/routing';
 // `RouteTab`, `TopNav`'s per-route checks, and `SETTINGS`, a prefix route that
 // needs an explicit `/*` under v7.
 
-test.describe('Routing — route matching', () => {
+test.describe('Routing — route matching', { tag: '@smoke' }, () => {
 	test('TC-09 RouteTab switches the url and survives a reload', async ({
 		routing,
 	}) => {

tests/e2e/tests/routing/url-state.spec.ts

@@ -4,80 +4,84 @@ import { expect, PATH, test } from '../../drivers/routing';
 // to the History API with `history: 'push'`, while `relativeTime` is written by
 // the router through `useSafeNavigate`.
 
-test.describe('Routing — nuqs and router param coexistence', () => {
-	test('TC-01 a router write keeps the nuqs params it did not author', async ({
-		routing,
-		pods,
-	}) => {
-		await routing.k8s.goto({ relativeTime: '30m' });
+test.describe(
+	'Routing — nuqs and router param coexistence',
+	{ tag: '@smoke' },
+	() => {
+		test('TC-01 a router write keeps the nuqs params it did not author', async ({
+			routing,
+			pods,
+		}) => {
+			await routing.k8s.goto({ relativeTime: '30m' });
 
-		await routing.k8s.groupBy(pods.groupBy);
-		await routing.selectRelativeTime('1h');
-		await routing.waitForParam('relativeTime', '1h');
+			await routing.k8s.groupBy(pods.groupBy);
+			await routing.selectRelativeTime('1h');
+			await routing.waitForParam('relativeTime', '1h');
 
-		expect(routing.url().pathname).toBe(PATH.k8s);
-		expect(routing.params()).toMatchObject({
-			relativeTime: '1h',
-			category: 'pods',
-		});
-		expect(routing.params().groupBy).toContain(pods.groupBy);
-		await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
-	});
-
-	test('TC-02 a nuqs write keeps the relativeTime the router authored', async ({
-		routing,
-		pods,
-	}) => {
-		await routing.k8s.goto({ relativeTime: '30m' });
-
-		await routing.selectRelativeTime('6h');
-		await routing.waitForParam('relativeTime', '6h');
-
-		await routing.k8s.groupBy(pods.groupBy);
-
-		expect(routing.url().pathname).toBe(PATH.k8s);
-		expect(routing.params().relativeTime).toBe('6h');
-		expect(routing.params().groupBy).toContain(pods.groupBy);
-		await routing.expectRelativeTime('6h');
-	});
-
-	test('TC-03 POP across a nuqs push reverts both url and list', async ({
-		routing,
-		pods,
-	}) => {
-		await routing.k8s.goto({ relativeTime: '30m' });
-
-		// One flush, one entry: otherwise one Back lands on an intermediate url.
-		const depthBeforeGroupBy = await routing.historyDepth();
-		await routing.k8s.groupBy(pods.groupBy);
-		expect(await routing.historyDepth()).toBe(depthBeforeGroupBy + 1);
-		await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
-
-		await routing.goBack();
-		await routing.k8s.waitUntilGrouped(pods.groupBy, false);
-		expect(routing.url().pathname).toBe(PATH.k8s);
-		await expect(routing.k8s.groupBySelect()).not.toContainText(pods.groupBy);
-
-		await routing.goForward();
-		await routing.k8s.waitUntilGrouped(pods.groupBy);
-		await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
-	});
-
-	test('TC-04 a deep link carrying both families applies both on first paint', async ({
-		routing,
-		pods,
-	}) => {
-		await routing.k8s.goto({
-			relativeTime: '6h',
-			groupBy: JSON.stringify([pods.groupBy]),
+			expect(routing.url().pathname).toBe(PATH.k8s);
+			expect(routing.params()).toMatchObject({
+				relativeTime: '1h',
+				category: 'pods',
+			});
+			expect(routing.params().groupBy).toContain(pods.groupBy);
+			await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
 		});
 
-		// `k8s.goto` waited for the mount-time republish, so anything it dropped is
-		// missing by now.
-		expect(routing.url().pathname).toBe(PATH.k8s);
-		expect(routing.params().relativeTime).toBe('6h');
-		expect(routing.params().groupBy).toContain(pods.groupBy);
-		await routing.expectRelativeTime('6h');
-		await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
-	});
-});
+		test('TC-02 a nuqs write keeps the relativeTime the router authored', async ({
+			routing,
+			pods,
+		}) => {
+			await routing.k8s.goto({ relativeTime: '30m' });
+
+			await routing.selectRelativeTime('6h');
+			await routing.waitForParam('relativeTime', '6h');
+
+			await routing.k8s.groupBy(pods.groupBy);
+
+			expect(routing.url().pathname).toBe(PATH.k8s);
+			expect(routing.params().relativeTime).toBe('6h');
+			expect(routing.params().groupBy).toContain(pods.groupBy);
+			await routing.expectRelativeTime('6h');
+		});
+
+		test('TC-03 POP across a nuqs push reverts both url and list', async ({
+			routing,
+			pods,
+		}) => {
+			await routing.k8s.goto({ relativeTime: '30m' });
+
+			// One flush, one entry: otherwise one Back lands on an intermediate url.
+			const depthBeforeGroupBy = await routing.historyDepth();
+			await routing.k8s.groupBy(pods.groupBy);
+			expect(await routing.historyDepth()).toBe(depthBeforeGroupBy + 1);
+			await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
+
+			await routing.goBack();
+			await routing.k8s.waitUntilGrouped(pods.groupBy, false);
+			expect(routing.url().pathname).toBe(PATH.k8s);
+			await expect(routing.k8s.groupBySelect()).not.toContainText(pods.groupBy);
+
+			await routing.goForward();
+			await routing.k8s.waitUntilGrouped(pods.groupBy);
+			await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
+		});
+
+		test('TC-04 a deep link carrying both families applies both on first paint', async ({
+			routing,
+			pods,
+		}) => {
+			await routing.k8s.goto({
+				relativeTime: '6h',
+				groupBy: JSON.stringify([pods.groupBy]),
+			});
+
+			// `k8s.goto` waited for the mount-time republish, so anything it dropped is
+			// missing by now.
+			expect(routing.url().pathname).toBe(PATH.k8s);
+			expect(routing.params().relativeTime).toBe('6h');
+			expect(routing.params().groupBy).toContain(pods.groupBy);
+			await routing.expectRelativeTime('6h');
+			await expect(routing.k8s.groupBySelect()).toContainText(pods.groupBy);
+		});
+	},
+);

tests/fixtures/http.py

@@ -28,6 +28,8 @@ def zeus(
     def create() -> types.TestContainerDocker:
         container = WireMockContainer(image="wiremock/wiremock:2.35.1-1", secure=False)
         container.with_network(network)
+        # The zeus address in images built for --prebuilt-signoz.
+        container.with_network_aliases("zeus")
         container.start()
 
         return types.TestContainerDocker(

tests/fixtures/signoz.py

@@ -58,23 +58,24 @@ def create_signoz(
 
         # The docker CLI is required: the Dockerfiles use BuildKit cache
         # mounts, which docker-py does not support.
-        subprocess.run(
-            [
-                "docker",
-                "build",
-                "--file",
-                str(context / dockerfile_path),
-                "--tag",
-                "signoz:integration",
-                "--build-arg",
-                f"TARGETARCH={arch}",
-                "--build-arg",
-                f"ZEUSURL={zeus.container_configs['8080'].base()}",
-                str(context),
-            ],
-            check=True,
-            env=os.environ | {"DOCKER_BUILDKIT": "1"},
-        )
+        if not pytestconfig.getoption("--prebuilt-signoz"):
+            subprocess.run(
+                [
+                    "docker",
+                    "build",
+                    "--file",
+                    str(context / dockerfile_path),
+                    "--tag",
+                    "signoz:integration",
+                    "--build-arg",
+                    f"TARGETARCH={arch}",
+                    "--build-arg",
+                    f"ZEUSURL={zeus.container_configs['8080'].base()}",
+                    str(context),
+                ],
+                check=True,
+                env=os.environ | {"DOCKER_BUILDKIT": "1"},
+            )
 
         env = (
             {
@@ -92,6 +93,8 @@ def create_signoz(
                 "SIGNOZ_ALERTMANAGER_SIGNOZ_ROUTE_GROUP__WAIT": "1s",
                 "SIGNOZ_ALERTMANAGER_SIGNOZ_ROUTE_GROUP__INTERVAL": "5s",
                 "SIGNOZ_CLOUDINTEGRATION_AGENT_VERSION": "v0.0.8",
+                # tests reseed the attributes rollout row between cases
+                "SIGNOZ_QUERIER_SCHEMAMETADATASTORE_CACHE__TTL": "1ns",
             }
             | sqlstore.env
             | clickhouse.env

tests/integration/tests/queriermetrics/17_cache.py

@@ -442,51 +442,3 @@ def test_builder_refreshing_a_sliding_time_range(
     assert uncached.status_code == HTTPStatus.OK, uncached.text
 
     assert_results_equal(from_cache.json(), uncached.json(), "A", "the twentieth refresh")
-
-
-def test_builder_rows_scanned_when_refreshing(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_metrics: Callable[[list[Metrics]], None],
-) -> None:
-    metric_name = f"cache_rows_scanned_{uuid4().hex[:8]}"
-
-    # 90 minutes back so even the last refresh closes clear of the flux
-    # interval, which holds recent data out of the cache
-    start_time = datetime.fromtimestamp(int((datetime.now(tz=UTC) - timedelta(minutes=90)).timestamp()) // 60 * 60, tz=UTC)
-    start_time_ms = int(start_time.timestamp() * 1000)
-
-    query = [build_builder_query("A", metric_name, "max", "max")]
-
-    insert_metrics(
-        [
-            Metrics(
-                metric_name=metric_name,
-                labels={"service": "api"},
-                timestamp=start_time + timedelta(minutes=minute),
-                value=minute,
-                type_="Gauge",
-                is_monotonic=False,
-            )
-            for minute in range(70)
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # a dashboard left open on a one hour range, re-running a minute later each
-    # time. rowsScanned is what answering the request cost, so a refresh served
-    # mostly out of the cache cannot report more than reading its range afresh
-    for refresh in range(10):
-        refresh_start_ms = start_time_ms + refresh * MINUTE_MS
-        from_cache = make_query_request(signoz, token, refresh_start_ms, refresh_start_ms + 60 * MINUTE_MS, query, no_cache=False)
-        assert from_cache.status_code == HTTPStatus.OK, from_cache.text
-
-        uncached = make_query_request(signoz, token, refresh_start_ms, refresh_start_ms + 60 * MINUTE_MS, query, no_cache=True)
-        assert uncached.status_code == HTTPStatus.OK, uncached.text
-
-        rows_scanned_from_cache = from_cache.json()["data"]["meta"]["rowsScanned"]
-        rows_scanned_uncached = uncached.json()["data"]["meta"]["rowsScanned"]
-        assert rows_scanned_uncached > 0, f"refresh {refresh}"
-        assert rows_scanned_from_cache <= rows_scanned_uncached, f"refresh {refresh}: {rows_scanned_from_cache} rows scanned when served from the cache, {rows_scanned_uncached} when read afresh"

tests/integration/tests/queriertraces/13_attributes_json_evolution.py

@@ -13,8 +13,11 @@ from fixtures.querier import (
     build_aggregation,
     build_group_by_field,
     build_traces_scalar_query,
+    get_all_warnings,
+    get_preview_sql,
     get_rows,
     index_series_by_label,
+    make_preview_query_request,
     make_query_request,
 )
 from fixtures.traces import TraceIdGenerator, Traces
@@ -467,3 +470,79 @@ def test_traces_attributes_json_list_view(
         assert row["data"]["name"] == name
         # int/float compare equal in Python, so map-sourced float64 and JSON-sourced numbers both match.
         assert row["data"]["attributes"] == attributes, name
+
+
+def test_traces_attributes_json_unreported_key(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_traces: Callable[[list[Traces]], None],
+    seed_attribute_evolution: Callable[[str, datetime], None],
+) -> None:
+    """An attribute metadata does not report follows the rollout like a reported one: the legacy
+    map before it, the attributes JSON column after it."""
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    evolution_time = datetime.now(tz=UTC).replace(second=0, microsecond=0) - timedelta(minutes=30)
+    seed_attribute_evolution("traces", evolution_time)
+
+    before = evolution_time - timedelta(minutes=5)
+    after = evolution_time + timedelta(minutes=5)
+    spans = [
+        Traces(
+            timestamp=before,
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            name="before",
+            attributes={"unreported.key": "value"},
+            attribute_write_mode="legacy_only",
+        ),
+        Traces(
+            timestamp=after,
+            trace_id=TraceIdGenerator.trace_id(),
+            span_id=TraceIdGenerator.span_id(),
+            name="after",
+            attributes={"unreported.key": "value"},
+            attribute_write_mode="json_only",
+        ),
+    ]
+    # no metadata rows, so the querier does not know the key
+    for span in spans:
+        span.attribute_keys = []
+        span.tag_attributes = []
+    insert_traces(spans)
+
+    queries = [
+        build_traces_scalar_query(
+            aggregations=[build_aggregation("count()")],
+            filter_expression="unreported.key = 'value'",
+        )
+    ]
+
+    # before the rollout -> legacy map
+    start_ms = int((before - timedelta(minutes=1)).timestamp() * 1000)
+    end_ms = int((before + timedelta(minutes=1)).timestamp() * 1000)
+
+    sql = get_preview_sql(make_preview_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, queries=queries), "A")
+    assert "attributes_string['unreported.key']" in sql
+    assert "attributes.`unreported.key`" not in sql
+
+    response = make_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, queries=queries)
+    assert response.status_code == HTTPStatus.OK
+    series = response.json()["data"]["data"]["results"][0]["aggregations"][0]["series"]
+    assert [value["value"] for value in series[0]["values"]] == [1]
+    assert any("not found in metadata" in warning.get("message", "") for warning in get_all_warnings(response.json()))
+
+    # after the rollout -> attributes JSON column
+    start_ms = int((after - timedelta(minutes=1)).timestamp() * 1000)
+    end_ms = int((after + timedelta(minutes=1)).timestamp() * 1000)
+
+    sql = get_preview_sql(make_preview_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, queries=queries), "A")
+    assert "attributes.`unreported.key`" in sql
+    assert "attributes_string" not in sql
+
+    response = make_query_request(signoz, token, start_ms=start_ms, end_ms=end_ms, queries=queries)
+    assert response.status_code == HTTPStatus.OK
+    series = response.json()["data"]["data"]["results"][0]["aggregations"][0]["series"]
+    assert [value["value"] for value in series[0]["values"]] == [1]
+    assert any("not found in metadata" in warning.get("message", "") for warning in get_all_warnings(response.json()))

tests/integration/tests/ruler/08_authz.py

@@ -16,6 +16,7 @@ from fixtures.types import Operation, SigNoz, TestContainerDocker
 
 V2_RULES_URL = "/api/v2/rules"
 V3_RULES_URL = "/api/v3/rules"
+RULE_VIEWS_URL = "/api/v2/rule_views"
 DOWNTIME_URL = "/api/v1/downtime_schedules"
 ROUTE_POLICIES_URL = "/api/v1/route_policies"
 
@@ -28,6 +29,7 @@ _ACTOR_PASSWORD = "password123Z$"
 _ACTOR_ROLE_NAME = "alert-authz-actor"
 
 _TARGET_RULE = "alert authz target"
+_VIEW_NAME = "alert-authz-view"
 _DOWNTIME_NAME = "alert-authz-downtime"
 _ACTOR_DOWNTIME_NAME = "alert-authz-actor-downtime"
 _ROUTE_POLICY_NAME = "alert-authz-route-policy"
@@ -400,6 +402,45 @@ def test_viewer_allowed_on_downtime_reads_and_forbidden_on_writes(
     assert response.status_code == HTTPStatus.NO_CONTENT, response.text
 
 
+def test_viewer_allowed_on_rule_views(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{RULE_VIEWS_URL}/{view_id}"),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "asc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{RULE_VIEWS_URL}/{view_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
 def test_apply_license(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
@@ -506,6 +547,37 @@ def test_downtime_managed_role_tuples_enforced_with_license(
     assert response.status_code == HTTPStatus.NO_CONTENT, f"editor delete must pass on the migrated planned-maintenance delete tuple: {response.text}"
 
 
+def test_rule_view_managed_role_tuples_enforced_with_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    viewer_token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        headers={"Authorization": f"Bearer {viewer_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, f"viewer list must pass on the migrated rule list tuple: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {viewer_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, f"viewer create must pass, rule views are gated on rule list like dashboard views: {response.text}"
+    view_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{RULE_VIEWS_URL}/{view_id}"),
+        headers={"Authorization": f"Bearer {viewer_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"viewer delete must pass on the migrated rule list tuple: {response.text}"
+
+
 def test_setup_channel_scoped_actor(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument
@@ -630,6 +702,29 @@ def test_route_policy_channel_changes_follow_channel_attach_and_detach(
     assert response.status_code == HTTPStatus.NO_CONTENT, response.text
 
 
+def test_rule_views_forbidden_without_rule_list(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(RULE_VIEWS_URL),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+
+
 def test_downtime_naming_rule_forbidden_without_rule_attach(
     signoz: SigNoz,
     create_user_admin: Operation,  # pylint: disable=unused-argument