Module logging 

Where diagnostics go, and where they must never go.

Every diagnostic this executable emits is written to stderr, structured, filtered by LOG_ENV and defaulting to info. stdout is never touched here, and that is the whole reason this module exists as a boundary rather than as two lines in main: stdout belongs to the protocol. An MCP client reads JSON-RPC framing from it, a shell reads the JSON a command printed, and one stray line of logging on that stream is a parse error in the caller rather than a message to a person.

Nothing the log writes carries a credential the redactor knows (I2708). A server started in the background writes this stream to server.log, a file nobody reads before it is kept, and a field logged at a call site — a request path, an origin, an error’s text — can hold whatever a caller sent. So every field of every event and span, the message among them, is formatted through one layer, subscriber’s field formatter, which passes the field’s text through redaction::redact_secrets before it is written. There is no second rule set and no per-call-site opt-in: a field added tomorrow is redacted because it is a field. A string field is redacted before it is quoted, and a debugged value whose escaped quotes hide a shape is redacted as if they were plain, so an escape cannot hide a credential from the redactor.

The subscriber is installed once per process. A second call is a no-op rather than an error, so a command that initialises defensively cannot fail because something already did it.

use majordomus_cli::logging;

// installing twice is safe, which is the property every caller relies on
logging::init();
logging::init();
assert_eq!(logging::LOG_ENV, "MAJORDOMUS_LOG");

Constants

LOG_ENV

The environment variable that sets the log filter, e.g. debug or majordomus_cli=trace.

Functions

init

Install the stderr subscriber once; a second call is a no-op.

subscriber

The subscriber init installs, writing to writer under filter.