logging — module 0.3

The audit/game/system log described in Architecture › Rule 7. The kernel creates the EventPipeline before any module runs, so early events aren't lost; this module attaches the sinks and watches their health. Source in modules/logging/; the pipeline itself is the log library.

What it does

• Attaches ConsoleLogSink always.
• Attaches ClickHouseLogSink (table log_events). Without a database, AUDIT events are spilled to <data>/log/audit-spill.jsonl and replayed when the database comes back.
• Attaches DiscordWebhookSink when any SHATTERVEIL_DISCORD_WEBHOOK_* variable is set.
• Every 5 minutes publishes a log.health SYSTEM event with the pipeline counters and each sink's status.
• Flushes the pipeline on disable.

Manifest

Field	Value
id	logging
version	0.1.0
security class	CRITICAL — owns the audit trail
kernel	yes
dependencies	none

Settings

Environment only:

Variable	Meaning
SHATTERVEIL_DISCORD_WEBHOOK_AUDIT	Webhook for AUDIT events
SHATTERVEIL_DISCORD_WEBHOOK_GAME	Webhook for GAME events
SHATTERVEIL_DISCORD_WEBHOOK_SYSTEM	Webhook for SYSTEM events
SHATTERVEIL_DISCORD_WEBHOOK_ALERTS	Webhook for ALERT-severity events, any category
SHATTERVEIL_DISCORD_ALERT_MENTION	Mention prefixed to alerts; default @here

Database settings come from the data library. Webhook URLs are secrets: keep them out of git.

Commands

None.

Security

• Trusted input: none from clients. Events come from modules through ModuleLog, already stamped with the submitting module's id by the kernel.
• Redactor strips secrets before storage; Discord gets summaries only.
• Audit rows are hash-chained; a tampered row breaks HashChain.verify.

When disabled

Never at runtime (kernel). Without it the pipeline still runs, but nothing leaves the process.

Tests

LoggingModuleTest: manifest, the toggle test (all sinks detached), and the no-database path — sinks attached, health task scheduled, an AUDIT event lands in the spill file with a valid chain link while a GAME event does not.