devbench 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be38d75135b0a120747e5abf3889afadb0997377f8d58510abb5a3baadf41d64
-  data.tar.gz: d2791c38e21e79d204e71a22aa3337793b9641976827aeb0f5e6dd54a7f811dc
+  metadata.gz: 61008f8defbff11fd3e079f568739cc25114bc05fb0f8981c5084f83d4770de4
+  data.tar.gz: d0304643c20cdb7fc413771188d60ee1881ae9e760129c22fd32d63aebea0bd5
 SHA512:
-  metadata.gz: 3f323a0cd9aa89ed80cee8fa78c8598c992f8ac15200bc7bf98ee5cc211079dc1458237c782479c150643a944683b27fe3b295222d1f7b2e8ec5a3bf0bacab5c
-  data.tar.gz: ec896fbc0a0d4d65d6259a83186f81df942cc09d0f437995cc34f80a4ab66c0864b90c948b944054c8404fa1f16047b002f7f5d2c56f84a9500dbaf304bc4d25
+  metadata.gz: 8af3f77395bf0f10fddf36e0cdfcfdfd85aa2e1528d08c4abc170eeffd318021d657824d24b8f1dfb8fdba1da71b904760ffffdee84a4d50944ab63f41a3f5db
+  data.tar.gz: c59ffb19a9739467182f6e4bf15b4ad68ebeb18d2eaabb79a17b15a24de40bde6230247bc58d8085368ef7be2b562986360dd0d5e90a45334d63adf739976938

data/README.md

@@ -1,24 +1,27 @@
 # Dev Bench for Ruby and Rails
 
 Everything Sentry's Rails SDK captures by default, plus who was affected,
-trace propagation and the handled-failure header — so an app can turn
-Sentry off. Zero runtime dependencies; loads in plain Ruby, hooks itself
+the server log lines of a failing request, the browser sensor, trace
+propagation and the handled-failure header — so an app can turn Sentry
+off. Zero runtime dependencies; loads in plain Ruby, hooks itself
 into Rails when Rails is there.
 
 ## Install (Rails)
 
-```ruby
-# Gemfile
-gem 'devbench'
+```sh
+bundle add devbench
+bin/rails generate devbench
 ```
 
+Then set **one** value in the app's environment — the DSN `adt dsn create`
+printed for this environment:
+
 ```sh
-# The DSN Dev Bench gave you for this environment
-DEVBENCH_DSN=https://<key>@adt-ingest.onrender.com
+DEVBENCH_DSN=https://<public>:<secret>@adt-ingest.onrender.com
 ```
 
-That is the whole install. No middleware line, no initializer, no process
-to run next to the app. Check it:
+That is the whole install: no browser key, no sidecar, no service names,
+no initializer, no middleware line. Check it:
 
 ```sh
 bin/rails devbench:test
@@ -30,16 +33,51 @@ It prints the HTTP result, or says plainly what is wrong (`DEVBENCH_DSN is
 not set`, `HTTP 401: the key in DEVBENCH_DSN was rejected`, `could not reach
 …`) and exits non-zero. Outside Rake: `Devbench.test!`.
 
+What the generator does, and nothing else (run it again and nothing
+changes):
+
+- puts `<%= devbench_script_tag %>` in `app/views/layouts/application.html.erb`
+  just before `</head>` (`.haml` / `.slim`: `= devbench_script_tag` as the
+  last line of `head`). Without that layout it prints what to add where.
+- if `config/initializers/content_security_policy.rb` defines a policy,
+  adds `https://unpkg.com` to `script_src`, and the ingest host and
+  `https://*.storage.supabase.co` (evidence uploads) to `connect_src`.
+
+### The browser tag
+
+`devbench_script_tag` renders the browser sensor, version-pinned to this
+gem (upgrading the gem upgrades the sensor), with **only the public part**
+of `DEVBENCH_DSN`:
+
+```html
+<script src="https://unpkg.com/devbench@0.6.0/dist/devbench.min.js"
+        data-dsn="https://<public>@adt-ingest.onrender.com" data-release="<release>" defer></script>
+```
+
+The secret never reaches a page. Without a DSN (or with a 0.5 single-key
+DSN, or `DEVBENCH_ENABLED=false`) it renders nothing at all, so a
+development or test environment without a DSN serves no tag. If the app
+uses CSP nonces (`content_security_policy_nonce_generator`), the tag
+carries the request's nonce.
+
+**CSP:** if your policy is defined somewhere other than the standard
+initializer, add these yourself:
+
+```ruby
+policy.script_src  ..., "https://unpkg.com"
+policy.connect_src ..., "https://adt-ingest.onrender.com", "https://*.storage.supabase.co"
+```
+
 ## Configuration
 
 All optional except the DSN.
 
 | Variable | Default | |
 |---|---|---|
-| `DEVBENCH_DSN` | — (falls back to `ADT_DSN`) | `https://<key>@<host>[:port]`. Plain `http://` is accepted only for localhost. |
-| `DEVBENCH_SERVICE` | your app's module, underscored (`AcmeShop` → `acme_shop`); `app` outside Rails | Groups this app's issues. |
+| `DEVBENCH_DSN` | — (falls back to `ADT_DSN`) | `https://<public>:<secret>@<host>[:port]` from `adt dsn create`. The server authenticates with the secret; the page gets the public part. A 0.5 `https://<key>@<host>` still works (no browser tag, see below). Plain `http://` is accepted only for localhost. |
+| `DEVBENCH_SERVICE` | your app's module, underscored (`AcmeShop` → `acme_shop`); `app` outside Rails; **`<that>-sidekiq` in a Sidekiq process** | Groups this app's issues. Set it and it wins everywhere. |
 | `DEVBENCH_RELEASE` | `GIT_SHA`, `SOURCE_VERSION`, `RENDER_GIT_COMMIT`, else empty | Which deploy an occurrence came from. |
-| `DEVBENCH_ENABLED` | on | `false` turns everything off: no middleware, no hooks, nothing sent. |
+| `DEVBENCH_ENABLED` | on | `false` turns everything off: no middleware, no hooks, no tag, nothing sent. |
 
 Or from code, e.g. `config/initializers/devbench.rb`:
 
@@ -51,7 +89,7 @@ end
 ```
 
 A DSN that does not parse logs one `[devbench]` warning and reports
-nothing; it never raises into the app.
+nothing; it never raises into the app. Neither key is ever printed.
 
 ## What is captured automatically
 
@@ -94,8 +132,9 @@ Like the browser sensor, the gem does not send one request per error:
   Dev Bench sensor). Repeats cost a counter increment.
 - **Once a minute** a background thread sends the counts — fingerprint,
   how many, first/last seen, and up to 20 affected users each — in one
-  small request. Nothing is sent for a quiet minute, and what is left is
-  sent when the process exits (waiting at most 2 seconds).
+  small request. Nothing is sent for a quiet minute (except a small poll
+  while the process holds log lines, below), and what is left is sent
+  when the process exits (waiting at most 2 seconds).
 - **Detail only on request.** When Dev Bench sees a fingerprint for the
   first time it asks for evidence, and the gem uploads the stack and one
   example message — **templated and scrubbed first** (emails, numbers,
@@ -107,6 +146,33 @@ Like the browser sensor, the gem does not send one request per error:
   counted). Safe under forking servers (Puma, Unicorn, Sidekiq): each
   worker reports on its own.
 
+## Server log lines
+
+Triage reads the server's log lines for the user action that failed. With
+`DEVBENCH_DSN` set, the gem keeps them itself — no sidecar:
+
+- **What:** every line written to `Rails.logger` and `Sidekiq.logger`
+  while a request or job carries a trace (`x-adt-trace` from the browser
+  sensor; a job inherits the trace of the request that enqueued it).
+  Untraced lines are not kept. Rails 7.1+: a capturing logger joins
+  `Rails.logger`'s broadcast (it follows the app's level and `silence`,
+  and writes nothing); older Rails and `Sidekiq.logger`: a tee after the
+  logger's own write. **What your logger writes is unchanged.**
+- **Bounded:** per process, the newest 10,000 lines or 4 MiB, nothing older
+  than 15 minutes, 4 KiB per line. A logging call is never blocked on I/O
+  and never raises because of this.
+- **Sent only when asked:** when Dev Bench asks for a trace, the flush
+  thread sends that trace's lines from this process — the newest ≤ 200
+  lines / 64 KiB — **redacted first** with the same strict rules as
+  evidence (quoted values, numbers, emails, cards, tokens, credentials,
+  IPs and two-word names removed), plus any redaction rules Dev Bench has
+  learned for your app. A process holding lines it was not asked about
+  sends nothing but a small poll once a minute while it holds them.
+- **Forking servers:** each Puma worker and Sidekiq process keeps and
+  answers for its own lines; Dev Bench assembles them.
+
+A Rack app without Rails: `Devbench.capture_logs(logger)`.
+
 ## Who was affected
 
 Set it once per request, typically in `ApplicationController`:
@@ -198,11 +264,12 @@ browser cannot read `x-adt-handled` unless the server lists it in
 than overwrites. **A CORS layer that replaces the response header set will
 strip it** and detection will silently never fire; check the ordering.
 
-## Optional: the sidecar (server logs)
+## Optional: the sidecar
 
 The Dev Bench sidecar is a separate process that reads your app's log
 stream on the host and answers triage's requests for the log lines of one
-user action. It is optional; nothing above needs it.
+user action. It is optional: with a DSN the gem keeps those lines itself
+(above). It remains for setups that cannot load the gem.
 
 Without a DSN, the gem reports to the sidecar's unix socket instead
 (`$ADT_SIDECAR_SOCKET`, default `/tmp/adt-sidecar.sock`), exactly as 0.4
@@ -212,6 +279,26 @@ gem does not also write to its socket, so nothing is counted twice.
 Fingerprints are identical in both modes, so moving between them keeps
 every issue.
 
+## Upgrading from 0.5
+
+Nothing is required: a 0.5 single-key `DEVBENCH_DSN` keeps reporting
+exactly as before. To get server log lines and the browser tag from the
+same value, mint a pair and replace the DSN:
+
+```sh
+adt dsn create --tenant <tenant> --environment production
+# https://<public>:<secret>@adt-ingest.onrender.com
+```
+
+then run `bin/rails generate devbench` for the tag and CSP. A page that
+loaded the browser sensor with its own DSN can drop that and use the tag.
+
+One default changed: a Sidekiq process without `DEVBENCH_SERVICE` now
+reports as `<app>-sidekiq` (it was `<app>`), so job failures are grouped
+apart from web failures — and an existing job issue reappears once under
+the new name. Set `DEVBENCH_SERVICE` in the Sidekiq process to keep the
+old name.
+
 ## Upgrading from `adt` (0.4)
 
 - Change the Gemfile line to `gem 'devbench'`. `require 'adt'` and every
@@ -221,5 +308,5 @@ every issue.
 - `config.middleware.insert_before 0, ADT::Middleware` can stay or go: the
   Railtie sees it and does not insert a second one.
 - Running the sidecar and want to keep it that way? Change nothing else.
-  To report directly instead, set `DEVBENCH_DSN` (a key minted with
-  `--source server`); the sidecar then only serves logs.
+  To report directly instead, set `DEVBENCH_DSN` (from `adt dsn create`);
+  see "Upgrading from 0.5".

data/lib/devbench/config.rb

@@ -4,23 +4,31 @@ require 'uri'
 
 module Devbench
   # Where reports go, parsed from DEVBENCH_DSN (docs/SERVER_SDK_SPEC.md, "Dev
-  # Bench naming and configuration"):
+  # Bench naming and configuration"; DECISIONS #161):
   #
-  #   https://<ingest key>@<host>[:port]
+  #   https://<public>:<secret>@<host>[:port]    from `adt dsn create`
+  #   https://<key>@<host>[:port]                0.5 and earlier: one key
   #
-  # scheme://host[:port] is the ingest base and the userinfo is the key. A
-  # path or query, if present, is ignored: the key alone identifies tenant,
-  # environment and source.
+  # scheme://host[:port] is the ingest base. The secret (a server key) is
+  # what this process authenticates with; the public part (a browser key) is
+  # only ever handed to the page, via #browser_dsn. A single-key DSN keeps
+  # working with its one key and has no browser part — that key is a server
+  # secret and must never reach a page. A path or query, if present, is
+  # ignored: the keys alone identify tenant, environment and source.
   class DSN
     class Invalid < StandardError; end
 
     LOOPBACK = /\A(?:localhost|127(?:\.\d{1,3}){3}|::1|\[::1\])\z|\.localhost\z/i
+    SHAPE = 'https://<public>:<secret>@<host>'
 
-    attr_reader :base, :key
+    attr_reader :base, :key, :public_key
 
-    def initialize(base, key)
+    # key: what the server sends as X-ADT-Key (the secret, or a 0.5 DSN's
+    # single key). public_key: the browser key, or nil.
+    def initialize(base, key, public_key = nil)
       @base = base.freeze
       @key = key.freeze
+      @public_key = public_key&.freeze
       freeze
     end
 
@@ -28,8 +36,26 @@ module Devbench
       "#{@base}/v1/flush"
     end
 
-    # The DSN without its key, for messages and logs. The key is a secret
-    # on a server: it must never be printed.
+    # The self-test endpoint: validates the key, stores nothing.
+    def check_url
+      "#{@base}/v1/check"
+    end
+
+    def logs_url
+      "#{@base}/v1/logs"
+    end
+
+    # The DSN a browser may hold: https://<public>@host. Nil when there is
+    # no public part.
+    def browser_dsn
+      return nil if @public_key.nil?
+
+      scheme, rest = @base.split('://', 2)
+      "#{scheme}://#{URI.encode_www_form_component(@public_key)}@#{rest}"
+    end
+
+    # The DSN without its keys, for messages and logs. The secret must never
+    # be printed.
     def to_s
       @base
     end
@@ -37,7 +63,7 @@ module Devbench
     alias inspect to_s
 
     # Raises DSN::Invalid with a message that says what to fix. Never echoes
-    # the key back.
+    # either key back.
     def self.parse(raw)
       text = raw.to_s.strip
       raise Invalid, 'is empty' if text.empty?
@@ -45,28 +71,32 @@ module Devbench
       uri = begin
         URI.parse(text)
       rescue URI::Error
-        raise Invalid, 'is not a URL (expected https://<key>@<host>)'
+        raise Invalid, "is not a URL (expected #{SHAPE})"
       end
 
       scheme = uri.scheme.to_s.downcase
-      raise Invalid, 'must start with https:// (expected https://<key>@<host>)' unless %w[http https].include?(scheme)
+      raise Invalid, "must start with https:// (expected #{SHAPE})" unless %w[http https].include?(scheme)
 
       host = uri.host.to_s
-      raise Invalid, 'has no host (expected https://<key>@<host>)' if host.empty?
+      raise Invalid, "has no host (expected #{SHAPE})" if host.empty?
 
-      key = URI.decode_www_form_component(uri.user.to_s)
-      raise Invalid, 'has no key (expected https://<key>@<host>)' if key.strip.empty?
+      user = URI.decode_www_form_component(uri.user.to_s).strip
+      secret = URI.decode_www_form_component(uri.password.to_s).strip
+      raise Invalid, "has no key (expected #{SHAPE})" if user.empty? && secret.empty?
 
-      # The key is a real secret on a server. Over plain http it would cross
-      # the network readable by anything on the path, so http is accepted
-      # only for a loopback ingest (local development and tests).
+      # The secret is a real secret on a server. Over plain http it would
+      # cross the network readable by anything on the path, so http is
+      # accepted only for a loopback ingest (local development and tests).
       if scheme == 'http' && !LOOPBACK.match?(host)
         raise Invalid, "uses http:// for #{host}: the key would cross the network in plaintext; use https://"
       end
 
       port = uri.port && uri.port != uri.default_port ? ":#{uri.port}" : ''
       host = "[#{host}]" if host.include?(':') && !host.start_with?('[')
-      new("#{scheme}://#{host}#{port}", key.strip)
+      base = "#{scheme}://#{host}#{port}"
+      return new(base, user) if secret.empty?
+
+      new(base, secret, user.empty? ? nil : user)
     end
   end
 
@@ -77,7 +107,8 @@ module Devbench
   #                      sidecar's socket, as before 0.5.
   #   DEVBENCH_SERVICE   this app's name. Default: the Rails application's
   #                      module, underscored (AcmeShop -> acme_shop);
-  #                      else "app".
+  #                      else "app"; with "-sidekiq" appended in a
+  #                      Sidekiq process.
   #   DEVBENCH_RELEASE   the deployed version. Default: GIT_SHA,
   #                      SOURCE_VERSION, RENDER_GIT_COMMIT, else "".
   #   DEVBENCH_ENABLED   "false" turns everything off.
@@ -106,8 +137,16 @@ module Devbench
 
     # The service name sent with every flush and folded into every
     # fingerprint. Resolved when reporting starts, after Rails has booted.
+    #
+    # A Sidekiq process (Sidekiq.server?) defaults to "<app>-sidekiq", so a
+    # typical app's web and job processes are told apart with no
+    # DEVBENCH_SERVICE at all. An explicit service always wins.
     def resolved_service
-      presence(@service) || rails_service || 'app'
+      explicit = presence(@service)
+      return explicit if explicit
+
+      base = rails_service || 'app'
+      sidekiq_server? ? "#{base}-sidekiq" : base
     end
 
     def resolved_release
@@ -116,6 +155,12 @@ module Devbench
 
     private
 
+    def sidekiq_server?
+      defined?(::Sidekiq) && ::Sidekiq.respond_to?(:server?) && ::Sidekiq.server? ? true : false
+    rescue StandardError, SystemStackError
+      false
+    end
+
     def presence(value)
       text = value.to_s.strip
       text.empty? ? nil : text

data/lib/devbench/direct.rb

@@ -6,11 +6,15 @@ require 'securerandom'
 require 'uri'
 require_relative 'fingerprint'
 require_relative 'scrub'
+require_relative 'egress_policy'
+require_relative 'logs'
 
 module Devbench
   # Direct mode (docs/SERVER_SDK_SPEC.md, "Direct mode"): fingerprint and
   # count in-process, flush counts to ingest once a minute, upload one
-  # redacted evidence bundle per fingerprint only when ingest asks. The same
+  # redacted evidence bundle per fingerprint only when ingest asks, and
+  # answer ingest's requests for the log lines of a trace (need_logs) from
+  # the in-process buffer (Devbench::Logs), redacted. The same
   # phase-1/phase-2 protocol as the browser sensor, and the same signals and
   # bundle the sidecar builds from the equivalent control message, so a
   # customer can move between modes without forking an issue.
@@ -37,6 +41,13 @@ module Devbench
     MAX_FRAMES = 50
     MAX_IDENTITY = 255
     MAX_RESPONSE_BYTES = 64 * 1024
+    # Log slices (spec: <= 500 lines per slice). 200 and 64 KiB are what the
+    # store keeps of a slice; sending more would spend the customer's
+    # bandwidth on lines truncated on arrival. 25 slices is what one
+    # delivery may carry.
+    MAX_SLICE_LINES = 200
+    MAX_SLICE_BYTES = 64 * 1024
+    MAX_SLICES_PER_POST = 25
     HTTP_TIMEOUT = 5.0
     EXIT_TIMEOUT = 2.0
 
@@ -52,6 +63,11 @@ module Devbench
       @release = release.to_s
       @interval = interval.to_f.positive? ? interval.to_f : 60.0
       @flush_uri = URI(dsn.flush_url)
+      @logs_uri = URI(dsn.logs_url)
+      @check_uri = URI(dsn.check_url)
+      # Learned redaction rules from the last response that carried a set.
+      # Not per process: a forked child keeps them until ingest re-sends.
+      @policy = nil
       @fork_lock = Mutex.new
       @stopped = false
       reset_state
@@ -100,6 +116,10 @@ module Devbench
       nil
     end
 
+    # The learned rules in force (an EgressPolicy), or nil before any
+    # arrived. For tests and diagnostics.
+    attr_reader :policy
+
     # Counts not yet flushed, by fingerprint. For tests and diagnostics.
     def pending
       @lock.synchronize { @window.transform_values { |c| c.n } }
@@ -108,14 +128,13 @@ module Devbench
     # rake devbench:test. Sends one synthetic exception straight to ingest
     # (not via the background thread), uploads its evidence if asked, and
     # prints what happened. Returns true when ingest accepted it.
-    def self_test(payload, io)
-      signal = signal_for(payload)
-      now = Time.now.to_i
-      body = bodies({ signal.fp => Count.new(signal.kind, 1, now, now, [], 0) }, 0).first
-      remember(signal)
-
-      io.puts "Dev Bench: sending a test exception to #{@dsn} (service #{@service.inspect})"
-      response, error = attempt(:post, @flush_uri, body, flush_headers, HTTP_TIMEOUT)
+    # The self-test (Devbench.test!): asks ingest whether this DSN's key is
+    # valid, and for which tenant and environment. Creates nothing — it used
+    # to send a synthetic exception, which became a real issue on a new
+    # customer's punch list.
+    def self_test(io)
+      io.puts "Dev Bench: checking the DSN against #{@dsn} (service #{@service.inspect})"
+      response, error = attempt(:post, @check_uri, '{}', flush_headers, HTTP_TIMEOUT)
       if error
         io.puts "  could not reach #{@dsn}: #{error.class}: #{error.message}"
         return false
@@ -127,14 +146,26 @@ module Devbench
         return false
       end
 
-      io.puts "  HTTP #{code}: accepted (fingerprint #{signal.fp[0, 12]})"
-      asks(response).each do |ask|
-        res = upload(ask, monotonic + HTTP_TIMEOUT)
-        io.puts(res ? "  evidence uploaded (HTTP #{res.code})" : '  evidence upload failed')
+      info = begin
+        JSON.parse(response.body.to_s)
+      rescue JSON::ParserError
+        {}
       end
+      io.puts "  HTTP #{code}: accepted — tenant #{info['tenant'].inspect}, environment " \
+              "#{info['environment'].inspect}. Nothing was recorded; real errors will appear as issues."
       true
     end
 
+    # Starts the background flush thread if it is not running (in this
+    # process). Called when this process first holds a log line, so a
+    # worker that reports nothing still polls for log requests.
+    def start
+      ensure_running
+      nil
+    rescue StandardError, SystemStackError
+      nil
+    end
+
     private
 
     # ---- Signals: exactly what the sidecar builds (internal/sidecar/control.go)
@@ -303,6 +334,9 @@ module Devbench
 
     # ---- Flushing
 
+    # Phase 1, then whatever the responses asked for: learned rules first
+    # (a rule arriving with a request for the shape it governs applies to
+    # that request), then log slices, then evidence.
     def flush_cycle(deadline)
       counts, overflowed = @lock.synchronize do
         taken = [@window, @overflowed]
@@ -310,11 +344,22 @@ module Devbench
         @overflowed = 0
         taken
       end
-      return true if counts.empty?
+      # Nothing counted: poll only while this process holds traced lines,
+      # since need_logs only rides a flush response (the sidecar's poll).
+      # Holding none, send nothing.
+      if counts.empty?
+        return true unless Logs.holding?
+
+        posts = [envelope([], 0)]
+      else
+        posts = bodies(counts, overflowed)
+      end
 
       ok = true
       wanted = []
-      bodies(counts, overflowed).each do |body|
+      log_keys = []
+      rules = nil
+      posts.each do |body|
         response = request(:post, @flush_uri, body, flush_headers, deadline)
         if response.nil?
           ok = false
@@ -322,12 +367,17 @@ module Devbench
         end
         code = response.code.to_i
         if (200..299).cover?(code)
-          wanted.concat(asks(response))
+          answer = answers(response)
+          wanted.concat(answer[:evidence])
+          log_keys.concat(answer[:logs])
+          rules = answer[:redaction] unless answer[:redaction].nil?
         else
           ok = false
           Devbench.warn_once(:"http_#{code}", "Dev Bench refused a flush: HTTP #{code}: #{explain(code, response)}")
         end
       end
+      @policy = EgressPolicy.compile(rules) unless rules.nil?
+      deliver_logs(log_keys.uniq, deadline) unless log_keys.empty?
       wanted.each { |ask| upload(ask, deadline) }
       ok
     end
@@ -369,15 +419,114 @@ module Devbench
     end
 
     def asks(response)
+      answers(response)[:evidence]
+    end
+
+    # What a flush response asked for: evidence (need_evidence), log slices
+    # (need_logs trace keys) and the learned rule set (redaction: an array,
+    # or nil when the response carried none — which leaves the rules in
+    # force, unlike an empty array, which withdraws them).
+    def answers(response)
+      none = { evidence: [], logs: [], redaction: nil }
       body = response.body.to_s
-      return [] if body.empty? || body.bytesize > MAX_RESPONSE_BYTES
+      return none if body.empty? || body.bytesize > MAX_RESPONSE_BYTES
 
       parsed = JSON.parse(body)
-      list = parsed.is_a?(Hash) ? parsed['need_evidence'] : nil
-      list.is_a?(Array) ? list.select { |a| a.is_a?(Hash) } : []
+      return none unless parsed.is_a?(Hash)
+
+      evidence = parsed['need_evidence']
+      logs = parsed['need_logs']
+      redaction = parsed['redaction']
+      {
+        evidence: evidence.is_a?(Array) ? evidence.select { |a| a.is_a?(Hash) } : [],
+        logs: logs.is_a?(Array) ? logs.filter_map { |l| log_key(l) } : [],
+        redaction: redaction.is_a?(Array) ? redaction : nil
+      }
     rescue JSON::ParserError
-      # Counts were accepted; an unreadable answer only loses the ask.
-      []
+      # Counts were accepted; an unreadable answer only loses the asks.
+      none
+    end
+
+    def log_key(ask)
+      key = ask.is_a?(Hash) ? ask['trace'] : nil
+      key.is_a?(String) && !key.empty? && key.bytesize <= 256 ? key : nil
+    end
+
+    # Phase 3: the lines this process holds for each requested trace,
+    # redacted with the exemplars' strict egress plus the learned rules,
+    # POSTed with the secret key. A key with no lines here sends nothing:
+    # another process (a Puma worker, a Sidekiq process) may hold them, and
+    # ingest does not let a server key's empty answer settle a request.
+    def deliver_logs(keys, deadline)
+      policy = @policy
+      slices = keys.filter_map do |key|
+        lines = Logs.lookup(key, MAX_SLICE_LINES)
+        next if lines.empty?
+
+        { trace: key, lines: bound_slice(lines.map { |line| egress_line(line, policy) }) }
+      end
+      slice_bodies(slices).each do |body|
+        response = request(:post, @logs_uri, body, flush_headers, deadline)
+        next if response.nil? || (200..299).cover?(response.code.to_i)
+
+        code = response.code.to_i
+        Devbench.warn_once(:"logs_http_#{code}", "Dev Bench refused log lines: HTTP #{code}: #{explain(code, response)}")
+      end
+      nil
+    rescue StandardError, SystemStackError
+      nil
+    end
+
+    # A held line is "[<trace>] <SEVERITY> <message>" (Logs). The bracketed
+    # trace is our own framing, kept as is; the rest is redacted exactly as
+    # the sidecar redacts a line's body.
+    OWN_TRACE = %r{\A\[(v1/[A-Za-z0-9_-]{1,64}/[A-Za-z0-9_-]{1,64}/\d{1,3})\] }
+
+    def egress_line(line, policy)
+      own = OWN_TRACE.match(line)
+      out = if own.nil?
+              Scrub.egress(line, policy, @service)
+            else
+              rest = line[own.end(0)..]
+              redacted = Scrub.egress(rest, policy, @service)
+              # A message that already carries the trace (Rails embeds its
+              # log tags in a multi-line error) comes back prefixed with it.
+              redacted.start_with?("[#{own[1]}] ") ? redacted : "[#{own[1]}] #{redacted}"
+            end
+      out.bytesize > Logs::MAX_LINE_BYTES ? out.byteslice(0, Logs::MAX_LINE_BYTES).scrub('') : out
+    end
+
+    # The most recent lines that fit the store's per-slice byte bound.
+    def bound_slice(lines)
+      total = 0
+      kept = []
+      lines.reverse_each do |line|
+        total += line.bytesize
+        break if total > MAX_SLICE_BYTES
+
+        kept << line
+      end
+      kept.reverse
+    end
+
+    # At most MAX_SLICES_PER_POST slices and MAX_BODY_BYTES per request.
+    def slice_bodies(slices)
+      out = []
+      current = []
+      size = 0
+      budget = MAX_BODY_BYTES - JSON.generate({ slices: [] }).bytesize
+      slices.each do |slice|
+        bytes = JSON.generate(slice).bytesize + 1
+        if !current.empty? && (current.length >= MAX_SLICES_PER_POST || size + bytes > budget)
+          out << JSON.generate({ slices: current })
+          current = []
+          size = 0
+        end
+        current << slice
+        size += bytes
+      end
+      out << JSON.generate({ slices: current }) unless current.empty?
+      out
     end
 
     # Phase 2: the sidecar's bundle shape, PUT to the presigned URL with no
@@ -395,8 +544,8 @@ module Devbench
 
       bundle = {
         v: 1, fp: fp, kind: detail.kind,
-        template: Scrub.template_text(detail.text), service: @service,
-        exemplars: detail.exemplar.empty? ? [] : [Scrub.egress(detail.exemplar)]
+        template: Scrub.template_text(detail.text, @policy, fp), service: @service,
+        exemplars: detail.exemplar.empty? ? [] : [Scrub.egress(detail.exemplar, @policy, @service)]
       }
       bundle[:frames] = detail.frames unless detail.frames.empty?
       response = request(:put, URI(url), JSON.generate(bundle), { 'content-type' => 'application/json' }, deadline)