[smith-xyz]

Plan: plans/traust-standardization/8-platform-api-and-sdk/19-shaun-ledger-diagnostics-integration.md

What

• pin reviewed traust-ledger provider diagnostics commit 78e1d8e26273f75755dd1c7d7c0cb2d35391fabb
• register traust_ledger by default whenever Core's Context configures logging, while keeping other consumer roots explicit
• carry safe provider, method and reason fields through Core's JSON/text formatter and the same selected handlers/correlation scope as Core service events
• report configured-but-failed optional append signing as a warning-level degraded committed service outcome rather than false success
• prove provider calls remain observable on rollback while committed service outcomes are suppressed

Review

Three independent read-only reviews covered logger ownership/duplication, sensitive-data flow, dependency pin/lock consistency, UOW correlation capture and transaction semantics. All returned no findings.

Verification

• make lint-fix
• make test: 8,160 passed, 1 skipped
• pre-push coverage: 96.72%, 8,160 passed, 1 skipped
• SQLite/Postgres ledger service suite: 125 passed, 1 expected SQLite concurrency skip
• no SQL or repository query changed; no perf run required

Reviewer checks (from the plan)

• Are provider and committed service events distinguishable but correlated, emitted once, and free of signing material and raw provider diagnostics?

Quality checklist

• 1. Comments only for the non-trivial
• 2. Docstrings don't bloat
• 3. Don't reinvent
• 4. Shared logic is a helper, in one place
• 5. Tests cover the edges
• 6. Integration tests are thorough and use real data, sanitized
• 7. Minimal, clean code
• 8. Queries are low latency, and you checked (no query changed)
• 9. Tests change only on purpose, and a person said so (new cases only; no existing test changed)

Legacy files

File	Verdict	Where it went / why it's gone
None	reuse	Extends Core's existing installer, formatter and LedgerService outcomes; no path is replaced

Changed tests

No existing test expectation changed. New cases in tests/v1/services/test_ledger.py exercise selected outputs, end-to-end correlation/redaction, optional signing degradation and rollback suppression.

Dependencies / stack

• Base: PR feat(platform-api-and-sdk): first-party logging namespaces and complete ledger service outcomes (XWING-2440) #320 (feat/first-party-logging-namespaces-and-complete-ledg), which provides first-party logger registration and public correlation scopes.
• Pinned dependency: traust-ledger PR feat(services): reporting door over a caller's report document (XWING-2440) #148 reviewed head 78e1d8e26273f75755dd1c7d7c0cb2d35391fabb.

Review this PR as the small integration layer on top of #320; it will be rebased/retargeted to development after the base merges.

[qodo-for-traust-security]

PR Summary by Qodo

Integrate ledger diagnostics with Core logging

✨ Enhancement 🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 20-40 Minutes

---

AI Description

• Route ledger provider diagnostics through Core’s selected outputs and correlation scope.
• Report committed appends with failed optional signing as degraded warnings, not successes.
• Pin the diagnostics-enabled ledger revision and test redaction, output selection, and rollback
 behavior.

Diagram

graph TD
  Context["Core Context"] --> Installer["Logging installer"] --> Formatter["Safe formatter"] --> Outputs["Selected outputs"]
  Service["Ledger service"] --> Provider["Ledger provider"] --> Formatter
  Service --> UOW["Unit of work"] --> Formatter

Loading

High-Level Assessment

Reuse the existing first-party logging installer, safe formatter, and after-commit outcome mechanism. A separate ledger handler would duplicate output configuration and risk duplicate or inconsistently correlated events.

Files changed (6) +134 / -7

Enhancement (2) +7 / -1

context.pyRegister ledger logging by default +1/-1

Register ledger logging by default

• Adds 'traust_ledger' to the logger roots configured by Context while leaving other additional roots explicit.

src/traust_core/v1/context/context.py

logging.pyPreserve safe ledger diagnostic fields +6/-0

Preserve safe ledger diagnostic fields

• Adds provider, method, and reason to the formatter’s JSON fields and text output so ledger diagnostics retain their structured context.

src/traust_core/v1/context/logging.py

Bug fix (1) +3 / -1

ledger.pyWarn when an appended decision has failed optional signing +3/-1

Warn when an appended decision has failed optional signing

• Emits a warning-level 'degraded' append outcome when its checkpoint reports failed signing, instead of calling the committed append a success. The service outcome remains deferred until commit.

src/traust_core/v1/services/ledger.py

Tests (1) +119 / -0

test_ledger.pyCover correlated ledger diagnostics and transaction outcomes +119/-0

Cover correlated ledger diagnostics and transaction outcomes

• Adds integration cases for selected outputs, one provider and one service event per destination, shared correlation fields, and redaction. Also verifies degraded signing outcomes and provider visibility without a committed service event on rollback.

tests/v1/services/test_ledger.py

Other (2) +5 / -5

pyproject.tomlPin the diagnostics-enabled traust-ledger revision +1/-1

Pin the diagnostics-enabled traust-ledger revision

• Updates the Git dependency to the reviewed ledger commit that emits provider diagnostics.

pyproject.toml

uv.lockLock the reviewed traust-ledger commit +4/-4

Lock the reviewed traust-ledger commit

• Updates the ledger dependency and source references to match pyproject.toml. The lockfile also changes its revision and rewrites an equivalent Python resolution marker.

uv.lock

[qodo-for-traust-security]

Code Review by Qodo

📜 Skill insights (1)

---

View medium (1)

🟠 **Medium**

1. Ledger outcomes remain untyped 📜 Skill insight ⭐ New

Description

append_decision passes the new degraded outcome as a plain string to _log_outcome, whose
outcome parameter is also typed as str. The append logging vocabulary now includes a finite
status without a shared StrEnum, so later callers can add misspelled values without a type-level
check.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

Issue description
The new `degraded` ledger outcome is represented as an unrestricted string, even though ledger outcomes form a closed set.

Fix Focus Areas
- src/traust_core/v1/services/ledger.py[60-70]
- src/traust_core/v1/services/ledger.py[157-161]

Recommended Fix
Define a `StrEnum` for ledger log outcomes, annotate `_log_outcome` with that enum, and pass the enum member for `degraded` and the existing outcome values. Preserve the emitted string values in the formatter output.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

---

---

Resolved findings

1. Ledger events leak into logs ✗ Dismissed

Description

Context.configure_logging() now routes every traust_ledger logger through Core’s handlers, whose
formatter writes the complete log message without redacting it. In traust-ledger, a failed event
parse logs the raw event dictionary, so a process using both repositories can write event contents
to Core’s selected stderr or log file.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Registering the entire traust-ledger logger namespace sends raw event diagnostics to Core’s outputs.

## Fix Focus Areas
- src/traust_core/v1/context/context.py[335-336]
- src/traust_core/v1/context/logging.py[91-123]
- /cross_repos/traust-ledger/src/traust_ledger/_internal/gates.py[322-330]

## Recommended Fix
Capture only explicitly safe ledger diagnostic records, or coordinate a change in traust-ledger to remove raw event contents from its messages before enabling the whole namespace by default.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

---