Structured logging contract

Chronacta servers emit JSON logs to stdout via slog (internal/observability/logging.go).

Required fields (gRPC access log)

Every completed RPC emits one rpc info record:

Field	Description
request_id	Correlation ID from x-request-id / request-id metadata, or server-generated UUID
method	Full gRPC method (/stream.v1.StreamService/AppendToStream)
grpc_code	gRPC status code string (OK, Unauthenticated, …)
duration_ms	Wall time in milliseconds
user	Authenticated username when auth is enabled
error	Present only when grpc_code != OK

The server echoes x-request-id in gRPC response headers when possible.

Redaction

String attributes whose keys match password, token, secret, authorization, or api_key are passed through security.RedactSecret before write.

Bearer tokens embedded in free-text messages are masked when they appear after Bearer .

Levels

Level	Usage
INFO	RPC access, startup/shutdown, scheduled jobs
WARN	Recoverable degradation
ERROR	Metrics listener failure, unrecoverable background errors

Log review checklist

• No raw bearer tokens, passwords, or webhook secrets in sample production logs
• Failed auth attempts include request_id but not submitted credentials
• RPC access lines include method, grpc_code, duration_ms
• Support bundle (chronacta support collect) redacts env secrets
• Trace IDs correlate when CHRONACTA_OTEL_ENABLED=true (W3C traceparent)

Tracing

Enable OTLP export:

Variable	Default	Purpose
CHRONACTA_OTEL_ENABLED	false	Install gRPC OpenTelemetry stats handler
CHRONACTA_OTEL_ENDPOINT	localhost:4317	OTLP gRPC collector
CHRONACTA_OTEL_SERVICE_NAME	chronacta-server	service.name resource attribute

See monitoring.md for metrics and SLO catalog.