An invariant-guided model for automated detection of anomalous execution regimes from production telemetry

Modern cloud-based distributed software systems increasingly exhibit persistent changes in execution behaviour that cannot be adequately characterised by isolated events or threshold violations alone. Although contemporary production environments already provide mature observability infrastructures for collecting logs, metrics, and traces, the formal representation of execution regimes derived from such telemetry remains insufficiently developed. This paper proposes an invariant-guided geometric framework for modelling execution regimes and detecting anomalous regime transitions under weak supervision. The framework applies common principles of invariant-based feature mapping, weighted pseudometrics, and geometric regularisation to log-derived and KPI-derived regime representations. Separate evaluations of these modality-specific implementations on HDFS logs and operational KPI telemetry demonstrate consistent improvements over representative baseline methods under limited supervision while preserving an explicit and interpretable execution-regime representation. Joint evaluation using synchronized logs and metrics remains future work. The results support the framework as a mathematical analytical layer for execution-regime analysis that complements existing production observability infrastructures.