Schema

Use this reference to inspect fields, methods, accepted values and failure outcomes. For setup and working examples, start with the API guide.

Definition: abstraction.logging

Service `Sink` [DEF-S1]

A sink for structured log records across a service boundary.

Wire identity: abstraction.logging/sink@1

Multiple services share this namespace. Generated ServiceName (Go) and service_name (C++/Python) validate the request envelope and version before returning its service identity for routing. The selected generated dispatcher validates the method and typed arguments; the selector does not authorize callers or interpret method payloads.

Frames carry version, service, method and typed arguments. Transport owns framing, associated exchanges, deadlines and connections. Unknown version/service/method and malformed arguments are rejected before invoking a handler. One-way WriteFrame success means local submission, not remote acceptance or persistence.

Submit a log record. Completion confirms local transport submission only.

`Write`

oneway void

Argument 1: Record record (required, including zero/false/empty)

Service `HistoryReader` [DEF-S1]

Authorized bounded access to retained logging history. Applications receive records and opaque cursors; history location and retention belong to the provider.

Wire identity: abstraction.logging/reader@1

Handler error codes, declared by history_error_codes: caller_unavailable, identity_required, wrong_user, policy_unavailable, forbidden. Generated bindings name each as a ServiceErrorCode member beside the dispatcher's own codes.

Request-response methods use ExchangeFrame. Replies carry version, service, method, ok and payload; success payload contains typed value (or an empty object for void). Error payload contains nonempty code and message, which may be empty. ServiceError preserves unknown codes. Unexpected handler failures become handler_error without private details; invalid results become invalid_result. Clients validate reply identity and result before exposing it. A malformed frame or transport failure remains a local error; the transport must associate each response with its exchange. C++ dispatchers are pure protocol bindings, not listening servers.

Read retained records through the service. Empty cursor starts at earliest retained history. Cursor end (history_cursor_words) starts at the current end: the page holds no records, at_end is true and next continues from that end. Limits are 1..256 records and 1..65536 encoded-record bytes; a first record that exceeds the byte limit gives record_too_large. A provider without history gives unavailable. Cursors may expire on restart or retention changes, reported as gap. Snapshot reads may be repeated at end; this method promises no subscription or persistence acknowledgement. The receiving service authorizes history access from native caller evidence.

`Read`

request-response Page

Argument 1: string cursor (required, including zero/false/empty)
Argument 2: i64 max_records (required, including zero/false/empty)
Argument 3: i64 max_bytes (required, including zero/false/empty)

Service `HistoryObserver` [DEF-S1]

Authorized bounded long-poll history observation with provider-owned notifications.

Wire identity: abstraction.logging/observer@1

Read with the same bounds and cursor semantics as HistoryReader. Cursor end fixes the current end when the call begins and returns only records appended after it. At an empty current end, wait up to wait_ms (0..30000) for a provider notification, then reread once; expiry may return an empty current-end page. Cancellation stops waiting and does not undo logging. Providers without observation return unsupported. Bounded waiter capacity exhaustion returns unavailable. Authorization is rechecked before records return. This is long-poll observation; external file writers have no notification promise.

`Observe`

request-response Page

Argument 1: string cursor (required, including zero/false/empty)
Argument 2: i64 max_records (required, including zero/false/empty)
Argument 3: i64 max_bytes (required, including zero/false/empty)
Argument 4: i64 wait_ms (required, including zero/false/empty)

Service `ApplicationHistoryReader` [DEF-S1]

Wire identity: abstraction.logging/reader@2

Handler error codes, declared by history_identity_error_codes: caller_unavailable, identity_required, wrong_user. Generated bindings name each as a ServiceErrorCode member beside the dispatcher's own codes.

Read one or all emitting programs. Bounds are 1..256 returned records and 1..65536 encoded Record bytes; scan work is independently bounded. Empty cursor starts earliest retained history; end fixes the current physical end. One consistent Rights snapshot governs selection and concrete outgoing emitters. No fallback to account-wide reader@1 is permitted.

`Read`

request-response ApplicationLogPage

Argument 1: ApplicationLogTarget target (required, including zero/false/empty)
Argument 2: string cursor (required, including zero/false/empty)
Argument 3: i64 max_records (required, including zero/false/empty)
Argument 4: i64 max_bytes (required, including zero/false/empty)

Service `ApplicationHistoryObserver` [DEF-S1]

Wire identity: abstraction.logging/observer@2

Read with reader@2 semantics, waiting once at an empty physical end for 0..30000 ms. Unrelated writes can produce filtered progress. Cancellation, fixed deadline and bounded waiter capacity apply. Authorization is reevaluated before delivery; no decision is retained across waits or pages.

`Observe`

request-response ApplicationLogPage

Argument 1: ApplicationLogTarget target (required, including zero/false/empty)
Argument 2: string cursor (required, including zero/false/empty)
Argument 3: i64 max_records (required, including zero/false/empty)
Argument 4: i64 max_bytes (required, including zero/false/empty)
Argument 5: i64 wait_ms (required, including zero/false/empty)

Service `SourceReader` [DEF-S1]

Authorized bounded reads from fixed, read-only operating-system log sources.

Wire identity: abstraction.logging/source-reader@1

List the runtime's fixed platform source identifiers and current access status. Source IDs are not paths or query expressions. Per-source OA rights are checked before native probing; a refused source is listed as permission_denied without a native access attempt.

`Sources`

request-response SourceCatalog

Read one fixed source with bounds of 1..256 entries and 1..65536 encoded SourceRecord bytes. The service checks the exact source-specific right before native access. A provider without a source returns unsupported; OA policy denial returns not_permitted, known native access denial returns forbidden and uncertainty returns unavailable. Invalid semantic bounds return invalid. Refusals contain no records, preserve the supplied cursor and never announce end. Empty cursor starts at the earliest visible retained entry the native API exposes. Cursors bind source ID and reader instance; source mismatch, restart or retention loss returns gap and preserves the cursor. No cross-source ordering, complete-capture claim or observation guarantee is made.

`Read`

request-response SourcePage

Argument 1: string source_id (required, including zero/false/empty)
Argument 2: string cursor (required, including zero/false/empty)
Argument 3: i64 max_records (required, including zero/false/empty)
Argument 4: i64 max_bytes (required, including zero/false/empty)

Return an opaque baseline cursor at the source's current end without returning records. The exact source-specific right is checked before native access and rechecked before the cursor is returned. A source without a safe current-position operation returns unsupported. Use the returned cursor with Read to request entries that follow this observed end; an empty source produces a valid empty baseline. If no native entry exists at the baseline, a later retention loss before the first read may be undetectable. Cursors bind source ID and reader instance; restart or detectable retention loss returns gap. This is a cursor operation, not a watch or complete-capture guarantee.

`StartAtEnd`

request-response SourcePage

Argument 1: string source_id (required, including zero/false/empty)

Encoding [DEF-E1]

setting	value	rule
`escape`	`minimal`	[DEF-E2]
`indent`	`2`	[DEF-E3]
`map_keys`	`utf8-bytes`	[DEF-E4]
`numbers`	`integer-decimal`	[DEF-E5]
`opaque`	`verbatim`	[DEF-E6]
`terminator`	`newline`	[DEF-E7]
`duplicate_keys`	`last`	[DEF-E8]
`depth_limit`	`64`	[DEF-E9]

Types

kind	types
built in	`ApplicationLogSelection` `HistoryPageOutcome` `PageOutcome` `SourceAvailability` `SourceCatalogOutcome` `bool` `i64` `string`
declared below	`ProducerClaim` `Record`
container [DEF-T3]	`list<SourceLimitation>`
repeated record [DEF-A9]	`list<Attestation>` `list<Record>` `list<SourceDescriptor>` `list<SourceRecord>`
string map [DEF-A10]	`map<string,string>`

Named types [DEF-T2]

One spelling is written [DEF-G2] and a wider set is read [DEF-G1]; the width between them is the interoperability guarantee.

name	is	written	read
`timestamp`	`string`	`rfc3339-micros`	`rfc3339-wide`

Structs [DEF-T1]

A field is required, or says when it is omitted [DEF-A4]. Each struct says on its own what it does with a field name it has never heard of [DEF-A7]. A wire name never moves; where a language must spell it differently the field says so [DEF-A2].

`Attestation`

unknown fields grant

id	field	type	presence	named elsewhere
1	`by`	`string`	required	—
2	`verified`	`bool`	required	—
3	`hop`	`i64`	required	—
4	`program`	`string`	optional · omitted when zero	—
5	`host`	`string`	optional · omitted when zero	—
6	`user`	`string`	optional · omitted when zero	—
7	`exe`	`string`	optional · omitted when zero	—
8	`uid`	`i64`	required	—
9	`gid`	`i64`	required	—
10	`pid`	`i64`	required	—
11	`key`	`string`	optional · omitted when zero	—
12	`mac`	`string`	optional · omitted when zero	—

`Record`

the document [DEF-A1] · unknown fields grant

id	field	type	presence	named elsewhere
1	`schema`	`i64`	required; equals `1`; refusal `bad_schema`	—
2	`time`	`timestamp`	required	—
3	`level`	`i64`	required	—
4	`msg`	`string`	required	—
5	`identity`	`list<Attestation>`	optional · omitted when zero	—
6	`job`	`string`	optional · omitted when zero	—
7	`attrs`	`map<string,string>`	optional · omitted when zero	—

`Page`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`PageOutcome`	required	—
2	`records`	`list<Record>`	required	—
3	`next`	`string`	required	—
4	`at_end`	`bool`	required	—

`ApplicationLogTarget`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`selection`	`ApplicationLogSelection`	required	—
2	`program`	`string`	optional · omitted when absent	—

`ApplicationLogResource`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`program`	`string`	required	—
2	`captured_file_key`	`string`	optional · omitted when absent	—

`ApplicationLogPage`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`HistoryPageOutcome`	required	—
2	`records`	`list<Record>`	required	—
3	`next`	`string`	required	—
4	`at_end`	`bool`	required	—

`SourceDescriptor`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`id`	`string`	required	—
2	`availability`	`SourceAvailability`	required	—
3	`limitations`	`list<SourceLimitation>`	required	—

`SourceCatalog`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`sources`	`list<SourceDescriptor>`	required	—
2	`outcome`	`SourceCatalogOutcome`	required	—

`ProducerClaim`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`provider`	`string`	optional · omitted when zero	—
2	`program`	`string`	optional · omitted when zero	—
3	`exe`	`string`	optional · omitted when zero	—
4	`user`	`string`	optional · omitted when zero	—
5	`pid`	`i64`	optional · omitted when zero	—
6	`uid`	`i64`	optional · omitted when zero	—
7	`gid`	`i64`	optional · omitted when zero	—

`SourceRecord`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`source_id`	`string`	required	—
2	`record`	`Record`	required	—
3	`producer`	`ProducerClaim`	optional · omitted when absent	—

`SourcePage`

unknown fields refuse

id	field	type	presence	named elsewhere
1	`outcome`	`HistoryPageOutcome`	required	—
2	`records`	`list<SourceRecord>`	required	—
3	`next`	`string`	required	—
4	`at_end`	`bool`	required	—

Enumerations [DEF-T5]

Enum fields carry JSON strings containing exact member wire spellings, never numeric IDs. Unknown names are preserved with grant and refused as bad_enum with refuse on read and write. Optional absent fields preserve presence separately from an empty string.

An enumeration is a closed vocabulary of wire names, and each one says on its own what a reader does with a member it has never heard of [DEF-A5].