feat: add structured control tracing

This commit is contained in:
Eric Wendland 2026-07-05 23:09:12 +02:00
commit d9031b995d
4 changed files with 477 additions and 9 deletions

View file

@ -158,6 +158,12 @@ daemon errors include a `next:` recovery line for missing peer cards, missing
grants, missing resources, unavailable endpoints, and missing DB/KV/document
registrations.
Daemon logs use structured `tracing` fields for local control requests:
`command`, `peer_node`, `resource`, `capability`, `stream`, and stable
`error_code` where applicable. The request tracer classifies requests instead of
formatting full payloads, so bearer tokens, private key paths, packet/message
payloads, and document JSON are not logged by that layer.
Host-opening paths are intentionally narrow. TCP pipe forwarding accepts only
explicit loopback socket addresses on both the local listener and remote target;
Unix pipe forwarding requires absolute paths without parent-directory