Collect line framing, password redaction and oversized-line discard in
one SslocalOutputIntake and dispatch redacted lines through a
destination seam: stderr (freopen'd into agent.log, raw capture kept
for ADR-0006 local viewing) and the unified log under category "sslocal",
reusing the shared subsystem.
Upstream free text is never routed through RuntimeLogEvent and is
marked private in the unified log as a whole (ADR-0014 warns default
upstream logs may contain server addresses). Levels derive from
whitespace-separated upstream level tokens: ERROR maps to .error,
WARN/WARNING maps to .default (unified logging has no warning level),
and anything else maps to .info so the unified-log surface persists
only detected problems while agent.log stays the persistent surface.
The intake lives in Domain/Runtime so the hostless test mirror compiles
it; unit tests drive raw chunks against fake destinations instead of
parsing agent.log text. The 1 MiB agent.log retention policy deliberately
stays on the file side shared with wrapper event lines.
Emit every RuntimeLogEvent to os.Logger under a shared subsystem with
per-event category and level, so GUI and wrapper output can be filtered
in Console.app. Public text is split from private detail (free-form error
text and connectivity measurement content) on the closed enum, keeping
server addresses out of the public log surface. The stderr line and the
event sink stay unchanged. Add the system log glossary term.
Ancestor groups of the active target now show a hollow bolt beside the
existing filled bolt on the target itself, in the servers tree, the
favorites table and the home target browser; the node detail subtitle
shows "含活动目标". The derivation lives in
CatalogTreeSnapshot.ancestors(of:) so every surface shares one rule
while activeTargetID stays a runtime fact outside the catalog
projection. Groups activated directly keep the filled bolt and leave
their member rows unmarked.
Wait for settings publications instead of a wall-clock polling budget. Separate DoH result aggregation from the real deadline check, and release gated probes after pass-through is enabled.
Separate Agent supervision from sslocal input and preserve the latest intent after deployment failure. Persist failure barriers, serialize publication and retirement, and verify reload and single-instance behavior with real processes.
Refs #83
Drop workflow port and credential prechecks that duplicated the store
gate. Credential shape is a save constraint only while LAN
authentication is enabled; terminal commands treat password() as a
usable secret without reshaping it.
Make systemProxyConfiguration total so a runtime document can no longer
swallow derivation via try? and silently skip desired system proxy
convergence. Delete the unreachable ProxyModeError / .mode failure fact
and its presentation; port validity stays at the settings store and the
document contract.
Each activation leaf was validated and then derived, resolving keychain
secrets and plugin facts twice and folding derivation failures back into
skips. Prepare once and hand the resolved facts to document assembly so
the catalog tree and activation share one judgment set without a dead
fold-back path.
Qiu Yuzhou