Merge branch 'main' into issue_4501

docs/api/openapi.yml

@@ -2559,7 +2559,6 @@ components:
       - factor-api-key
       - license
       - subscription
-      - deployment-host
       - logs
       - traces
       - metrics
@@ -22950,6 +22949,73 @@ paths:
       summary: Rotate session
       tags:
       - sessions
+  /api/v2/system/dashboards/{name}:
+    get:
+      deprecated: false
+      description: Returns a dashboard SigNoz ships and owns, addressed by its stable
+        definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards
+        are read-only and upgraded through releases. The dashboard's own `name` field
+        carries a reserved prefix that the path segment must not include.
+      operationId: GetSystemDashboard
+      parameters:
+      - in: path
+        name: name
+        required: true
+        schema:
+          type: string
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/DashboardtypesGettableDashboardV2'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - dashboard:read
+      - tokenizer:
+        - dashboard:read
+      summary: Get system dashboard
+      tags:
+      - dashboard
   /api/v2/user_roles:
     post:
       deprecated: false
@@ -23943,9 +24009,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - deployment-host:list
+        - VIEWER
       - tokenizer:
-        - deployment-host:list
+        - VIEWER
       summary: Get host info from Zeus.
       tags:
       - zeus
@@ -23999,9 +24065,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - deployment-host:update
+        - ADMIN
       - tokenizer:
-        - deployment-host:update
+        - ADMIN
       summary: Put host in Zeus for a deployment.
       tags:
       - zeus

ee/modules/dashboard/impldashboard/module.go

@@ -276,6 +276,10 @@ func (module *module) GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UU
 	return module.pkgDashboardModule.GetV2(ctx, orgID, id)
 }
 
+func (module *module) GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
+	return module.pkgDashboardModule.GetByNameV2(ctx, orgID, name)
+}
+
 func (module *module) MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error) {
 	return module.pkgDashboardModule.MigrateV2(ctx, orgID, id)
 }
@@ -284,6 +288,10 @@ func (module *module) UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer
 	return module.pkgDashboardModule.UpdateV2(ctx, orgID, id, updatedBy, updatable)
 }
 
+func (module *module) UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error) {
+	return module.pkgDashboardModule.UpdateUnsafeV2(ctx, orgID, id, updatedBy, updatable)
+}
+
 func (module *module) PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, patch dashboardtypes.PatchableDashboardV2) (*dashboardtypes.DashboardV2, error) {
 	return module.pkgDashboardModule.PatchV2(ctx, orgID, id, updatedBy, patch)
 }

frontend/src/api/generated/services/dashboard/index.ts

@@ -46,6 +46,8 @@ import type {
 	GetPublicDashboardPathParameters,
 	GetPublicDashboardWidgetQueryRange200,
 	GetPublicDashboardWidgetQueryRangePathParameters,
+	GetSystemDashboard200,
+	GetSystemDashboardPathParameters,
 	ListDashboardViews200,
 	ListDashboardsForUserV2200,
 	ListDashboardsForUserV2Params,
@@ -2111,6 +2113,108 @@ export const invalidateGetPublicDashboardPanelQueryRangeV2 = async (
 	return queryClient;
 };
 
+/**
+ * Returns a dashboard SigNoz ships and owns, addressed by its stable definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards are read-only and upgraded through releases. The dashboard's own `name` field carries a reserved prefix that the path segment must not include.
+ * @summary Get system dashboard
+ */
+export const getSystemDashboard = (
+	{ name }: GetSystemDashboardPathParameters,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<GetSystemDashboard200>({
+		url: `/api/v2/system/dashboards/${name}`,
+		method: 'GET',
+		signal,
+	});
+};
+
+export const getGetSystemDashboardQueryKey = ({
+	name,
+}: GetSystemDashboardPathParameters) => {
+	return [`/api/v2/system/dashboards/${name}`] as const;
+};
+
+export const getGetSystemDashboardQueryOptions = <
+	TData = Awaited<ReturnType<typeof getSystemDashboard>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	{ name }: GetSystemDashboardPathParameters,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof getSystemDashboard>>,
+			TError,
+			TData
+		>;
+	},
+) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey =
+		queryOptions?.queryKey ?? getGetSystemDashboardQueryKey({ name });
+
+	const queryFn: QueryFunction<
+		Awaited<ReturnType<typeof getSystemDashboard>>
+	> = ({ signal }) => getSystemDashboard({ name }, signal);
+
+	return {
+		queryKey,
+		queryFn,
+		enabled: !!name,
+		...queryOptions,
+	} as UseQueryOptions<
+		Awaited<ReturnType<typeof getSystemDashboard>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type GetSystemDashboardQueryResult = NonNullable<
+	Awaited<ReturnType<typeof getSystemDashboard>>
+>;
+export type GetSystemDashboardQueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Get system dashboard
+ */
+
+export function useGetSystemDashboard<
+	TData = Awaited<ReturnType<typeof getSystemDashboard>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(
+	{ name }: GetSystemDashboardPathParameters,
+	options?: {
+		query?: UseQueryOptions<
+			Awaited<ReturnType<typeof getSystemDashboard>>,
+			TError,
+			TData
+		>;
+	},
+): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getGetSystemDashboardQueryOptions({ name }, options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary Get system dashboard
+ */
+export const invalidateGetSystemDashboard = async (
+	queryClient: QueryClient,
+	{ name }: GetSystemDashboardPathParameters,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getGetSystemDashboardQueryKey({ name }) },
+		options,
+	);
+
+	return queryClient;
+};
+
 /**
  * Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.
  * @summary List dashboards for the current user (v2)

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -2175,7 +2175,6 @@ export enum CoretypesKindDTO {
 	'factor-api-key' = 'factor-api-key',
 	license = 'license',
 	subscription = 'subscription',
-	'deployment-host' = 'deployment-host',
 	logs = 'logs',
 	traces = 'traces',
 	metrics = 'metrics',
@@ -12252,6 +12251,17 @@ export type RotateSession200 = {
 	status: string;
 };
 
+export type GetSystemDashboardPathParameters = {
+	name: string;
+};
+export type GetSystemDashboard200 = {
+	data: DashboardtypesGettableDashboardV2DTO;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
 export type CreateUserRole201 = {
 	data: TypesIdentifiableDTO;
 	/**

frontend/src/components/QueryBuilderV2/QueryBuilderV2.tsx

@@ -241,29 +241,28 @@ export const QueryBuilderV2 = memo(function QueryBuilderV2({
 						))
 					)}
 
-					{!showOnlyWhereClause &&
-						currentQuery.builder.queryFormulas?.length > 0 && (
-							<div className="qb-formulas-container">
-								{currentQuery.builder.queryFormulas.map((formula, index) => {
-									const query =
-										currentQuery.builder.queryData[index] ||
-										currentQuery.builder.queryData[0];
+					{!showOnlyWhereClause && currentQuery.builder.queryFormulas.length > 0 && (
+						<div className="qb-formulas-container">
+							{currentQuery.builder.queryFormulas.map((formula, index) => {
+								const query =
+									currentQuery.builder.queryData[index] ||
+									currentQuery.builder.queryData[0];
 
-									return (
-										<div key={formula.queryName} className="qb-formula">
-											<Formula
-												filterConfigs={filterConfigs}
-												query={query}
-												formula={formula}
-												index={index}
-												isAdditionalFilterEnable={false}
-												isQBV2
-											/>
-										</div>
-									);
-								})}
-							</div>
-						)}
+								return (
+									<div key={formula.queryName} className="qb-formula">
+										<Formula
+											filterConfigs={filterConfigs}
+											query={query}
+											formula={formula}
+											index={index}
+											isAdditionalFilterEnable={false}
+											isQBV2
+										/>
+									</div>
+								);
+							})}
+						</div>
+					)}
 
 					{shouldShowFooter && (
 						<QueryFooter
@@ -291,7 +290,7 @@ export const QueryBuilderV2 = memo(function QueryBuilderV2({
 							</div>
 						))}
 
-						{currentQuery.builder.queryFormulas?.map((formula) => (
+						{currentQuery.builder.queryFormulas.map((formula) => (
 							<div key={formula.queryName} className="formula-name">
 								{formula.queryName}
 							</div>

frontend/src/components/QueryBuilderV2/QueryV2/__tests__/QueryV2.test.tsx

@@ -212,32 +212,6 @@ describe('QueryBuilderV2 + QueryV2 - base render', () => {
 		expect(handleRunQueryMock).toHaveBeenCalled();
 	});
 
-	it('does not crash when builder.queryFormulas/queryTraceOperator are missing (partial/legacy query)', () => {
-		const currentQueryBase = baseQBContext.currentQuery as Query;
-
-		mockedUseQueryBuilder.mockReturnValue({
-			...baseQBContext,
-			currentQuery: {
-				...currentQueryBase,
-				builder: {
-					queryData: currentQueryBase.builder.queryData,
-					queryFormulas: undefined as unknown as [],
-					queryTraceOperator: undefined as unknown as [],
-				},
-			},
-		});
-
-		expect(() =>
-			render(<QueryBuilderV2 panelType={PANEL_TYPES.TABLE} version="v4" />),
-		).not.toThrow();
-
-		// query list still renders from queryData, formulas block is skipped
-		expect(document.querySelector('.query-names-section')).toBeInTheDocument();
-		expect(
-			document.querySelector('.qb-formulas-container'),
-		).not.toBeInTheDocument();
-	});
-
 	it('fx button is disabled when functions already exist', () => {
 		const currentQueryBase = baseQBContext.currentQuery as Query;
 		const supersetQueryBase = baseQBContext.supersetQuery as Query;

frontend/src/components/ServiceAccountDrawer/__tests__/ServiceAccountDrawer.authz.test.tsx

@@ -4,7 +4,7 @@ import {
 } from 'mocks-server/__mockdata__/roles';
 import { rest, server } from 'mocks-server/server';
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing';
-import { render, screen, waitFor } from 'tests/test-utils';
+import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
 import {
 	setupAuthzAdmin,
 	setupAuthzDeny,
@@ -110,7 +110,10 @@ describe('ServiceAccountDrawer — permissions', () => {
 	it('shows PermissionDeniedCallout in Keys tab when list-keys permission is denied', async () => {
 		server.use(setupAuthzDeny(APIKeyListPermission));
 
-		renderDrawer({ account: 'sa-1', tab: 'keys' });
+		renderDrawer();
+		await screen.findByDisplayValue('CI Bot');
+
+		fireEvent.click(screen.getByRole('radio', { name: /keys/i }));
 
 		await waitFor(() => {
 			expect(screen.getByText(/list:factor-api-key/)).toBeInTheDocument();

frontend/src/container/FormAlertRules/utils.ts

@@ -53,24 +53,17 @@ export const getUpdatedStepInterval = (evalWindow?: string): number => {
 };
 
 export const getSelectedQueryOptions = (
-	queries:
-		| Array<
-				| IBuilderQuery
-				| IBuilderTraceOperator
-				| IBuilderFormula
-				| IClickHouseQuery
-				| IPromQLQuery
-		  >
-		| undefined
-		| null,
-): SelectProps['options'] => {
-	if (!queries) {
-		return [];
-	}
-	return queries
+	queries: Array<
+		| IBuilderQuery
+		| IBuilderTraceOperator
+		| IBuilderFormula
+		| IClickHouseQuery
+		| IPromQLQuery
+	>,
+): SelectProps['options'] =>
+	queries
 		.filter((query) => !query.disabled)
 		.map((query) => ({
 			label: 'queryName' in query ? query.queryName : query.name,
 			value: 'queryName' in query ? query.queryName : query.name,
 		}));
-};

frontend/src/hooks/queryBuilder/useGetCompositeQueryParam.ts

@@ -27,14 +27,6 @@ export const useGetCompositeQueryParam = (): Query | null => {
 				decodeURIComponent(compositeQuery.replace(/\+/g, ' ')),
 			);
 
-			// Add default values for optional fields if empty
-			if (parsedCompositeQuery?.builder) {
-				parsedCompositeQuery.builder.queryFormulas =
-					parsedCompositeQuery.builder.queryFormulas ?? [];
-				parsedCompositeQuery.builder.queryTraceOperator =
-					parsedCompositeQuery.builder.queryTraceOperator ?? [];
-			}
-
 			// Convert old format to new format for each query in builder.queryData
 			if (parsedCompositeQuery?.builder?.queryData) {
 				parsedCompositeQuery.builder.queryData =

frontend/src/providers/QueryBuilder.tsx

@@ -163,23 +163,20 @@ export function QueryBuilderProvider({
 	const prepareQueryBuilderData = useCallback(
 		(query: Query): Query => {
 			const builder: QueryBuilderData = {
-				queryData:
-					query.builder.queryData?.map((item) => ({
-						...initialQueryBuilderFormValuesMap[
-							initialDataSource || DataSource.METRICS
-						],
-						...item,
-					})) ?? [],
-				queryFormulas:
-					query.builder.queryFormulas?.map((item) => ({
-						...initialFormulaBuilderFormValues,
-						...item,
-					})) ?? [],
-				queryTraceOperator:
-					query.builder.queryTraceOperator?.map((item) => ({
-						...initialQueryBuilderFormTraceOperatorValues,
-						...item,
-					})) ?? [],
+				queryData: query.builder.queryData?.map((item) => ({
+					...initialQueryBuilderFormValuesMap[
+						initialDataSource || DataSource.METRICS
+					],
+					...item,
+				})),
+				queryFormulas: query.builder.queryFormulas?.map((item) => ({
+					...initialFormulaBuilderFormValues,
+					...item,
+				})),
+				queryTraceOperator: query.builder.queryTraceOperator?.map((item) => ({
+					...initialQueryBuilderFormTraceOperatorValues,
+					...item,
+				})),
 			};
 
 			const setupedQueryData = builder.queryData.map((item) => {
@@ -212,17 +209,15 @@ export function QueryBuilderProvider({
 				return currentElement;
 			});
 
-			const promql: IPromQLQuery[] =
-				query.promql?.map((item) => ({
-					...initialQueryPromQLData,
-					...item,
-				})) ?? [];
+			const promql: IPromQLQuery[] = query.promql.map((item) => ({
+				...initialQueryPromQLData,
+				...item,
+			}));
 
-			const clickHouse: IClickHouseQuery[] =
-				query.clickhouse_sql?.map((item) => ({
-					...initialClickHouseData,
-					...item,
-				})) ?? [];
+			const clickHouse: IClickHouseQuery[] = query.clickhouse_sql.map((item) => ({
+				...initialClickHouseData,
+				...item,
+			}));
 
 			const newQueryState: QueryState = {
 				clickhouse_sql: clickHouse,

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -66,7 +66,6 @@
         "factor-api-key",
         "license",
         "subscription",
-        "deployment-host",
         "logs",
         "traces",
         "metrics",

pkg/apiserver/signozapiserver/provider.go

@@ -30,6 +30,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/user"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -80,6 +81,8 @@ type provider struct {
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
+	systemDashboardModule      systemdashboard.Module
+	systemDashboardHandler     systemdashboard.Handler
 }
 
 func NewFactory(
@@ -118,6 +121,8 @@ func NewFactory(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
+	systemDashboardModule systemdashboard.Module,
+	systemDashboardHandler systemdashboard.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
 	return factory.NewProviderFactory(factory.MustNewName("signoz"), func(ctx context.Context, providerSettings factory.ProviderSettings, config apiserver.Config) (apiserver.APIServer, error) {
 		return newProvider(
@@ -159,6 +164,8 @@ func NewFactory(
 			rulerHandler,
 			statsHandler,
 			savedViewHandler,
+			systemDashboardModule,
+			systemDashboardHandler,
 		)
 	})
 }
@@ -202,6 +209,8 @@ func newProvider(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
+	systemDashboardModule systemdashboard.Module,
+	systemDashboardHandler systemdashboard.Handler,
 ) (apiserver.APIServer, error) {
 	settings := factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/apiserver/signozapiserver")
 	router := mux.NewRouter().UseEncodedPath()
@@ -244,6 +253,8 @@ func newProvider(
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,
+		systemDashboardModule:      systemDashboardModule,
+		systemDashboardHandler:     systemDashboardHandler,
 	}
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
@@ -296,6 +307,10 @@ func (provider *provider) AddToRouter(router *mux.Router) error {
 		return err
 	}
 
+	if err := provider.addSystemDashboardRoutes(router); err != nil {
+		return err
+	}
+
 	if err := provider.addMetricsExplorerRoutes(router); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/systemdashboard.go

@@ -0,0 +1,63 @@
+package signozapiserver
+
+import (
+	"net/http"
+
+	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+)
+
+func (provider *provider) addSystemDashboardRoutes(router *mux.Router) error {
+	if err := router.Handle("/api/v2/system/dashboards/{name}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.systemDashboardHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetSystemDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Get system dashboard",
+			Description:         "Returns a dashboard SigNoz ships and owns, addressed by its stable definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards are read-only and upgraded through releases. The dashboard's own `name` field carries a reserved prefix that the path segment must not include.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       provider.systemDashboardID(),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// systemDashboardID resolves the {name} path param to the dashboard's id. Authz
+// tuples and audit records are written against ids, so the name has to be
+// resolved before either runs.
+func (provider *provider) systemDashboardID() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		ctx := ec.Request.Context()
+		claims, err := authtypes.ClaimsFromContext(ctx)
+		if err != nil {
+			return "", err
+		}
+
+		id, err := provider.systemDashboardModule.ResolveID(ctx, valuer.MustNewUUID(claims.OrgID), mux.Vars(ec.Request)["name"])
+		if err != nil {
+			return "", err
+		}
+
+		return id.StringValue(), nil
+	})
+}

pkg/apiserver/signozapiserver/zeus.go

@@ -5,8 +5,6 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/zeustypes"
 	"github.com/gorilla/mux"
 )
@@ -29,7 +27,7 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.CheckResources(provider.zeusHandler.GetHosts, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.ViewAccess(provider.zeusHandler.GetHosts), handler.OpenAPIDef{
 		ID:                  "GetHosts",
 		Tags:                []string{"zeus"},
 		Summary:             "Get host info from Zeus.",
@@ -41,17 +39,12 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDeploymentHost.Scope(coretypes.VerbList)}),
-	}, handler.WithResourceDefs(handler.BasicResourceDef{
-		Resource: coretypes.ResourceMetaResourceDeploymentHost,
-		Verb:     coretypes.VerbList,
-		Category: coretypes.ActionCategoryDataAccess,
-		Selector: coretypes.WildcardSelector,
-	}))).Methods(http.MethodGet).GetError(); err != nil {
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.CheckResources(provider.zeusHandler.PutHost, authtypes.SigNozAdminRoleName), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.AdminAccess(provider.zeusHandler.PutHost), handler.OpenAPIDef{
 		ID:                  "PutHost",
 		Tags:                []string{"zeus"},
 		Summary:             "Put host in Zeus for a deployment.",
@@ -63,14 +56,8 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusNoContent,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound, http.StatusConflict},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDeploymentHost.Scope(coretypes.VerbUpdate)}),
-	}, handler.WithResourceDefs(handler.BasicResourceDef{
-		Resource: coretypes.ResourceMetaResourceDeploymentHost,
-		Verb:     coretypes.VerbUpdate,
-		Category: coretypes.ActionCategoryConfigurationChange,
-		ID:       coretypes.BodyJSONPath("name"),
-		Selector: coretypes.WildcardSelector,
-	}))).Methods(http.MethodPut).GetError(); err != nil {
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 

pkg/modules/dashboard/dashboard.go

@@ -63,6 +63,8 @@ type Module interface {
 
 	GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error)
 
+	GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error)
+
 	// MigrateV2 retries the v1→v2 migration on a dashboard still stored in the v1 schema.
 	MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error)
 
@@ -72,6 +74,9 @@ type Module interface {
 
 	UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error)
 
+	// UpdateUnsafeV2 updates a dashboard bypassing the guards. Intended for internal system callers.
+	UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error)
+
 	LockUnlockV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, isAdmin bool, lock bool) error
 
 	PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, patch dashboardtypes.PatchableDashboardV2) (*dashboardtypes.DashboardV2, error)

pkg/modules/dashboard/impldashboard/store.go

@@ -64,6 +64,23 @@ func (store *store) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID)
 	return storableDashboard, nil
 }
 
+func (store *store) GetByName(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.StorableDashboard, error) {
+	storableDashboard := new(dashboardtypes.StorableDashboard)
+	err := store.
+		sqlstore.
+		BunDB().
+		NewSelect().
+		Model(storableDashboard).
+		Where("name = ?", name).
+		Where("org_id = ?", orgID).
+		Scan(ctx)
+	if err != nil {
+		return nil, store.sqlstore.WrapNotFoundErrf(err, errors.CodeNotFound, "dashboard with name %s doesn't exist", name)
+	}
+
+	return storableDashboard, nil
+}
+
 // ListForUser emits the joined dashboard ⨝ user_dashboard_preference query the
 // spec calls for. Aliases:
 //

pkg/modules/dashboard/impldashboard/v2_module.go

@@ -19,9 +19,12 @@ func (m *module) CreateV2(ctx context.Context, orgID valuer.UUID, createdBy stri
 		return nil, err
 	}
 
-	dashboard := postable.NewDashboardV2(orgID, createdBy, source)
+	dashboard, err := postable.NewDashboardV2(orgID, createdBy, source)
+	if err != nil {
+		return nil, err
+	}
 
-	err := m.store.RunInTx(ctx, func(ctx context.Context) error {
+	err = m.store.RunInTx(ctx, func(ctx context.Context) error {
 		resolvedTags, err := m.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, dashboard.ID, postable.Tags)
 		if err != nil {
 			return err
@@ -120,6 +123,20 @@ func (module *module) GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UU
 	return storable.ToDashboardV2(tags)
 }
 
+func (module *module) GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
+	storable, err := module.store.GetByName(ctx, orgID, name)
+	if err != nil {
+		return nil, err
+	}
+
+	tags, err := module.tagModule.ListForResource(ctx, orgID, coretypes.KindDashboard, storable.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	return storable.ToDashboardV2(tags)
+}
+
 // MigrateV2 retries the v1→v2 migration on a dashboard still stored as v1 (one the
 // bulk 103 migration skipped or failed). Idempotent: an already-v2 one is unchanged.
 func (module *module) MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error) {
@@ -179,13 +196,32 @@ func (module *module) UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer
 		return nil, err
 	}
 
-	err = module.store.RunInTx(ctx, func(ctx context.Context) error {
-		resolvedTags, err := module.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, id, updatable.Tags)
+	return module.updateV2(ctx, orgID, existing, updatedBy, updatable, existing.Update)
+}
+
+func (module *module) UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error) {
+	if err := updatable.Validate(); err != nil {
+		return nil, err
+	}
+
+	existing, err := module.GetV2(ctx, orgID, id)
+	if err != nil {
+		return nil, err
+	}
+
+	return module.updateV2(ctx, orgID, existing, updatedBy, updatable, existing.UpdateUnsafe)
+}
+
+// apply is existing.Update or existing.UpdateUnsafe, so the gated path keeps its
+// in-transaction checks and only UpdateUnsafeV2 skips them.
+func (module *module) updateV2(ctx context.Context, orgID valuer.UUID, existing *dashboardtypes.DashboardV2, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2, apply func(dashboardtypes.UpdatableDashboardV2, string, []*tagtypes.Tag) error) (*dashboardtypes.DashboardV2, error) {
+	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
+		resolvedTags, err := module.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, existing.ID, updatable.Tags)
 		if err != nil {
 			return err
 		}
 
-		err = existing.Update(updatable, updatedBy, resolvedTags)
+		err = apply(updatable, updatedBy, resolvedTags)
 		if err != nil {
 			return err
 		}

pkg/modules/organization/implorganization/setter.go

@@ -6,18 +6,20 @@ import (
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 type setter struct {
-	store        types.OrganizationStore
-	alertmanager alertmanager.Alertmanager
-	quickfilter  quickfilter.Module
+	store           types.OrganizationStore
+	alertmanager    alertmanager.Alertmanager
+	quickfilter     quickfilter.Module
+	systemDashboard systemdashboard.Module
 }
 
-func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module) organization.Setter {
-	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter}
+func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, systemDashboard systemdashboard.Module) organization.Setter {
+	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, systemDashboard: systemDashboard}
 }
 
 func (module *setter) Create(ctx context.Context, organization *types.Organization, createManagedRoles func(context.Context, valuer.UUID) error) error {
@@ -37,6 +39,10 @@ func (module *setter) Create(ctx context.Context, organization *types.Organizati
 		return err
 	}
 
+	if err := module.systemDashboard.Reconcile(ctx, organization.ID); err != nil {
+		return err
+	}
+
 	return nil
 }
 

pkg/modules/systemdashboard/implsystemdashboard/definitions.go

@@ -0,0 +1,45 @@
+package implsystemdashboard
+
+import (
+	"embed"
+	"io/fs"
+	"path"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
+)
+
+const definitionsRoot = "fs/definitions"
+
+//go:embed fs/definitions/*.json
+var definitionFiles embed.FS
+
+// NewRegistry parses every embedded definition. Definitions are build-time assets
+// validated by a test, so a failure here means the binary shipped broken JSON.
+func NewRegistry() (systemdashboardtypes.Registry, error) {
+	entries, err := fs.ReadDir(definitionFiles, definitionsRoot)
+	if err != nil {
+		return systemdashboardtypes.Registry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read system dashboard definitions")
+	}
+
+	definitions := make([]systemdashboardtypes.Definition, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+
+		file := path.Join(definitionsRoot, entry.Name())
+		raw, err := definitionFiles.ReadFile(file)
+		if err != nil {
+			return systemdashboardtypes.Registry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read %s", file)
+		}
+
+		definition, err := systemdashboardtypes.NewDefinition(raw)
+		if err != nil {
+			return systemdashboardtypes.Registry{}, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't parse %s", file)
+		}
+		definitions = append(definitions, definition)
+	}
+
+	return systemdashboardtypes.NewRegistry(definitions)
+}

pkg/modules/systemdashboard/implsystemdashboard/definitions_test.go

@@ -0,0 +1,20 @@
+package implsystemdashboard
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A schema migration cannot ship without updating the definitions: parsing them
+// runs the same validation a create goes through, at the current schemaVersion.
+func TestEmbeddedDefinitionsParseAtCurrentSchemaVersion(t *testing.T) {
+	registry, err := NewRegistry()
+	require.NoError(t, err)
+
+	// The frontend addresses the overview dashboard by this name.
+	_, ok := registry.Get(dashboardtypes.SystemDashboardNamePrefix + "ai-o11y-overview")
+	assert.True(t, ok)
+}

pkg/modules/systemdashboard/implsystemdashboard/fs/definitions/ai-o11y-overview.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "definition": {
+    "schemaVersion": "v6",
+    "name": "signoz---ai-o11y-overview",
+    "tags": [],
+    "spec": {
+      "display": {
+        "name": "AI Observability Overview",
+        "description": "Overview of LLM traffic. Panels ship in an upcoming release."
+      },
+      "variables": [],
+      "panels": {},
+      "layouts": []
+    }
+  }
+}

pkg/modules/systemdashboard/implsystemdashboard/handler.go

@@ -0,0 +1,48 @@
+package implsystemdashboard
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/http/render"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+)
+
+type handler struct {
+	module systemdashboard.Module
+}
+
+func NewHandler(module systemdashboard.Module) systemdashboard.Handler {
+	return &handler{module: module}
+}
+
+func (handler *handler) Get(rw http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
+	defer cancel()
+
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	name := mux.Vars(r)["name"]
+	if name == "" {
+		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "name is missing in the path"))
+		return
+	}
+
+	systemDashboard, err := handler.module.Get(ctx, valuer.MustNewUUID(claims.OrgID), name)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusOK, systemDashboard.ToGettableDashboardV2())
+}
+

pkg/modules/systemdashboard/implsystemdashboard/module.go

@@ -0,0 +1,151 @@
+package implsystemdashboard
+
+import (
+	"context"
+	"log/slog"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/modules/dashboard"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type module struct {
+	settings        factory.ScopedProviderSettings
+	store           systemdashboardtypes.Store
+	registry        systemdashboardtypes.Registry
+	dashboardModule dashboard.Module
+}
+
+func NewModule(
+	providerSettings factory.ProviderSettings,
+	store systemdashboardtypes.Store,
+	registry systemdashboardtypes.Registry,
+	dashboardModule dashboard.Module,
+) systemdashboard.Module {
+	return &module{
+		settings:        factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"),
+		store:           store,
+		registry:        registry,
+		dashboardModule: dashboardModule,
+	}
+}
+
+func (module *module) Reconcile(ctx context.Context, orgID valuer.UUID) error {
+	for _, definition := range module.registry.List() {
+		if err := module.reconcile(ctx, orgID, definition); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (module *module) reconcile(ctx context.Context, orgID valuer.UUID, definition systemdashboardtypes.Definition) error {
+	existing, err := module.dashboardModule.GetByNameV2(ctx, orgID, definition.Name())
+	if err != nil {
+		if !errors.Ast(err, errors.TypeNotFound) {
+			return err
+		}
+		return module.provision(ctx, orgID, definition)
+	}
+
+	// Anything but the provisioner in updated_by means a foreign write. Leave the
+	// row alone — never overwriting is the safe direction.
+	if existing.UpdatedBy != systemdashboardtypes.ProvisionerIdentity {
+		module.settings.Logger().WarnContext(ctx, "skipping system dashboard reconcile: last write was not by the provisioner", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()), slog.String("updated_by", existing.UpdatedBy))
+		return nil
+	}
+
+	state, err := module.store.Get(ctx, orgID, definition.Name())
+	if err != nil {
+		return err
+	}
+	// Only ever move forward: a downgrade must not rewrite the newer content.
+	if state.Version >= definition.Version {
+		return nil
+	}
+
+	return module.upgrade(ctx, orgID, existing.ID, definition)
+}
+
+// provision creates the dashboard and its state row in one transaction, so a
+// system dashboard can never exist without the version it was provisioned at.
+// A concurrent provisioner (another replica, or the org-creation hook racing the
+// startup sweep) loses on the state row's unique (org_id, name) index and rolls back.
+func (module *module) provision(ctx context.Context, orgID valuer.UUID, definition systemdashboardtypes.Definition) error {
+	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
+		created, err := module.dashboardModule.CreateV2(
+			ctx,
+			orgID,
+			systemdashboardtypes.ProvisionerIdentity,
+			valuer.UUID{},
+			dashboardtypes.SourceSystem,
+			definition.Dashboard,
+		)
+		if err != nil {
+			return err
+		}
+
+		return module.store.Create(ctx, systemdashboardtypes.NewStorableSystemDashboard(orgID, created.ID, definition.Name(), definition.Version))
+	})
+	if err != nil {
+		if errors.Ast(err, errors.TypeAlreadyExists) {
+			module.settings.Logger().DebugContext(ctx, "system dashboard already provisioned concurrently", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
+			return nil
+		}
+		return err
+	}
+
+	module.settings.Logger().InfoContext(ctx, "provisioned system dashboard", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
+	return nil
+}
+
+func (module *module) upgrade(ctx context.Context, orgID valuer.UUID, id valuer.UUID, definition systemdashboardtypes.Definition) error {
+	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
+		if _, err := module.dashboardModule.UpdateUnsafeV2(ctx, orgID, id, systemdashboardtypes.ProvisionerIdentity, definition.ToUpdatable()); err != nil {
+			return err
+		}
+
+		return module.store.UpdateVersion(ctx, orgID, definition.Name(), definition.Version)
+	})
+	if err != nil {
+		return err
+	}
+
+	module.settings.Logger().InfoContext(ctx, "upgraded system dashboard", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
+	return nil
+}
+
+func (module *module) Get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
+	return module.get(ctx, orgID, name)
+}
+
+func (module *module) ResolveID(ctx context.Context, orgID valuer.UUID, name string) (valuer.UUID, error) {
+	existing, err := module.get(ctx, orgID, name)
+	if err != nil {
+		return valuer.UUID{}, err
+	}
+
+	return existing.ID, nil
+}
+
+func (module *module) get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
+	if strings.HasPrefix(name, dashboardtypes.SystemDashboardNamePrefix) {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "name must not carry the %q prefix", dashboardtypes.SystemDashboardNamePrefix)
+	}
+
+	existing, err := module.dashboardModule.GetByNameV2(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+name)
+	if err != nil {
+		return nil, err
+	}
+	if err := existing.ErrIfNotSystem(); err != nil {
+		return nil, err
+	}
+
+	return existing, nil
+}

pkg/modules/systemdashboard/implsystemdashboard/module_test.go

@@ -0,0 +1,209 @@
+package implsystemdashboard
+
+import (
+	"context"
+	"path/filepath"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/analytics/analyticstest"
+	"github.com/SigNoz/signoz/pkg/factory/factorytest"
+	"github.com/SigNoz/signoz/pkg/modules/dashboard"
+	"github.com/SigNoz/signoz/pkg/modules/dashboard/impldashboard"
+	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
+	"github.com/SigNoz/signoz/pkg/queryparser"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/sqlstore/sqlitesqlstore"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
+	"github.com/SigNoz/signoz/pkg/types/tagtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const testDashboardName = "test-overview"
+
+func newTestSQLStore(t *testing.T) sqlstore.SQLStore {
+	t.Helper()
+
+	store, err := sqlitesqlstore.New(context.Background(), factorytest.NewSettings(), sqlstore.Config{
+		Provider:   "sqlite",
+		Connection: sqlstore.ConnectionConfig{MaxOpenConns: 10},
+		Sqlite: sqlstore.SqliteConfig{
+			Path:            filepath.Join(t.TempDir(), "test.db"),
+			Mode:            "wal",
+			BusyTimeout:     5 * time.Second,
+			TransactionMode: "deferred",
+		},
+	})
+	require.NoError(t, err)
+
+	for _, model := range []any{
+		(*dashboardtypes.StorableDashboard)(nil),
+		(*tagtypes.Tag)(nil),
+		(*tagtypes.TagRelation)(nil),
+		(*systemdashboardtypes.StorableSystemDashboard)(nil),
+	} {
+		_, err := store.BunDB().NewCreateTable().Model(model).IfNotExists().Exec(context.Background())
+		require.NoError(t, err)
+	}
+
+	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_system_dashboard_org_name ON system_dashboard (org_id, name)`)
+	require.NoError(t, err)
+
+	return store
+}
+
+func newTestModule(t *testing.T, sqlStore sqlstore.SQLStore, definitions ...systemdashboardtypes.Definition) (*module, dashboard.Module) {
+	t.Helper()
+
+	providerSettings := factorytest.NewSettings()
+	dashboardModule := impldashboard.NewModule(
+		impldashboard.NewStore(sqlStore),
+		providerSettings,
+		analyticstest.New(),
+		nil,
+		queryparser.New(providerSettings),
+		impltag.NewModule(impltag.NewStore(sqlStore)),
+	)
+
+	registry, err := systemdashboardtypes.NewRegistry(definitions)
+	require.NoError(t, err)
+
+	return NewModule(providerSettings, NewStore(sqlStore), registry, dashboardModule).(*module), dashboardModule
+}
+
+func newTestDefinition(t *testing.T, version int, displayName string) systemdashboardtypes.Definition {
+	t.Helper()
+
+	raw := `{
+		"version": ` + strconv.Itoa(version) + `,
+		"definition": {
+			"schemaVersion": "` + dashboardtypes.SchemaVersion + `",
+			"name": "` + dashboardtypes.SystemDashboardNamePrefix + testDashboardName + `",
+			"tags": [],
+			"spec": {"display": {"name": "` + displayName + `"}, "variables": [], "panels": {}, "layouts": []}
+		}
+	}`
+
+	definition, err := systemdashboardtypes.NewDefinition([]byte(raw))
+	require.NoError(t, err)
+
+	return definition
+}
+
+func TestReconcileProvisionsThenUpgradesUntilTheRowIsModified(t *testing.T) {
+	ctx := context.Background()
+	sqlStore := newTestSQLStore(t)
+	orgID := valuer.GenerateUUID()
+
+	systemDashboardModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 1, "v1"))
+	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
+
+	provisioned, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+	assert.Equal(t, dashboardtypes.SourceSystem, provisioned.Source)
+	assert.Equal(t, systemdashboardtypes.ProvisionerIdentity, provisioned.CreatedBy)
+	assert.Equal(t, "v1", provisioned.Spec.Display.Name)
+	assert.Equal(t, 1, stateVersion(t, systemDashboardModule, ctx, orgID))
+
+	// Reconciling the same version again is a no-op.
+	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
+	unchanged, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+	assert.Equal(t, provisioned.UpdatedAt, unchanged.UpdatedAt)
+
+	// An unmodified copy is upgraded in place, keeping its id.
+	upgradingModule, dashboardModule := newTestModule(t, sqlStore, newTestDefinition(t, 2, "v2"))
+	require.NoError(t, upgradingModule.Reconcile(ctx, orgID))
+
+	upgraded, err := upgradingModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+	assert.Equal(t, provisioned.ID, upgraded.ID)
+	assert.Equal(t, "v2", upgraded.Spec.Display.Name)
+	assert.Equal(t, 2, stateVersion(t, upgradingModule, ctx, orgID))
+
+	// Once anything but the provisioner writes the row, later releases leave it alone.
+	updatable := newTestDefinition(t, 2, "edited out of band").ToUpdatable()
+	_, err = dashboardModule.UpdateUnsafeV2(ctx, orgID, upgraded.ID, "user@signoz.io", updatable)
+	require.NoError(t, err)
+
+	shippingModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 3, "v3"))
+	require.NoError(t, shippingModule.Reconcile(ctx, orgID))
+
+	untouched, err := shippingModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+	assert.Equal(t, "user@signoz.io", untouched.UpdatedBy)
+	assert.Equal(t, "edited out of band", untouched.Spec.Display.Name)
+	assert.Equal(t, 2, stateVersion(t, shippingModule, ctx, orgID))
+}
+
+func stateVersion(t *testing.T, module *module, ctx context.Context, orgID valuer.UUID) int {
+	t.Helper()
+
+	state, err := module.store.Get(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+testDashboardName)
+	require.NoError(t, err)
+
+	return state.Version
+}
+
+func TestSystemDashboardsAreImmutableToUsers(t *testing.T) {
+	ctx := context.Background()
+	sqlStore := newTestSQLStore(t)
+	orgID := valuer.GenerateUUID()
+
+	systemDashboardModule, dashboardModule := newTestModule(t, sqlStore, newTestDefinition(t, 1, "v1"))
+	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
+
+	provisioned, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+
+	_, err = dashboardModule.UpdateV2(ctx, orgID, provisioned.ID, "user@signoz.io", newTestDefinition(t, 1, "edited").ToUpdatable())
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot be modified")
+}
+
+func TestReconcileDoesNotDowngrade(t *testing.T) {
+	ctx := context.Background()
+	sqlStore := newTestSQLStore(t)
+	orgID := valuer.GenerateUUID()
+
+	newerModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 3, "v3"))
+	require.NoError(t, newerModule.Reconcile(ctx, orgID))
+
+	olderModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 2, "v2"))
+	require.NoError(t, olderModule.Reconcile(ctx, orgID))
+
+	got, err := newerModule.Get(ctx, orgID, testDashboardName)
+	require.NoError(t, err)
+	assert.Equal(t, "v3", got.Spec.Display.Name)
+	assert.Equal(t, 3, stateVersion(t, newerModule, ctx, orgID))
+}
+
+func TestGetRejectsANonSystemDashboard(t *testing.T) {
+	ctx := context.Background()
+	sqlStore := newTestSQLStore(t)
+	orgID := valuer.GenerateUUID()
+
+	systemDashboardModule, dashboardModule := newTestModule(t, sqlStore)
+
+	var postable dashboardtypes.PostableDashboardV2
+	require.NoError(t, postable.UnmarshalJSON([]byte(`{
+		"schemaVersion": "`+dashboardtypes.SchemaVersion+`",
+		"name": "a-user-dashboard",
+		"tags": [],
+		"spec": {"display": {"name": "user"}, "variables": [], "panels": {}, "layouts": []}
+	}`)))
+	_, err := dashboardModule.CreateV2(ctx, orgID, "user@signoz.io", valuer.GenerateUUID(), dashboardtypes.SourceUser, postable)
+	require.NoError(t, err)
+
+	// The server-side prefix makes user names structurally unreachable here.
+	_, err = systemDashboardModule.Get(ctx, orgID, "a-user-dashboard")
+	require.Error(t, err)
+
+	_, err = systemDashboardModule.Get(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+testDashboardName)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "must not carry")
+}

pkg/modules/systemdashboard/implsystemdashboard/service.go

@@ -0,0 +1,81 @@
+package implsystemdashboard
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/modules/organization"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
+)
+
+const reconcileRetryInterval = 30 * time.Second
+
+type service struct {
+	settings  factory.ScopedProviderSettings
+	module    systemdashboard.Module
+	orgGetter organization.Getter
+	stopC     chan struct{}
+	healthyC  chan struct{}
+}
+
+// NewService reconciles every org's system dashboards once at startup. Orgs
+// created later are reconciled by the organization setter instead.
+func NewService(providerSettings factory.ProviderSettings, module systemdashboard.Module, orgGetter organization.Getter) factory.Service {
+	return &service{
+		settings:  factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"),
+		module:    module,
+		orgGetter: orgGetter,
+		stopC:     make(chan struct{}),
+		healthyC:  make(chan struct{}),
+	}
+}
+
+func (service *service) Start(ctx context.Context) error {
+	ticker := time.NewTicker(reconcileRetryInterval)
+	defer ticker.Stop()
+
+	for {
+		err := service.reconcile(ctx)
+		if err == nil {
+			close(service.healthyC)
+			<-service.stopC
+			return nil
+		}
+
+		service.settings.Logger().WarnContext(ctx, "system dashboard reconciliation failed, retrying", errors.Attr(err))
+
+		select {
+		case <-service.stopC:
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (service *service) Healthy() <-chan struct{} {
+	return service.healthyC
+}
+
+func (service *service) Stop(_ context.Context) error {
+	close(service.stopC)
+	return nil
+}
+
+func (service *service) reconcile(ctx context.Context) error {
+	orgs, err := service.orgGetter.ListByOwnedKeyRange(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, org := range orgs {
+		if err := service.module.Reconcile(ctx, org.ID); err != nil {
+			return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't reconcile system dashboards for org %s", org.ID.StringValue())
+		}
+	}
+
+	service.settings.Logger().InfoContext(ctx, "system dashboard reconciliation completed", slog.Int("orgs", len(orgs)))
+	return nil
+}

pkg/modules/systemdashboard/implsystemdashboard/store.go

@@ -0,0 +1,80 @@
+package implsystemdashboard
+
+import (
+	"context"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type store struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewStore(sqlstore sqlstore.SQLStore) systemdashboardtypes.Store {
+	return &store{sqlstore: sqlstore}
+}
+
+func (store *store) Create(ctx context.Context, storable *systemdashboardtypes.StorableSystemDashboard) error {
+	_, err := store.
+		sqlstore.
+		BunDBCtx(ctx).
+		NewInsert().
+		Model(storable).
+		Exec(ctx)
+	if err != nil {
+		return store.sqlstore.WrapAlreadyExistsErrf(err, systemdashboardtypes.ErrCodeSystemDashboardAlreadyProvisioned, "system dashboard %s is already provisioned", storable.Name)
+	}
+
+	return nil
+}
+
+func (store *store) Get(ctx context.Context, orgID valuer.UUID, name string) (*systemdashboardtypes.StorableSystemDashboard, error) {
+	storable := new(systemdashboardtypes.StorableSystemDashboard)
+	err := store.
+		sqlstore.
+		BunDBCtx(ctx).
+		NewSelect().
+		Model(storable).
+		Where("org_id = ?", orgID).
+		Where("name = ?", name).
+		Scan(ctx)
+	if err != nil {
+		return nil, store.sqlstore.WrapNotFoundErrf(err, systemdashboardtypes.ErrCodeSystemDashboardNotFound, "system dashboard %s is not provisioned", name)
+	}
+
+	return storable, nil
+}
+
+func (store *store) UpdateVersion(ctx context.Context, orgID valuer.UUID, name string, version int) error {
+	result, err := store.
+		sqlstore.
+		BunDBCtx(ctx).
+		NewUpdate().
+		Model(new(systemdashboardtypes.StorableSystemDashboard)).
+		Set("version = ?", version).
+		Set("updated_at = ?", time.Now()).
+		Where("org_id = ?", orgID).
+		Where("name = ?", name).
+		Exec(ctx)
+	if err != nil {
+		return err
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows == 0 {
+		return errors.Newf(errors.TypeNotFound, systemdashboardtypes.ErrCodeSystemDashboardNotFound, "system dashboard %s is not provisioned", name)
+	}
+
+	return nil
+}
+
+func (store *store) RunInTx(ctx context.Context, cb func(ctx context.Context) error) error {
+	return store.sqlstore.RunInTxCtx(ctx, nil, cb)
+}

pkg/modules/systemdashboard/systemdashboard.go

@@ -0,0 +1,28 @@
+package systemdashboard
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+type Module interface {
+	// Reconcile provisions the org's missing system dashboards and upgrades the
+	// unmodified ones to the shipped version. It never touches a dashboard whose
+	// row carries a foreign write and it never deletes.
+	Reconcile(ctx context.Context, orgID valuer.UUID) error
+
+	// Get addresses the dashboard by its bare definition name; the reserved
+	// prefix is a storage concern the API never exposes.
+	Get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error)
+
+	// ResolveID maps a system dashboard's name to its id, so routes addressed by
+	// name can be authz-checked and audited against the id tuples carry.
+	ResolveID(ctx context.Context, orgID valuer.UUID, name string) (valuer.UUID, error)
+}
+
+type Handler interface {
+	Get(http.ResponseWriter, *http.Request)
+}

pkg/querybuilder/exists_expr.go

@@ -43,7 +43,7 @@ func ExistsExpression(columns []*schema.Column, key *telemetrytypes.TelemetryFie
 		if len(evolutionsEntries) > 0 && evolutionsEntries[0] != nil {
 			columnName = evolutionsEntries[0].ColumnName
 		}
-		rawPath := fmt.Sprintf("%s.%s", columnName, ClickHouseIdentifier(key.Name))
+		rawPath := fmt.Sprintf("%s.`%s`", columnName, key.Name)
 		if exists {
 			return rawPath + " IS NOT NULL", nil
 		}

pkg/signoz/handler.go

@@ -46,6 +46,8 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail/impltracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracefunnel"
@@ -88,6 +90,7 @@ type Handlers struct {
 	RulerHandler            ruler.Handler
 	LLMPricingRuleHandler   llmpricingrule.Handler
 	StatsHandler            statsreporter.Handler
+	SystemDashboard         systemdashboard.Handler
 }
 
 func NewHandlers(
@@ -137,5 +140,6 @@ func NewHandlers(
 		RulerHandler:            signozruler.NewHandler(rulerService),
 		LLMPricingRuleHandler:   impllmpricingrule.NewHandler(modules.LLMPricingRule),
 		StatsHandler:            statsreporter.NewHandler(statsAggregator),
+		SystemDashboard:         implsystemdashboard.NewHandler(modules.SystemDashboard),
 	}
 }

pkg/signoz/handler_test.go

@@ -59,7 +59,7 @@ func TestNewHandlers(t *testing.T) {
 	userGetter := impluser.NewGetter(impluser.NewStore(sqlstore, providerSettings), userRoleStore, flagger)
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, nil)
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)

pkg/signoz/module.go

@@ -48,6 +48,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail/impltracedetail"
@@ -67,35 +68,36 @@ import (
 )
 
 type Modules struct {
-	OrgGetter           organization.Getter
-	OrgSetter           organization.Setter
-	Preference          preference.Module
-	UserSetter          user.Setter
-	UserGetter          user.Getter
-	RetentionGetter     retention.Getter
-	SavedView           savedview.Module
-	Apdex               apdex.Module
-	Dashboard           dashboard.Module
-	QuickFilter         quickfilter.Module
-	TraceFunnel         tracefunnel.Module
-	RawDataExport       rawdataexport.Module
-	AuthDomain          authdomain.Module
-	Session             session.Module
-	Services            services.Module
-	SpanPercentile      spanpercentile.Module
-	MetricsExplorer     metricsexplorer.Module
-	MetricReductionRule metricreductionrule.Module
-	InfraMonitoring     inframonitoring.Module
+	OrgGetter            organization.Getter
+	OrgSetter            organization.Setter
+	Preference           preference.Module
+	UserSetter           user.Setter
+	UserGetter           user.Getter
+	RetentionGetter      retention.Getter
+	SavedView            savedview.Module
+	Apdex                apdex.Module
+	Dashboard            dashboard.Module
+	QuickFilter          quickfilter.Module
+	TraceFunnel          tracefunnel.Module
+	RawDataExport        rawdataexport.Module
+	AuthDomain           authdomain.Module
+	Session              session.Module
+	Services             services.Module
+	SpanPercentile       spanpercentile.Module
+	MetricsExplorer      metricsexplorer.Module
+	MetricReductionRule  metricreductionrule.Module
+	InfraMonitoring      inframonitoring.Module
 	Promote              promote.Module
 	ServiceAccount       serviceaccount.Module
 	ServiceAccountGetter serviceaccount.Getter
 	CloudIntegration     cloudintegration.Module
-	LogsPipeline        logspipeline.Module
-	RuleStateHistory    rulestatehistory.Module
-	TraceDetail         tracedetail.Module
-	SpanMapper          spanmapper.Module
-	LLMPricingRule      llmpricingrule.Module
-	Tag                 tag.Module
+	LogsPipeline         logspipeline.Module
+	RuleStateHistory     rulestatehistory.Module
+	TraceDetail          tracedetail.Module
+	SpanMapper           spanmapper.Module
+	LLMPricingRule       llmpricingrule.Module
+	Tag                  tag.Module
+	SystemDashboard      systemdashboard.Module
 }
 
 func NewModules(
@@ -124,9 +126,10 @@ func NewModules(
 	fl flagger.Flagger,
 	tagModule tag.Module,
 	metricReductionRule metricreductionrule.Module,
+	systemDashboard systemdashboard.Module,
 ) Modules {
 	quickfilter := implquickfilter.NewModule(implquickfilter.NewStore(sqlstore))
-	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter)
+	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, systemDashboard)
 	// Cleanup callbacks from other modules, invoked when a user is deleted.
 	onDeleteUser := []user.OnDeleteUser{
 		dashboard.DeletePreferencesForUser,
@@ -136,34 +139,35 @@ func NewModules(
 	authDomainModule := implauthdomain.NewModule(implauthdomain.NewStore(sqlstore), authNs, authz)
 
 	return Modules{
-		OrgGetter:           orgGetter,
-		OrgSetter:           orgSetter,
-		Preference:          implpreference.NewModule(implpreference.NewStore(sqlstore), preferencetypes.NewAvailablePreference()),
-		SavedView:           implsavedview.NewModule(implsavedview.NewStore(sqlstore)),
-		Apdex:               implapdex.NewModule(sqlstore),
-		Dashboard:           dashboard,
-		UserSetter:          userSetter,
-		UserGetter:          userGetter,
-		RetentionGetter:     retentionGetter,
-		QuickFilter:         quickfilter,
-		TraceFunnel:         impltracefunnel.NewModule(impltracefunnel.NewStore(sqlstore)),
-		RawDataExport:       implrawdataexport.NewModule(querier),
-		AuthDomain:          authDomainModule,
-		Session:             implsession.NewModule(providerSettings, authNs, userSetter, userGetter, authDomainModule, tokenizer, orgGetter, authz, config.Global),
-		SpanPercentile:      implspanpercentile.NewModule(querier, providerSettings),
-		Services:            implservices.NewModule(querier, telemetryStore),
-		MetricsExplorer:     implmetricsexplorer.NewModule(telemetryStore, telemetryMetadataStore, cache, ruleStore, dashboard, fl, providerSettings, config.MetricsExplorer),
-		MetricReductionRule: metricReductionRule,
-		InfraMonitoring:     implinframonitoring.NewModule(telemetryStore, telemetryMetadataStore, querier, fl, providerSettings, config.InfraMonitoring),
-		Promote:             implpromote.NewModule(telemetryMetadataStore, telemetryStore),
+		OrgGetter:            orgGetter,
+		OrgSetter:            orgSetter,
+		Preference:           implpreference.NewModule(implpreference.NewStore(sqlstore), preferencetypes.NewAvailablePreference()),
+		SavedView:            implsavedview.NewModule(implsavedview.NewStore(sqlstore)),
+		Apdex:                implapdex.NewModule(sqlstore),
+		Dashboard:            dashboard,
+		UserSetter:           userSetter,
+		UserGetter:           userGetter,
+		RetentionGetter:      retentionGetter,
+		QuickFilter:          quickfilter,
+		TraceFunnel:          impltracefunnel.NewModule(impltracefunnel.NewStore(sqlstore)),
+		RawDataExport:        implrawdataexport.NewModule(querier),
+		AuthDomain:           authDomainModule,
+		Session:              implsession.NewModule(providerSettings, authNs, userSetter, userGetter, authDomainModule, tokenizer, orgGetter, authz, config.Global),
+		SpanPercentile:       implspanpercentile.NewModule(querier, providerSettings),
+		Services:             implservices.NewModule(querier, telemetryStore),
+		MetricsExplorer:      implmetricsexplorer.NewModule(telemetryStore, telemetryMetadataStore, cache, ruleStore, dashboard, fl, providerSettings, config.MetricsExplorer),
+		MetricReductionRule:  metricReductionRule,
+		InfraMonitoring:      implinframonitoring.NewModule(telemetryStore, telemetryMetadataStore, querier, fl, providerSettings, config.InfraMonitoring),
+		Promote:              implpromote.NewModule(telemetryMetadataStore, telemetryStore),
 		ServiceAccount:       serviceAccount,
 		ServiceAccountGetter: serviceAccountGetter,
-		LogsPipeline:        impllogspipeline.NewModule(sqlstore),
-		RuleStateHistory:    implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
-		CloudIntegration:    cloudIntegrationModule,
-		TraceDetail:         impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
-		SpanMapper:          implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
-		LLMPricingRule:      impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
-		Tag:                 tagModule,
+		LogsPipeline:         impllogspipeline.NewModule(sqlstore),
+		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
+		CloudIntegration:     cloudIntegrationModule,
+		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
+		SpanMapper:           implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
+		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
+		Tag:                  tagModule,
+		SystemDashboard:      systemDashboard,
 	}
 }

pkg/signoz/module_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/queryparser"
@@ -66,7 +67,12 @@ func TestNewModules(t *testing.T) {
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
 
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule())
+	systemDashboardRegistry, err := implsystemdashboard.NewRegistry()
+	require.NoError(t, err)
+
+	systemDashboard := implsystemdashboard.NewModule(providerSettings, implsystemdashboard.NewStore(sqlstore), systemDashboardRegistry, dashboardModule)
+
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), systemDashboard)
 
 	reflectVal := reflect.ValueOf(modules)
 	for i := 0; i < reflectVal.NumField(); i++ {

pkg/signoz/openapi.go

@@ -35,6 +35,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/user"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -93,6 +94,8 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
+		struct{ systemdashboard.Module }{},
+		struct{ systemdashboard.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})
 	if err != nil {
 		return nil, err

pkg/signoz/provider.go

@@ -244,7 +244,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewDeleteOrphanUserRolesFactory(),
 		sqlmigration.NewMigrateLambdaDashboardsFactory(),
 		sqlmigration.NewAddAuthDomainTuplesFactory(sqlstore),
-		sqlmigration.NewAddDeploymentHostTuplesFactory(sqlstore),
+		sqlmigration.NewAddSystemDashboardFactory(sqlstore, sqlschema),
 	)
 }
 
@@ -348,6 +348,8 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RulerHandler,
 			handlers.StatsHandler,
 			handlers.SavedView,
+			modules.SystemDashboard,
+			handlers.SystemDashboard,
 		),
 	)
 }

pkg/signoz/signoz.go

@@ -36,6 +36,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
+	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
@@ -540,8 +541,16 @@ func New(
 
 	metricReductionRuleModule := metricReductionRuleModuleCallback(sqlstore, telemetrystore, dashboard, queryParser, licensing, flagger, telemetryMetadataStore, providerSettings, config.MetricsExplorer.TelemetryStore.Threads)
 
+	// Initialize the system dashboard module. The registry is parsed here so a
+	// malformed embedded definition fails startup instead of a request.
+	systemDashboardRegistry, err := implsystemdashboard.NewRegistry()
+	if err != nil {
+		return nil, err
+	}
+	systemDashboardModule := implsystemdashboard.NewModule(providerSettings, implsystemdashboard.NewStore(sqlstore), systemDashboardRegistry, dashboard)
+
 	// Initialize all modules
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, systemDashboardModule)
 
 	// Initialize ruler from the variant-specific provider factories
 	rulerInstance, err := factory.NewProviderFromNamedMap(ctx, providerSettings, config.Ruler, rulerProviderFactories(cache, alertmanager, sqlstore, telemetrystore, telemetryMetadataStore, prometheus, orgGetter, modules.RuleStateHistory, querier, queryParser), "signoz")
@@ -610,6 +619,7 @@ func New(
 		factory.NewNamedService(factory.MustNewName("auditor"), auditor),
 		factory.NewNamedService(factory.MustNewName("meterreporter"), meterReporter, factory.MustNewName("licensing")),
 		factory.NewNamedService(factory.MustNewName("ruler"), rulerInstance),
+		factory.NewNamedService(factory.MustNewName("systemdashboard"), implsystemdashboard.NewService(providerSettings, systemDashboardModule, orgGetter)),
 	)
 	if err != nil {
 		return nil, err

pkg/sqlmigration/118_add_deployment_host_tuples.go

@@ -1,161 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addDeploymentHostTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddDeploymentHostTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_deployment_host_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addDeploymentHostTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addDeploymentHostTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addDeploymentHostTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	// zeus hosts moved from the legacy ViewAccess/AdminAccess role gates to
-	// CheckResources, which on enterprise requires real tuples -- existing orgs
-	// never had these written, only new orgs get them from the registry at bootstrap.
-	tuples := []migrationTuple{
-		{authtypes.SigNozAdminRoleName, "metaresource", "deployment-host", "list"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "deployment-host", "update"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "deployment-host", "list"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "deployment-host", "list"},
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	for _, orgID := range orgIDs {
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addDeploymentHostTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/118_add_system_dashboard.go

@@ -0,0 +1,93 @@
+package sqlmigration
+
+import (
+	"context"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlschema"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addSystemDashboard struct {
+	sqlstore  sqlstore.SQLStore
+	sqlschema sqlschema.SQLSchema
+}
+
+func NewAddSystemDashboardFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(
+		factory.MustNewName("add_system_dashboard"),
+		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+			return &addSystemDashboard{sqlstore: sqlstore, sqlschema: sqlschema}, nil
+		},
+	)
+}
+
+func (migration *addSystemDashboard) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addSystemDashboard) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	sqls := migration.sqlschema.Operator().CreateTable(&sqlschema.Table{
+		Name: "system_dashboard",
+		Columns: []*sqlschema.Column{
+			{Name: "id", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "org_id", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "dashboard_id", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "name", DataType: sqlschema.DataTypeText, Nullable: false},
+			{Name: "version", DataType: sqlschema.DataTypeBigInt, Nullable: false},
+			{Name: "created_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
+			{Name: "updated_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
+		},
+		PrimaryKeyConstraint: &sqlschema.PrimaryKeyConstraint{
+			ColumnNames: []sqlschema.ColumnName{"id"},
+		},
+		ForeignKeyConstraints: []*sqlschema.ForeignKeyConstraint{
+			{
+				ReferencingColumnName: sqlschema.ColumnName("org_id"),
+				ReferencedTableName:   sqlschema.TableName("organizations"),
+				ReferencedColumnName:  sqlschema.ColumnName("id"),
+			},
+			{
+				ReferencingColumnName: sqlschema.ColumnName("dashboard_id"),
+				ReferencedTableName:   sqlschema.TableName("dashboard"),
+				ReferencedColumnName:  sqlschema.ColumnName("id"),
+			},
+		},
+	})
+
+	// (org_id, name) is what makes provisioning safe across replicas: the state
+	// row is written in the same transaction as the dashboard, so a losing racer
+	// rolls back its dashboard too.
+	sqls = append(sqls, migration.sqlschema.Operator().CreateIndex(
+		&sqlschema.UniqueIndex{
+			TableName:   "system_dashboard",
+			ColumnNames: []sqlschema.ColumnName{"org_id", "name"},
+		},
+	)...)
+	sqls = append(sqls, migration.sqlschema.Operator().CreateIndex(
+		&sqlschema.UniqueIndex{
+			TableName:   "system_dashboard",
+			ColumnNames: []sqlschema.ColumnName{"dashboard_id"},
+		},
+	)...)
+
+	for _, sql := range sqls {
+		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
+			return err
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addSystemDashboard) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/telemetryschema/tracestelemetryschema/const.go

@@ -43,7 +43,6 @@ const (
 	SpanAttributesStringColumn = "attributes_string"
 	SpanAttributesNumberColumn = "attributes_number"
 	SpanAttributesBoolColumn   = "attributes_bool"
-	SpanAttributesColumn       = "attributes"
 	SpanResourcesStringColumn  = "resources_string"
 )
 

pkg/telemetryschema/tracestelemetryschema/field_mapper.go

@@ -52,9 +52,8 @@ var (
 			KeyType:   schema.LowCardinalityColumnType{ElementType: schema.ColumnTypeString},
 			ValueType: schema.ColumnTypeString,
 		}},
-		"resource":   {Name: "resource", Type: schema.JSONColumnType{}},
-		"scope":      {Name: "scope", Type: schema.JSONColumnType{}},
-		"attributes": {Name: "attributes", Type: schema.JSONColumnType{}},
+		"resource": {Name: "resource", Type: schema.JSONColumnType{}},
+		"scope":    {Name: "scope", Type: schema.JSONColumnType{}},
 
 		"events": {Name: "events", Type: schema.ArrayColumnType{
 			ElementType: schema.ColumnTypeString,
@@ -185,32 +184,16 @@ func (m *fieldMapper) getColumn(
 	case telemetrytypes.FieldContextScope:
 		return []*schema.Column{indexV3Columns["scope"]}, nil
 	case telemetrytypes.FieldContextAttribute:
-		// Only typed keys resolve here: a data-type-unspecified attribute key
-		// falls through to ErrColumnNotFound so bare keys keep taking the legacy
-		// CandidateKeys/synthesis path rather than flipping to metadata-first.
-		var mapCol *schema.Column
 		switch key.FieldDataType {
 		case telemetrytypes.FieldDataTypeString:
-			mapCol = indexV3Columns["attributes_string"]
+			return []*schema.Column{indexV3Columns["attributes_string"]}, nil
 		case telemetrytypes.FieldDataTypeInt64,
 			telemetrytypes.FieldDataTypeFloat64,
 			telemetrytypes.FieldDataTypeNumber:
-			mapCol = indexV3Columns["attributes_number"]
+			return []*schema.Column{indexV3Columns["attributes_number"]}, nil
 		case telemetrytypes.FieldDataTypeBool:
-			mapCol = indexV3Columns["attributes_bool"]
-		default:
-			return nil, qbtypes.ErrColumnNotFound
+			return []*schema.Column{indexV3Columns["attributes_bool"]}, nil
 		}
-		// Dual-read from the JSON column only once the attributes evolution entry
-		// is registered for this key; without it, resolution is byte-for-byte the
-		// legacy Map path. The JSON column is returned first so it wins the multiIf
-		// when both homes hold the key; SelectEvolutionsForColumns narrows the pair
-		// by the query's time range. This makes the evolution entry the rollout
-		// control, exactly as it is for resource/scope.
-		if attributeJSONEvolutionRegistered(key) {
-			return []*schema.Column{indexV3Columns["attributes"], mapCol}, nil
-		}
-		return []*schema.Column{mapCol}, nil
 	case telemetrytypes.FieldContextSpan:
 		// Check if this is a span scope field
 		if strings.ToLower(key.Name) == SpanSearchScopeRoot || strings.ToLower(key.Name) == SpanSearchScopeEntryPoint {
@@ -296,7 +279,6 @@ func (m *fieldMapper) resolveColumnExprs(
 		return nil, nil, nil, err
 	}
 
-	key = narrowEvolutionsToColumns(key, columns)
 	newColumns, evolutionsEntries, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, startNs, endNs)
 	if err != nil {
 		return nil, nil, nil, err
@@ -327,17 +309,6 @@ func (m *fieldMapper) resolveColumnExprs(
 					exprs = append(exprs, fmt.Sprintf("%s.attributes.%s::String", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
 					existExprs = append(existExprs, fmt.Sprintf("%s.attributes.%s IS NOT NULL", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
 				}
-			case telemetrytypes.FieldContextAttribute:
-				// Span attributes are flat shared-data paths keyed by the attribute name
-				// verbatim (no nested object), so the name addresses the path directly.
-				// String casts to ::String so an absent path folds to '' — matching the
-				// Map column's default and preserving negative-operator parity; typed
-				// numeric/bool cast to Nullable so a missing or wrong-typed path reads
-				// NULL rather than 0/false. Existence tests the raw path (the cast folds
-				// NULL) and is index-eligible via attributes_paths_tokenbf.
-				path := fmt.Sprintf("%s.%s", columnName, querybuilder.ClickHouseIdentifier(key.Name))
-				exprs = append(exprs, fmt.Sprintf("%s::%s", path, attributeJSONCast(key.FieldDataType)))
-				existExprs = append(existExprs, fmt.Sprintf("%s IS NOT NULL", path))
 			default:
 				return nil, nil, nil, errors.NewInternalf(errors.CodeInternal, "only resource and scope context fields are supported for json columns, got %s", key.FieldContext.String)
 			}
@@ -382,66 +353,6 @@ func (m *fieldMapper) resolveColumnExprs(
 	return exprs, existExprs, columns, nil
 }
 
-// attributeJSONEvolutionRegistered reports whether the key carries an evolution entry for the
-// `attributes` JSON column. Until that entry is registered, attribute resolution stays on the
-// legacy Map column and the JSON column is never touched.
-func attributeJSONEvolutionRegistered(key *telemetrytypes.TelemetryFieldKey) bool {
-	for _, e := range key.Evolutions {
-		if e != nil && e.ColumnName == SpanAttributesColumn {
-			return true
-		}
-	}
-	return false
-}
-
-// narrowEvolutionsToColumns returns key.Evolutions filtered to entries whose column is in cols.
-// A metadata attribute key carries the `__all__` evolutions for every attribute-context column
-// (all three legacy maps plus the JSON column), but getColumn resolves a typed key to only its
-// own map + the JSON column; without this filter SelectEvolutionsForColumns would reject the
-// in-range sibling-map entries as columns not present in the slice. A no-op for every other
-// context, where getColumn already returns exactly the columns the evolutions name.
-func narrowEvolutionsToColumns(key *telemetrytypes.TelemetryFieldKey, cols []*schema.Column) *telemetrytypes.TelemetryFieldKey {
-	if len(key.Evolutions) == 0 {
-		return key
-	}
-	allowed := make(map[string]struct{}, len(cols))
-	for _, c := range cols {
-		allowed[c.Name] = struct{}{}
-	}
-	filtered := make([]*telemetrytypes.EvolutionEntry, 0, len(key.Evolutions))
-	for _, e := range key.Evolutions {
-		if e == nil {
-			continue
-		}
-		if _, ok := allowed[e.ColumnName]; ok {
-			filtered = append(filtered, e)
-		}
-	}
-	if len(filtered) == len(key.Evolutions) {
-		return key
-	}
-	narrowed := *key
-	narrowed.Evolutions = filtered
-	return &narrowed
-}
-
-// attributeJSONCast returns the ClickHouse cast target for a span attribute read from the
-// JSON column. String (and data-type-unspecified) casts to non-nullable String so an absent
-// path folds to ” the way the Map column's default does, keeping negative-operator parity;
-// numeric and bool cast to Nullable so an absent or wrong-typed path reads NULL instead of a
-// spurious 0/false. GROUP BY accepts these Nullable scalar casts (unlike a raw Dynamic).
-func attributeJSONCast(dataType telemetrytypes.FieldDataType) string {
-	switch dataType {
-	case telemetrytypes.FieldDataTypeInt64,
-		telemetrytypes.FieldDataTypeFloat64,
-		telemetrytypes.FieldDataTypeNumber,
-		telemetrytypes.FieldDataTypeBool:
-		return fmt.Sprintf("Nullable(%s)", telemetrytypes.MappingFieldDataTypeToJSONDataType[dataType].StringValue())
-	default:
-		return "String"
-	}
-}
-
 // upgradeToFamilies swaps single-member candidates for their family when the
 // metadata map proves membership. Candidate order and every non-family
 // candidate stay exactly as the legacy flow produced them; sibling candidates
@@ -605,7 +516,6 @@ func (m *fieldMapper) columnIsTemporal(ctx context.Context, startNs, endNs uint6
 	if err != nil {
 		return false, err
 	}
-	key = narrowEvolutionsToColumns(key, columns)
 	newColumns, _, err := qbtypes.SelectEvolutionsForColumns(columns, key.Evolutions, startNs, endNs)
 	if err != nil {
 		return false, err
@@ -728,7 +638,6 @@ func (m *fieldMapper) ExistsFor(
 	if err != nil {
 		return "", err
 	}
-	key = narrowEvolutionsToColumns(key, columns)
 	fieldExpression, err := m.FieldFor(ctx, orgID, tsStart, tsEnd, key)
 	if err != nil {
 		return "", err

pkg/telemetryschema/tracestelemetryschema/field_mapper_attributes_json_test.go

@@ -1,182 +0,0 @@
-package tracestelemetryschema
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/huandu/go-sqlbuilder"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	attrJSONRelease = time.Date(2025, 1, 1, 0, 0, 0, 0, time.UTC)
-
-	attrWindowBefore   = [2]uint64{tsNano(2024, 1), tsNano(2024, 6)}
-	attrWindowAfter    = [2]uint64{tsNano(2025, 6), tsNano(2025, 7)}
-	attrWindowStraddle = [2]uint64{tsNano(2024, 6), tsNano(2025, 6)}
-)
-
-func tsNano(y int, m time.Month) uint64 {
-	return uint64(time.Date(y, m, 1, 0, 0, 0, 0, time.UTC).UnixNano())
-}
-
-func attrKey(name string, dt telemetrytypes.FieldDataType, evo []*telemetrytypes.EvolutionEntry) telemetrytypes.TelemetryFieldKey {
-	return telemetrytypes.TelemetryFieldKey{
-		Name:          name,
-		FieldContext:  telemetrytypes.FieldContextAttribute,
-		FieldDataType: dt,
-		Evolutions:    evo,
-	}
-}
-
-// TestFieldForAttributeJSONEvolution asserts the value expression across the rollout window:
-// before release the legacy Map lookup (byte-for-byte today), after release the type-aware JSON
-// cast, straddling a dual-read multiIf with the JSON column first.
-func TestFieldForAttributeJSONEvolution(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-	evo := MockAttributeEvolutionData(attrJSONRelease)
-
-	testCases := []struct {
-		name     string
-		dataType telemetrytypes.FieldDataType
-		window   [2]uint64
-		expected string
-	}{
-		{"string before -> map", telemetrytypes.FieldDataTypeString, attrWindowBefore, "attributes_string['user.id']"},
-		{"string after -> json", telemetrytypes.FieldDataTypeString, attrWindowAfter, "attributes.`user.id`::String"},
-		{"string straddle -> dual", telemetrytypes.FieldDataTypeString, attrWindowStraddle, "multiIf(attributes.`user.id` IS NOT NULL, attributes.`user.id`::String, mapContains(attributes_string, 'user.id'), attributes_string['user.id'], NULL)"},
-		{"number before -> map", telemetrytypes.FieldDataTypeNumber, attrWindowBefore, "attributes_number['user.id']"},
-		{"number after -> json", telemetrytypes.FieldDataTypeNumber, attrWindowAfter, "attributes.`user.id`::Nullable(Float64)"},
-		{"number straddle -> dual", telemetrytypes.FieldDataTypeNumber, attrWindowStraddle, "multiIf(attributes.`user.id` IS NOT NULL, attributes.`user.id`::Nullable(Float64), mapContains(attributes_number, 'user.id'), attributes_number['user.id'], NULL)"},
-		{"int64 after -> json", telemetrytypes.FieldDataTypeInt64, attrWindowAfter, "attributes.`user.id`::Nullable(Int64)"},
-		{"bool before -> map", telemetrytypes.FieldDataTypeBool, attrWindowBefore, "attributes_bool['user.id']"},
-		{"bool after -> json", telemetrytypes.FieldDataTypeBool, attrWindowAfter, "attributes.`user.id`::Nullable(Bool)"},
-		{"bool straddle -> dual", telemetrytypes.FieldDataTypeBool, attrWindowStraddle, "multiIf(attributes.`user.id` IS NOT NULL, attributes.`user.id`::Nullable(Bool), mapContains(attributes_bool, 'user.id'), attributes_bool['user.id'], NULL)"},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			key := attrKey("user.id", tc.dataType, evo)
-			got, err := fm.FieldFor(ctx, valuer.UUID{}, tc.window[0], tc.window[1], &key)
-			require.NoError(t, err)
-			assert.Equal(t, tc.expected, got)
-		})
-	}
-}
-
-// TestFieldForAttributeNoEvolutionParity proves the JSON column is untouched until the evolution
-// entry is registered: a key with no evolutions resolves to the Map column for every window.
-func TestFieldForAttributeNoEvolutionParity(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-
-	for _, dt := range []struct {
-		dataType telemetrytypes.FieldDataType
-		expected string
-	}{
-		{telemetrytypes.FieldDataTypeString, "attributes_string['user.id']"},
-		{telemetrytypes.FieldDataTypeNumber, "attributes_number['user.id']"},
-		{telemetrytypes.FieldDataTypeBool, "attributes_bool['user.id']"},
-	} {
-		key := attrKey("user.id", dt.dataType, nil)
-		got, err := fm.FieldFor(ctx, valuer.UUID{}, attrWindowAfter[0], attrWindowAfter[1], &key)
-		require.NoError(t, err)
-		assert.Equal(t, dt.expected, got, "no evolution entry must keep the Map path")
-	}
-}
-
-// TestConditionForAttributeJSON asserts the emitted WHERE fragment per operator against the JSON
-// column (window fully after release). Positive operators carry the raw-path existence guard;
-// numeric comparisons keep numeric semantics; existence never tests the ::String cast.
-func TestConditionForAttributeJSON(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-	cb := NewConditionBuilder(fm, flaggertest.New(t))
-	evo := MockAttributeEvolutionData(attrJSONRelease)
-
-	testCases := []struct {
-		name     string
-		key      telemetrytypes.TelemetryFieldKey
-		operator qbtypes.FilterOperator
-		value    any
-		expected string
-	}{
-		{
-			name:     "equal string",
-			key:      attrKey("user.id", telemetrytypes.FieldDataTypeString, evo),
-			operator: qbtypes.FilterOperatorEqual, value: "admin",
-			expected: "(attributes.`user.id`::String = ? AND attributes.`user.id` IS NOT NULL)",
-		},
-		{
-			name:     "not equal string has no exists guard",
-			key:      attrKey("user.id", telemetrytypes.FieldDataTypeString, evo),
-			operator: qbtypes.FilterOperatorNotEqual, value: "admin",
-			expected: "attributes.`user.id`::String <> ?",
-		},
-		{
-			name:     "greater than number",
-			key:      attrKey("http.status_code", telemetrytypes.FieldDataTypeInt64, evo),
-			operator: qbtypes.FilterOperatorGreaterThan, value: float64(200),
-			expected: "toFloat64(attributes.`http.status_code`::Nullable(Int64)) > ?",
-		},
-		{
-			name:     "ilike string",
-			key:      attrKey("user.id", telemetrytypes.FieldDataTypeString, evo),
-			operator: qbtypes.FilterOperatorILike, value: "%adm%",
-			expected: "LOWER(attributes.`user.id`::String) LIKE LOWER(?)",
-		},
-		{
-			name:     "exists uses raw path",
-			key:      attrKey("user.id", telemetrytypes.FieldDataTypeString, evo),
-			operator: qbtypes.FilterOperatorExists, value: nil,
-			expected: "attributes.`user.id` IS NOT NULL",
-		},
-		{
-			name:     "not exists uses raw path",
-			key:      attrKey("user.id", telemetrytypes.FieldDataTypeString, evo),
-			operator: qbtypes.FilterOperatorNotExists, value: nil,
-			expected: "attributes.`user.id` IS NULL",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			sb := sqlbuilder.NewSelectBuilder()
-			conds, _, err := cb.ConditionFor(ctx, valuer.UUID{}, attrWindowAfter[0], attrWindowAfter[1], &tc.key,
-				map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
-			require.NoError(t, err)
-			sb.Where(conds...)
-			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			assert.Contains(t, sql, tc.expected)
-		})
-	}
-}
-
-// TestConditionForAttributeJSONNotExistsDualRead covers NOT EXISTS across both homes during the
-// dual-read window: it must AND the JSON IS NULL with NOT mapContains so a row present in either
-// home is excluded (De Morgan), including rows that predate the JSON column.
-func TestConditionForAttributeJSONNotExistsDualRead(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-	cb := NewConditionBuilder(fm, flaggertest.New(t))
-	evo := MockAttributeEvolutionData(attrJSONRelease)
-
-	key := attrKey("user.id", telemetrytypes.FieldDataTypeString, evo)
-	sb := sqlbuilder.NewSelectBuilder()
-	conds, _, err := cb.ConditionFor(ctx, valuer.UUID{}, attrWindowStraddle[0], attrWindowStraddle[1], &key,
-		map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {&key}}, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorNotExists, nil, sb)
-	require.NoError(t, err)
-	sb.Where(conds...)
-	sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-	// the value multiIf resolves the row's home; NOT EXISTS negates the whole thing to IS NULL
-	assert.Contains(t, sql, "IS NULL")
-	assert.Contains(t, sql, "attributes.`user.id` IS NOT NULL")
-	assert.Contains(t, sql, "mapContains(attributes_string, 'user.id')")
-}

pkg/telemetryschema/tracestelemetryschema/test_data.go

@@ -154,29 +154,6 @@ func BuildCompleteFieldKeyMap(releaseTime time.Time) map[string][]*telemetrytype
 	return keysMap
 }
 
-// MockAttributeEvolutionData returns the attribute-context evolution timeline: the three legacy
-// map columns at epoch 0 and the JSON `attributes` column released at releaseTime. Every entry
-// is field_name "__all__", so a typed attribute key carries all four; getColumn keeps only its
-// own map plus the JSON column and narrowEvolutionsToColumns drops the rest before selection.
-func MockAttributeEvolutionData(releaseTime time.Time) []*telemetrytypes.EvolutionEntry {
-	entry := func(col, typ string, rt time.Time) *telemetrytypes.EvolutionEntry {
-		return &telemetrytypes.EvolutionEntry{
-			Signal:       telemetrytypes.SignalTraces,
-			ColumnName:   col,
-			ColumnType:   typ,
-			FieldContext: telemetrytypes.FieldContextAttribute,
-			FieldName:    "__all__",
-			ReleaseTime:  rt,
-		}
-	}
-	return []*telemetrytypes.EvolutionEntry{
-		entry("attributes_string", "Map(LowCardinality(String), String)", time.Unix(0, 0)),
-		entry("attributes_number", "Map(LowCardinality(String), Float64)", time.Unix(0, 0)),
-		entry("attributes_bool", "Map(LowCardinality(String), Bool)", time.Unix(0, 0)),
-		entry("attributes", "JSON()", releaseTime),
-	}
-}
-
 // MockEvolutionData returns the canonical resource-column evolution timeline used in tests:
 // the legacy resources_string map at epoch 0 and the JSON resource column released at releaseTime.
 func MockEvolutionData(releaseTime time.Time) []*telemetrytypes.EvolutionEntry {

pkg/types/coretypes/kind.go

@@ -71,7 +71,6 @@ func (name Kind) Enum() []any {
 		KindFactorAPIKey,
 		KindLicense,
 		KindSubscription,
-		KindDeploymentHost,
 		KindLogs,
 		KindTraces,
 		KindMetrics,

pkg/types/coretypes/registry_kind.go

@@ -31,7 +31,6 @@ var Kinds = []Kind{
 	KindFactorAPIKey,
 	KindLicense,
 	KindSubscription,
-	KindDeploymentHost,
 	KindLogs,
 	KindTraces,
 	KindMetrics,
@@ -72,7 +71,6 @@ var (
 	KindFactorAPIKey                 = MustNewKind("factor-api-key")
 	KindLicense                      = MustNewKind("license")
 	KindSubscription                 = MustNewKind("subscription")
-	KindDeploymentHost               = MustNewKind("deployment-host")
 	KindLogs                         = MustNewKind("logs")
 	KindTraces                       = MustNewKind("traces")
 	KindMetrics                      = MustNewKind("metrics")

pkg/types/coretypes/registry_managed_role.go

@@ -191,9 +191,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — admin updates, viewer lists
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
-		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
@@ -286,8 +283,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// ttl-setting — read only (admin updates)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — list only (admin updates)
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
@@ -346,8 +341,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// ttl-setting — read only
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — list only
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},

pkg/types/coretypes/registry_resource.go

@@ -31,7 +31,6 @@ var Resources = []Resource{
 	ResourceMetaResourceFactorAPIKey,
 	ResourceMetaResourceLicense,
 	ResourceMetaResourceSubscription,
-	ResourceMetaResourceDeploymentHost,
 	ResourceTelemetryResourceLogs,
 	ResourceTelemetryResourceTraces,
 	ResourceTelemetryResourceMetrics,
@@ -72,7 +71,6 @@ var (
 	ResourceMetaResourceFactorAPIKey                     = NewResourceMetaResource(KindFactorAPIKey, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceLicense                          = NewResourceMetaResource(KindLicense)
 	ResourceMetaResourceSubscription                     = NewResourceMetaResource(KindSubscription)
-	ResourceMetaResourceDeploymentHost                   = NewResourceMetaResource(KindDeploymentHost, VerbList, VerbUpdate)
 	ResourceTelemetryResourceLogs                        = NewResourceTelemetryResource(KindLogs)
 	ResourceTelemetryResourceTraces                      = NewResourceTelemetryResource(KindTraces)
 	ResourceTelemetryResourceMetrics                     = NewResourceTelemetryResource(KindMetrics)

pkg/types/dashboardtypes/perses_dashboard.go

@@ -25,6 +25,10 @@ const (
 	dashboardNameSuffixLen = 8
 )
 
+// SystemDashboardNamePrefix is reserved for dashboards SigNoz ships and owns. Generated
+// names never contain consecutive hyphens, so only a typed name can carry it — create rejects that.
+const SystemDashboardNamePrefix = "signoz---"
+
 const (
 	dashboardIconPathPrefix = "/assets/Icons/"
 	dashboardLogoPathPrefix = "/assets/Logos/"
@@ -75,8 +79,8 @@ type DashboardV2 struct {
 }
 
 func (d *DashboardV2) ErrIfNotMutable() error {
-	if d.Source == SourceIntegration {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "integration dashboards cannot be modified")
+	if d.Source != SourceUser {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be modified", d.Source)
 	}
 	return nil
 }
@@ -95,6 +99,11 @@ func (d *DashboardV2) Update(updatable UpdatableDashboardV2, updatedBy string, r
 	if err := d.ErrIfNotUpdatable(); err != nil {
 		return err
 	}
+	return d.UpdateUnsafe(updatable, updatedBy, resolvedTags)
+}
+
+// UpdateUnsafe applies the update without the source/lock gate. Intended for internal system callers.
+func (d *DashboardV2) UpdateUnsafe(updatable UpdatableDashboardV2, updatedBy string, resolvedTags []*tagtypes.Tag) error {
 	if updatable.Name != d.Name {
 		return errors.NewInvalidInputf(ErrCodeDashboardImmutable, "name is immutable; cannot change from %q to %q", d.Name, updatable.Name)
 	}
@@ -129,6 +138,13 @@ func (d *DashboardV2) LockUnlock(lock bool, isAdmin bool, updatedBy string) erro
 	return nil
 }
 
+func (d *DashboardV2) ErrIfNotSystem() error {
+	if d.Source != SourceSystem {
+		return errors.Newf(errors.TypeNotFound, ErrCodeDashboardNotFound, "dashboard %q is not a system dashboard", d.Name)
+	}
+	return nil
+}
+
 func (d *DashboardV2) ErrIfNotClonable() error {
 	if !d.Source.isClonable() {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be cloned", d.Source)
@@ -205,13 +221,21 @@ type PostableDashboardV2 struct {
 	Spec         DashboardSpec          `json:"spec" required:"true"`
 }
 
-func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy string, source Source) *DashboardV2 {
+func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy string, source Source) (*DashboardV2, error) {
 	now := time.Now()
 
 	name := postable.Name
 	if postable.GenerateName {
 		name = generateDashboardName(postable.Spec.Display.Name)
 	}
+	// Checked on the final name, here rather than in validateName, because only
+	// the constructor knows the source.
+	if source != SourceSystem && strings.HasPrefix(name, SystemDashboardNamePrefix) {
+		return nil, errors.NewInvalidInputf(ErrCodeDashboardInvalidInput, "name %q is invalid: the %q prefix is reserved for system dashboards", name, SystemDashboardNamePrefix)
+	}
+	if source == SourceSystem && !strings.HasPrefix(name, SystemDashboardNamePrefix) {
+		return nil, errors.NewInvalidInputf(ErrCodeDashboardInvalidInput, "name %q is invalid: system dashboard names must start with the %q prefix", name, SystemDashboardNamePrefix)
+	}
 
 	return &DashboardV2{
 		Identifiable:            types.Identifiable{ID: valuer.GenerateUUID()},
@@ -224,7 +248,7 @@ func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy
 		Name:                    name,
 		Tags:                    tagtypes.NewTagsFromPostableTags(orgID, coretypes.KindDashboard, postable.Tags),
 		Spec:                    postable.Spec,
-	}
+	}, nil
 }
 
 func (p *PostableDashboardV2) UnmarshalJSON(data []byte) error {

pkg/types/dashboardtypes/perses_dashboard_convertors_test.go

@@ -89,21 +89,25 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 	cases := []struct {
 		scenario       string
 		source         Source
+		name           string
 		expectedLocked bool
 	}{
 		{
 			scenario:       "user source is not locked",
 			source:         SourceUser,
+			name:           "my-dashboard",
 			expectedLocked: false,
 		},
 		{
 			scenario:       "system source is not locked",
 			source:         SourceSystem,
+			name:           SystemDashboardNamePrefix + "my-dashboard",
 			expectedLocked: false,
 		},
 		{
 			scenario:       "integration source is locked",
 			source:         SourceIntegration,
+			name:           "my-dashboard",
 			expectedLocked: true,
 		},
 	}
@@ -115,7 +119,7 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 					SchemaVersion: SchemaVersion,
 					Image:         "img",
 				},
-				Name: "my-dashboard",
+				Name: tc.name,
 				Tags: []tagtypes.PostableTag{
 					{Key: "team", Value: "platform"},
 					{Key: "env", Value: "prod"},
@@ -124,7 +128,8 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			}
 
 			before := time.Now()
-			dashboard := postable.NewDashboardV2(orgID, "alice", tc.source)
+			dashboard, err := postable.NewDashboardV2(orgID, "alice", tc.source)
+			require.NoError(t, err)
 			after := time.Now()
 
 			require.NotNil(t, dashboard)
@@ -160,8 +165,10 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			Spec:                    DashboardSpec{},
 		}
 
-		first := postable.NewDashboardV2(orgID, "alice", SourceUser)
-		second := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		first, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		require.NoError(t, err)
+		second, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		require.NoError(t, err)
 		assert.NotEqual(t, first.ID, second.ID, "expected distinct UUIDs across invocations")
 	})
 
@@ -174,7 +181,8 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			},
 		}
 
-		dashboard := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		dashboard, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		require.NoError(t, err)
 		assert.True(t, strings.HasPrefix(dashboard.Name, "my-dashboard-"), "expected slug prefix, got %q", dashboard.Name)
 		assert.Len(t, dashboard.Name, len("my-dashboard-")+dashboardNameSuffixLen)
 	})

pkg/types/dashboardtypes/perses_dashboard_patch_test.go

@@ -109,7 +109,8 @@ func TestPatchableDashboardV2_Apply(t *testing.T) {
 	var p PostableDashboardV2
 	require.NoError(t, json.Unmarshal([]byte(basePostableJSON), &p), "base postable JSON must validate")
 	testOrgID := valuer.GenerateUUID()
-	base := p.NewDashboardV2(testOrgID, "somecreatedthisiguess@signoz.io", SourceUser)
+	base, err := p.NewDashboardV2(testOrgID, "somecreatedthisiguess@signoz.io", SourceUser)
+	require.NoError(t, err)
 	base.Tags = []*tagtypes.Tag{
 		{Key: "team", Value: "alpha"},
 		{Key: "env", Value: "prod"},

pkg/types/dashboardtypes/perses_dashboard_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/perses/spec/go/dashboard"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -1928,3 +1929,37 @@ func TestEnsureSingleExpressionAggregation(t *testing.T) {
 		})
 	}
 }
+
+// Guards the constant: a prefixed name must stay a valid DNS-1123 label.
+func TestSystemDashboardNamePrefix(t *testing.T) {
+	require.NoError(t, validateDashboardName(SystemDashboardNamePrefix+"ai-o11y-overview"))
+}
+
+func TestNewDashboardV2RejectsReservedName(t *testing.T) {
+	testCases := []struct {
+		description string
+		name        string
+		source      Source
+		errContains string
+	}{
+		{description: "reserved name for a system dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceSystem},
+		{description: "reserved name for a user dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceUser, errContains: "reserved for system dashboards"},
+		{description: "reserved name for an integration dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceIntegration, errContains: "reserved for system dashboards"},
+		{description: "unprefixed name for a system dashboard", name: "overview", source: SourceSystem, errContains: "must start with"},
+		{description: "ordinary name for a user dashboard", name: "overview", source: SourceUser},
+		{description: "fewer hyphens than the prefix for a user dashboard", name: "signoz--overview", source: SourceUser},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.description, func(t *testing.T) {
+			postable := PostableDashboardV2{Name: testCase.name}
+			_, err := postable.NewDashboardV2(valuer.GenerateUUID(), "user@signoz.io", testCase.source)
+			if testCase.errContains != "" {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), testCase.errContains)
+				return
+			}
+			require.NoError(t, err)
+		})
+	}
+}

pkg/types/dashboardtypes/store.go

@@ -13,6 +13,9 @@ type Store interface {
 
 	Get(context.Context, valuer.UUID, valuer.UUID) (*StorableDashboard, error)
 
+	// GetByName resolves a dashboard by its per-org unique name.
+	GetByName(ctx context.Context, orgID valuer.UUID, name string) (*StorableDashboard, error)
+
 	GetPublic(context.Context, string) (*StorablePublicDashboard, error)
 
 	GetDashboardByOrgsAndPublicID(context.Context, []string, string) (*StorableDashboard, error)

pkg/types/systemdashboardtypes/definition.go

@@ -0,0 +1,95 @@
+package systemdashboardtypes
+
+import (
+	"bytes"
+	"encoding/json"
+	"slices"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+)
+
+// Definition is one shipped system dashboard. Version is bumped on every content
+// change and drives upgrade detection; the name is the stable key and never changes.
+type Definition struct {
+	Version   int                                `json:"version"`
+	Dashboard dashboardtypes.PostableDashboardV2 `json:"definition"`
+}
+
+func (definition Definition) Name() string {
+	return definition.Dashboard.Name
+}
+
+func NewDefinition(raw []byte) (Definition, error) {
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+
+	var definition Definition
+	if err := decoder.Decode(&definition); err != nil {
+		return Definition{}, errors.WrapInvalidInputf(err, ErrCodeSystemDashboardDefinitionInvalid, "%s", err.Error())
+	}
+	if err := definition.validate(); err != nil {
+		return Definition{}, err
+	}
+
+	return definition, nil
+}
+
+func (definition Definition) validate() error {
+	if definition.Version < 1 {
+		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "version must be at least 1, got %d", definition.Version)
+	}
+	if !strings.HasPrefix(definition.Name(), dashboardtypes.SystemDashboardNamePrefix) {
+		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "name %q must start with %q", definition.Name(), dashboardtypes.SystemDashboardNamePrefix)
+	}
+	if definition.Dashboard.GenerateName {
+		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "%s: generateName is not allowed, the name is the stable key", definition.Name())
+	}
+
+	return nil
+}
+
+// ToUpdatable is how an upgrade re-applies a definition onto an existing row:
+// everything but the dashboard's identity comes from the shipped definition.
+func (definition Definition) ToUpdatable() dashboardtypes.UpdatableDashboardV2 {
+	return dashboardtypes.UpdatableDashboardV2{
+		DashboardV2MetadataBase: definition.Dashboard.DashboardV2MetadataBase,
+		Name:                    definition.Dashboard.Name,
+		Tags:                    definition.Dashboard.Tags,
+		Spec:                    definition.Dashboard.Spec,
+	}
+}
+
+// Registry holds every definition embedded in the binary, keyed by name.
+type Registry struct {
+	definitions map[string]Definition
+}
+
+func NewRegistry(definitions []Definition) (Registry, error) {
+	byName := make(map[string]Definition, len(definitions))
+	for _, definition := range definitions {
+		if _, duplicate := byName[definition.Name()]; duplicate {
+			return Registry{}, errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "duplicate system dashboard name %q", definition.Name())
+		}
+		byName[definition.Name()] = definition
+	}
+
+	return Registry{definitions: byName}, nil
+}
+
+func (registry Registry) Get(name string) (Definition, bool) {
+	definition, ok := registry.definitions[name]
+	return definition, ok
+}
+
+// List returns the definitions sorted by name so provisioning order is stable.
+func (registry Registry) List() []Definition {
+	definitions := make([]Definition, 0, len(registry.definitions))
+	for _, definition := range registry.definitions {
+		definitions = append(definitions, definition)
+	}
+	slices.SortFunc(definitions, func(a, b Definition) int { return strings.Compare(a.Name(), b.Name()) })
+
+	return definitions
+}

pkg/types/systemdashboardtypes/system_dashboard.go

@@ -0,0 +1,58 @@
+package systemdashboardtypes
+
+import (
+	"context"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/uptrace/bun"
+)
+
+var (
+	ErrCodeSystemDashboardNotFound           = errors.MustNewCode("system_dashboard_not_found")
+	ErrCodeSystemDashboardDefinitionInvalid  = errors.MustNewCode("system_dashboard_definition_invalid")
+	ErrCodeSystemDashboardAlreadyProvisioned = errors.MustNewCode("system_dashboard_already_provisioned")
+)
+
+// ProvisionerIdentity is stamped into created_by/updated_by by the reconciler. It
+// is deliberately not a valid email, so it can never collide with a real account:
+// any other value in updated_by means a foreign write.
+const ProvisionerIdentity = "signoz"
+
+type Store interface {
+	Create(ctx context.Context, storable *StorableSystemDashboard) error
+
+	Get(ctx context.Context, orgID valuer.UUID, name string) (*StorableSystemDashboard, error)
+
+	UpdateVersion(ctx context.Context, orgID valuer.UUID, name string, version int) error
+
+	RunInTx(ctx context.Context, cb func(ctx context.Context) error) error
+}
+
+// StorableSystemDashboard records the shipped version each org's copy of a system
+// dashboard was last provisioned at. That version is the only thing the dashboard
+// row cannot answer, since the binary only embeds the latest definition.
+type StorableSystemDashboard struct {
+	bun.BaseModel `bun:"table:system_dashboard"`
+
+	types.Identifiable
+	types.TimeAuditable
+	OrgID       valuer.UUID `bun:"org_id,type:text,notnull"`
+	DashboardID valuer.UUID `bun:"dashboard_id,type:text,notnull"`
+	Name        string      `bun:"name,type:text,notnull"`
+	Version     int         `bun:"version,notnull"`
+}
+
+func NewStorableSystemDashboard(orgID valuer.UUID, dashboardID valuer.UUID, name string, version int) *StorableSystemDashboard {
+	now := time.Now()
+	return &StorableSystemDashboard{
+		Identifiable:  types.Identifiable{ID: valuer.GenerateUUID()},
+		TimeAuditable: types.TimeAuditable{CreatedAt: now, UpdatedAt: now},
+		OrgID:         orgID,
+		DashboardID:   dashboardID,
+		Name:          name,
+		Version:       version,
+	}
+}

tests/integration/testdata/role/managed_role_transactions.json

@@ -295,14 +295,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list",
-        "update"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",
@@ -506,13 +498,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",
@@ -669,13 +654,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",