BobSong-dev opened a new issue, #7950: URL: https://github.com/apache/shenyu/issues/7950
## Background P1-06 in the mentor-approved OSPP plan; parent #7949. Metrics and traces do not replace a correlated, privacy-preserving decision/terminal audit record, especially for requests rejected before execution. ## Existing capabilities and reuse Reuse the logging SPI/collectors, trusted identity, immutable request context and terminal observations from P0-02/P0-03 and P1-05 (#7811, #7827, #7860, #7921). Reuse existing queue/drop instrumentation (#7687), not another logging delivery subsystem. At the research baseline those later context/observability PRs remained open; integrate against their final merged contracts. ## Implementation scope - Define a versioned audit record containing trusted tenant/subject, internal API-key identifier when available, target/model/tool, configuration/policy versions, decision, bounded reason code, terminal status and correlation identifiers. - Emit one terminal record per logical invocation, including authentication/authorization/admission rejection before upstream execution. Correlate separate upstream-attempt records without counting them as additional logical calls. - Use bounded nonblocking delivery through existing logging extension points. Specify queue capacity, overflow/drop visibility, sink-error handling, shutdown behavior and the actual delivery guarantee. - Omit prompts, arguments, response bodies and credentials by default. Do not use W3C trace IDs as identity or raw API keys as identifiers. ## Non-goals A new authorization server, a billing/usage ledger (owned by #7934), guaranteed lossless remote delivery, body logging, or replacing existing metrics/tracing. ## Acceptance criteria - [ ] Success, failure, timeout, cancellation and pre-execution rejection have correctly correlated, tenant-isolated records with one logical terminal event. - [ ] Retry/fallback attempts retain separate identities; late or duplicate terminal callbacks do not duplicate logical completion. - [ ] Queue saturation and sink failures are observable and never block gateway event loops or leak sensitive data. - [ ] Record schema, retention/delivery limitations, configuration and reason-code semantics are documented. ## Tests Unit tests for record mapping/redaction/terminal idempotence; concurrent Reactor-context isolation tests; a real logging-sink fixture covering slow/failing sinks, queue overflow and shutdown; regression tests confirming unchanged response status/body and existing logging metrics. ## Dependencies P0-02, P0-03 and P1-05 contracts; #7860 and #7921 integration availability. P1-11/P1-12 consume this record/decision vocabulary; they must not introduce competing audit records. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
