@agentsfleet/orly 0.6.9 → 0.7.0

package/audits/agents-md.md

@@ -81,8 +81,8 @@ The questionnaire is organised by scenario. Each scenario corresponds to a momen
 | 4.9 (Shell) | Must `gitleaks` pass before any commit/push? | YES |
 | 4.10 (CI) | Are CI/CD edits (`.github/workflows/**`, deploy configs) **forbidden without explicit user approval** even in auto mode? | YES |
 | 4.11 (Bun) | For `*.ts`/`*.tsx`/`*.js`/`*.jsx` edits, does AGENTS.md route to `dispatch/write_ts_adhere_bun.md` (TS FILE SHAPE DECISION at PLAN, const/import/Bun-primitive discipline)? | YES |
-| 4.12 (Logging) | For every Edit/Write that adds/removes/changes a log emit (Zig `std.log.*`/`std.debug.print`/`obs.scoped`, TS/JS `console.*`/custom logger, shell `echo` to `&2`), does LOGGING GATE require reading `docs/LOGGING_STANDARD.md` and printing the per-edit gate block citing §3 (wire format) / §4 (severity) / §5 (error codes) / §6 (PII) / §10A (tightenings)? | YES |
-| 4.13 (Logging) | Is `std.debug.print` in non-test source AND `console.log` in `agentsfleet/src/**` an automatic blocking violation, with no "temporary" carve-out? | YES |
+| 4.12 (Logging) | For every Edit/Write that adds/removes/changes a log emit (Zig `std.log.*`/`std.debug.print`/`obs.scoped`, Rust `tracing::*`/print macros under `rustd/`, TS/JS `console.*`/custom logger, shell `echo` to `&2`), does LOGGING GATE require reading `docs/LOGGING_STANDARD.md` and printing the per-edit gate block citing §3 (wire format) / §4 (severity) / §5 (error codes) / §6 (PII) / §7, §8, or §8A (language binding) / §10A (tightenings)? | YES |
+| 4.13 (Logging) | Are `std.debug.print`, Rust `println!`/`eprintln!`/`dbg!`, Rust tracing without `event` or with positional formatting, and `console.log` in their non-test production scopes automatic blocking violations, with no "temporary" carve-out? | YES |
 | 4.14 (Logging) | Must a new registry-scheme `error_code` reference (agentsfleet: `UZ-XXX-NNN`) land in the same commit as its registry entry (used-but-undeclared = blocking)? | YES |
 | 4.15 (Lifecycle) | For every Edit/Write that adds/reshapes a lifecycle method in `*.zig` (`pub fn init|deinit|close|release|destroy|shutdown|dispose|free`) or an `errdefer`/`defer` adjacent to allocation, does LIFECYCLE GATE require reading `docs/LIFECYCLE_PATTERNS.md` and printing the per-edit gate block? | YES |
 | 4.16 (Lifecycle) | Is `defer X.free(Y)` + `errdefer X.free(Y)` on the same allocation in the same scope a blocking violation? | YES |

package/audits/logging.sh

@@ -9,7 +9,7 @@
 #   - agentsfleet scope-prefix format from LOGGING_STANDARD §7 (the
 #     `log.scoped(...)` API path under `src/logging/`)
 #   - `UZ-XXX-NNN` as the `error_code=` substring per LOGGING_STANDARD §5
-#   - `src/` + `agentsfleet/src/` as the scan roots
+#   - `src/` + `rustd/` + `agentsfleet/src/` as the scan roots
 # A parameterised version that reads prefix + scope-api path + scan
 # roots from a per-project config is the right long-term shape; not
 # done yet. Today, this script lives in dotfiles so the gate body and
@@ -18,6 +18,8 @@
 # Two severity tiers:
 #   BLOCK  — exits 1, must fix:
 #            - `std.debug.print(` in non-test source under src/.
+#            - `println!` / `eprintln!` / `dbg!`, missing `event`, or positional
+#              tracing formatting in non-test Rust source under rustd/.
 #            - `console.log/debug/info/warn/error` in agentsfleet/src outside tests.
 #   INFO   — surfaced for reviewer/agent attention, doesn't block:
 #            - `std.log.scoped(...)` outside `src/logging/` (LOGGING_STANDARD §7
@@ -29,7 +31,7 @@
 #
 # Modes:
 #   --staged   diff-scope: only files in `git diff --cached`
-#   --all      (default) full src/ + agentsfleet/src/ scan
+#   --all      (default) full src/ + rustd/ + agentsfleet/src/ scan
 #   --strict   promote every INFO finding to BLOCK (post-migration use)
 #
 # Exits 0 clean, 1 on BLOCK findings.
@@ -79,6 +81,13 @@ is_test_zig() {
   return 1
 }
 
+is_test_rust_path() {
+  case "$1" in
+    */tests/*|*/benches/*) return 0 ;;
+  esac
+  return 1
+}
+
 # ---------------------------------------------------------------------------
 # 1. Gather files in scope.
 # ---------------------------------------------------------------------------
@@ -86,11 +95,12 @@ gather_paths() {
   case "$MODE" in
     --staged)
       git diff --cached --name-only --diff-filter=ACMRT \
-        | grep -E '^(src/.*\.zig$|agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
+        | grep -E '^(src/.*\.zig$|rustd/.*\.rs$|agentsfleet/src/.*\.(js|jsx|ts|tsx)$)' || true
       ;;
     --all)
-      find src -type f -name '*.zig' 2>/dev/null
-      find agentsfleet/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) 2>/dev/null
+      find src -type f -name '*.zig' 2>/dev/null || true
+      find rustd -type f -name '*.rs' 2>/dev/null || true
+      find agentsfleet/src -type f \( -name '*.js' -o -name '*.jsx' -o -name '*.ts' -o -name '*.tsx' \) 2>/dev/null || true
       ;;
   esac
 }
@@ -105,11 +115,15 @@ fi
 # previously ran 3–4 forks × N files; M70 perf pass batches them into
 # single awk/grep passes.
 zig_nontest=()
+rust_nontest=()
 js_nontest=()
 for f in "${FILES[@]}"; do
   if [[ "$f" == *.zig ]] && ! is_test_zig "$f"; then
     zig_nontest+=("$f")
   fi
+  if [[ "$f" == *.rs ]] && ! is_test_rust_path "$f"; then
+    rust_nontest+=("$f")
+  fi
   case "$f" in
     agentsfleet/src/*.test.*|agentsfleet/src/*.spec.*|agentsfleet/src/tests/*) ;;
     agentsfleet/src/*.js|agentsfleet/src/*.jsx|agentsfleet/src/*.ts|agentsfleet/src/*.tsx)
@@ -140,7 +154,146 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 3. BLOCKING: console.log/debug/info/warn/error in agentsfleet/src non-test.
+# 3. BLOCKING: unstructured or event-less tracing in non-test Rust source.
+#    The awk tracker excludes complete items annotated with #[cfg(test)].
+# ---------------------------------------------------------------------------
+rust_direct_hits=0
+rust_missing_event_hits=0
+rust_positional_hits=0
+if [[ ${#rust_nontest[@]} -gt 0 ]]; then
+  while IFS='|' read -r kind f ln; do
+    [[ -z "$kind" ]] && continue
+    case "$kind" in
+      direct)
+        fail "$f:$ln — direct Rust diagnostic macro in non-test source (LOGGING_STANDARD §8A)"
+        rust_direct_hits=$((rust_direct_hits + 1))
+        ;;
+      event)
+        fail "$f:$ln — \`tracing\` emit without \`event = ...\` (LOGGING_STANDARD §8A)"
+        rust_missing_event_hits=$((rust_missing_event_hits + 1))
+        ;;
+      positional)
+        fail "$f:$ln — positional formatting in \`tracing\` emit (LOGGING_STANDARD §8A)"
+        rust_positional_hits=$((rust_positional_hits + 1))
+        ;;
+    esac
+  done < <(awk '
+    function count_char(text, char, copy, count) {
+      copy = text
+      count = gsub(char, "", copy)
+      return count
+    }
+    function code_only(text, output, cursor, char, escaped, quoted) {
+      output = ""
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/") break
+        output = output char
+      }
+      return output
+    }
+    function without_comment(text, output, cursor, char, escaped, quoted) {
+      output = ""
+      escaped = 0
+      quoted = 0
+      for (cursor = 1; cursor <= length(text); cursor++) {
+        char = substr(text, cursor, 1)
+        if (quoted) {
+          output = output char
+          if (escaped) escaped = 0
+          else if (char == "\\") escaped = 1
+          else if (char == "\"") quoted = 0
+          continue
+        }
+        if (char == "\"") {
+          quoted = 1
+          output = output char
+          continue
+        }
+        if (char == "/" && substr(text, cursor + 1, 1) == "/") break
+        output = output char
+      }
+      return output
+    }
+    function check_emit() {
+      if (emit_code !~ /event[[:space:]]*=/ && emit_code !~ /[(,][[:space:]]*event[[:space:]]*[,)]/)
+        printf "event|%s|%d\n", FILENAME, emit_line
+      if (emit_source ~ /"[^"\n]*\{[^"\n]*\}[^"\n]*"/)
+        printf "positional|%s|%d\n", FILENAME, emit_line
+      emit_code = ""
+      emit_source = ""
+      in_emit = 0
+    }
+    FNR == 1 {
+      depth = 0
+      test_depth = 0
+      cfg_test = 0
+      in_emit = 0
+      emit_parens = 0
+      emit_code = ""
+      emit_source = ""
+    }
+    {
+      code = code_only($0)
+      if (!in_emit && code ~ /^[[:space:]]*$/) next
+      opens = count_char(code, "\\{")
+      closes = count_char(code, "\\}")
+      if (test_depth > 0) {
+        depth += opens - closes
+        if (depth < test_depth) test_depth = 0
+        next
+      }
+      if (code ~ /^[[:space:]]*#\[cfg\(test\)\]/) {
+        if (opens > 0) {
+          test_depth = depth + 1
+          depth += opens - closes
+          if (depth < test_depth) test_depth = 0
+        } else cfg_test = 1
+        next
+      }
+      if (cfg_test) {
+        if (opens > 0) {
+          test_depth = depth + 1
+          depth += opens - closes
+          if (depth < test_depth) test_depth = 0
+          cfg_test = 0
+        } else if (code ~ /;/) cfg_test = 0
+        next
+      }
+      if (code ~ /(^|[^[:alnum:]_])(println|eprintln|dbg)!/)
+        printf "direct|%s|%d\n", FILENAME, FNR
+      if (!in_emit && match(code, /tracing::(error|warn|info|debug|trace)!/)) {
+        in_emit = 1
+        emit_line = FNR
+        emit_code = code
+        emit_source = without_comment($0)
+        macro = substr(code, RSTART)
+        emit_parens = count_char(macro, "\\(") - count_char(macro, "\\)")
+      } else if (in_emit) {
+        emit_code = emit_code " " code
+        emit_source = emit_source " " without_comment($0)
+        emit_parens += count_char(code, "\\(") - count_char(code, "\\)")
+      }
+      if (in_emit && emit_parens <= 0) check_emit()
+      depth += opens - closes
+    }
+  ' "${rust_nontest[@]}")
+fi
+
+# ---------------------------------------------------------------------------
+# 4. BLOCKING: console.log/debug/info/warn/error in agentsfleet/src non-test.
 # ---------------------------------------------------------------------------
 console_hits=0
 if [[ ${#js_nontest[@]} -gt 0 ]]; then
@@ -155,7 +308,7 @@ if [[ ${#js_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 4. INFO: std.log.scoped outside src/logging/ (pre-migration to the named
+# 5. INFO: std.log.scoped outside src/logging/ (pre-migration to the named
 #    `log` module's scoped API). The audit no longer carves out src/auth/ —
 #    the named module is import-able from layer-isolated trees, so the
 #    portability exception is gone.
@@ -180,7 +333,7 @@ if [[ ${#scoped_eligible[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 5. INFO: err/warn logs without `error_code=` substring on the same line.
+# 6. INFO: err/warn logs without `error_code=` substring on the same line.
 #    Heuristic — captures the common case where an err/warn line should
 #    embed UZ-XXX-NNN per LOGGING_STANDARD §5.
 # ---------------------------------------------------------------------------
@@ -198,16 +351,16 @@ if [[ ${#zig_nontest[@]} -gt 0 ]]; then
 fi
 
 # ---------------------------------------------------------------------------
-# 6. Promote INFO to BLOCK in --strict mode.
+# 7. Promote INFO to BLOCK in --strict mode.
 # ---------------------------------------------------------------------------
 if [[ $STRICT -eq 1 && $INFO_COUNT -gt 0 ]]; then
   fail "--strict: $INFO_COUNT informational findings promoted to blocking"
 fi
 
 # ---------------------------------------------------------------------------
-# 7. Verdict.
+# 8. Verdict.
 # ---------------------------------------------------------------------------
-ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
+ok "scanned ${#FILES[@]} files; std.debug.print=$debug_print_hits rust-direct=$rust_direct_hits rust-missing-event=$rust_missing_event_hits rust-positional=$rust_positional_hits console.*=$console_hits std.log.scoped=$scoped_hits missing-error_code=$missing_code_hits"
 if [[ $FAIL -ne 0 ]]; then
   printf "\n🔴 LOGGING GATE: blocking violations. See dispatch/write_any.md (Logging Gate).\n" >&2
   exit 1

package/dispatch/write_any.md

@@ -127,6 +127,7 @@ shebang and is the authoritative check.
 **Triggers** — every `Edit`/`Write` that adds, removes, or changes a log emit:
 
 - `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/`/`*_test.zig` — `std.log.*`, `std.debug.print`, raw stderr writes, calls into the `log` named module (source: `src/logging/mod.zig`).
+- `*.rs` under `rustd/` outside `tests/`, `benches/`, and `#[cfg(test)]` items — `tracing::*`, `println!`, `eprintln!`, and `dbg!`.
 - `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/`/`*.test.*`/`*.spec.*` — `console.*`, custom logger calls.
 - `*.sh` outside generated dirs — `echo`/`printf` to `&2`.
 
@@ -145,10 +146,11 @@ shebang and is the authoritative check.
 | Pattern | Rule |
 |---|---|
 | New `logging.scoped(.tag)` call | Scope is a Zig enum literal — adding a new tag is freeform. `event` must be snake_case `verb_noun`. |
+| New Rust `tracing::<level>!` call | `event = "verb_noun"` or the equivalent `event` field shorthand is mandatory; values are structured fields hoisted into locals. |
 | New `err`/`warn` log mapping to a domain failure | registry-scheme `error_code=` field required (agentsfleet: `UZ-XXX-NNN`). Registry entry must land in same commit. |
 | Per-iteration / hot-loop log | Use `debug` (hidden by default), not `info`. |
-| `info` level | No allow-list — `info` is open (§4 rule 2). Two checks instead: a boundary-crossing operation needs its `_started`/`_completed`\|`_failed` pair on every exit path (rule 1), and a per-iteration path is `debug` (rule 3). |
-| `console.log`/`std.debug.print` in non-test source | Forbidden. Convert to logger or delete before commit. |
+| `info` level | No allow-list — `info` is open (§4 rule 2). Two checks instead: a boundary-crossing operation needs its `_started`/`_completed`\|`_failed` pair on every exit path (rule 1), and a per-iteration path is `debug` (rule 3). Hot-poll boundary pairs remain complete but use `debug`. |
+| `console.log`/`std.debug.print`/Rust print macro in non-test source | Forbidden. Convert to the structured logger or delete before commit. |
 | `std.log.scoped` outside `src/logging/` | Migration target. The `log` named module's `scoped` API is the only non-test entry point; flip the file's alias and migrate every call site in the same commit. |
 | `msg=` field | ≤ 300 chars. Stack traces emit as separate `event=stack_trace` debug record. |
 | Multi-line values | Newlines must be `\n` literal (two chars), not raw newline byte. |
@@ -173,7 +175,7 @@ Full multi-line block fires when a sub-rule reports a violation:
 
 ```
 LOGGING GATE: <file>
-  docs/LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (zig binding) | §8 (TS binding), §10A (tightenings)
+  docs/LOGGING_STANDARD.md sections consulted: §3 (wire format), §4 (severity), §5 (error codes), §6 (PII), §7 (Zig binding) | §8 (TS binding) | §8A (Rust binding), §10A (tightenings)
   Wire format: <logfmt ✓ | violation: <where>>
   Required keys: <ts_ms,level,scope,event present ✓ | violation: <missing>>
   Severity choice: <within rules ✓ | violation: <e.g. info on per-iteration path>>
@@ -188,13 +190,13 @@ LOGGING GATE: <file>
 
 > [DETERMINISTIC → LOG]
 
-`logging.sh` walks the **full `src/` + `agentsfleet/src/` working tree** via `git ls-files`. The index includes staged-but-not-yet-committed content, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
+`logging.sh` walks the **full `src/` + `rustd/` + `agentsfleet/src/` working tree**. The staged mode reads the index, so a fix staged in pre-commit satisfies the check on the same hook run. `--staged` is preserved as an opt-in narrowing mode for iterative dev.
 
 #### End-of-turn audit
 
 > [DETERMINISTIC → LOG]
 
-`audits/logging.sh` runs as part of `make lint`. It greps `std.log.*`, `console.*` and raw stderr writes — it does NOT see calls through the `log` named module's `scoped()`, which is where every structured emit in `agentsfleet` goes, so a clean run is not evidence that §4/§5 hold. Mechanical today: `std.debug.print`/`console.log` presence, `std.log.scoped` outside `src/lib/logging/`, msg-length. Reviewer-side: severity choice, entry/exit pairing, `error_code` on scoped-logger calls, and PII spot-checks.
+`audits/logging.sh` runs as part of `make lint`. It greps `std.log.*`, Rust `tracing` and direct-print macros, `console.*`, and raw stderr writes. It does NOT see calls through the Zig `log` named module's `scoped()`, so a clean run is not evidence that §4/§5 hold everywhere. Mechanical today: direct Zig/Rust/TypeScript diagnostics, Rust's required `event` field and positional-format ban, `std.log.scoped` outside `src/lib/logging/`, and legacy Zig error-code hints. Reviewer-side: severity choice, entry/exit pairing, registry applicability, inline Rust expression hoisting, and Personally Identifiable Information (PII) spot-checks.
 
 #### Family
 

package/docs/LOGGING_STANDARD.md

@@ -1,6 +1,6 @@
 # LOGGING_STANDARD — wire format and discipline for structured logs
 
-The contract between code that emits log records and the systems (humans, collectors, dashboards) that consume them. Cross-language: applies to every Zig, TypeScript, JavaScript, and shell call site that emits to `stderr`/`stdout`.
+The contract between code that emits log records and the systems (humans, collectors, dashboards) that consume them. Cross-language: applies to every Zig, Rust, TypeScript, JavaScript, and shell call site that emits to `stderr`/`stdout`.
 
 Pre-design rules, decisive defaults, and the anti-patterns each rule exists to prevent. Every rule has a one-line "why" so you can judge edge cases.
 
@@ -9,12 +9,13 @@ Pre-design rules, decisive defaults, and the anti-patterns each rule exists to p
 Triggers on every `Edit`/`Write` that adds, removes, or changes a log emit:
 
 - `*.zig` outside `vendor/`/`third_party/`/`.zig-cache/` — `std.log.*`, `std.debug.print`, `std.io.getStdErr().writer().print`, any helper in `src/lib/logging/`.
+- `*.rs` under `rustd/` outside test and benchmark scopes — `tracing::{error,warn,info,debug,trace}!`, `println!`, `eprintln!`, and `dbg!`.
 - `*.ts`/`*.tsx`/`*.js`/`*.jsx` outside `vendor/`/`node_modules/` — `console.*`, custom logger calls.
 - `*.sh` outside generated directories — `echo`, `printf` to `&2`.
 
 Out of scope (explicitly):
 
-- Test-only diagnostic prints inside `*_test.zig`, `*.test.ts`, `*.spec.ts`. Tests render to humans, not collectors; gates ignore.
+- Test-only diagnostic prints inside `*_test.zig`, Rust `tests/` and `benches/` trees or `#[cfg(test)]` items, `*.test.ts`, and `*.spec.ts`. Tests render to humans, not collectors; gates ignore.
 - Build/release scripts — the harness's own `audits/*`, `audits/release-*`, and any governance-repo tooling — toolchain output, not application logs.
 - Generated framework noise (Next.js startup banners, Bun runtime warnings) — out of our control.
 
@@ -123,6 +124,12 @@ a per-chunk callback: these flood collectors and drown the records that matter.
 `debug` is not a lesser level, it is the level with a volume switch. A sweep that
 reaps 4,000 workspaces logs each one at `debug` and its outcome at `info`.
 
+Boundary pairing and per-iteration severity both apply to hot polls. A lease poll
+that crosses Redis and Postgres on every iteration still emits its complete
+`_started` and `_completed`/`_failed` pair, but emits both records at `debug`.
+The pair satisfies rule 1; the level satisfies rule 3. A coarser poll-loop start,
+stop, or aggregate outcome may remain `info`.
+
 ### `err` and `warn` are unconditional
 
 > [UNENFORCED → "always emitted" is a runtime filter-configuration property; nothing greps for a suppressed err/warn path]
@@ -288,6 +295,48 @@ class AgentError extends Error {
 
 Throw-style modules `throw new AgentError({...})`. Result-style modules return `{ ok: false, error: new AgentError({...}) }`. Render path picks human or JSON based on the runtime mode.
 
+## §8A · Per-language binding — Rust (`rustd`)
+
+> [DETERMINISTIC → LOG]
+
+Rust uses the existing `tracing` crate and emits the same logical fields as §3.
+Every production emit supplies an `event` field, explicitly or through tracing's
+field shorthand, whose value is a snake_case `verb_noun`. Fields are structured
+arguments, never positional message formatting.
+
+> [JUDGMENT → RUST-STYLE]
+
+Every `warn` or `error` that maps to a registry code supplies
+`error_code = code` per §5. Hoist field expressions into locals before the macro
+call. The log bridge duplicates field expressions, and LLVM coverage
+instrumentation scores the dead copy; locals preserve evaluation and coverage
+behavior. A trailing string message is §3's optional `msg` and is always the
+last macro argument. Prefer fields alone when they already explain the event.
+
+```rust
+let code = error_code::INTERNAL_DB_QUERY.as_str();
+let id = runner.as_str();
+let reason = error.to_string();
+let event = "runner_lease_failed";
+tracing::warn!(error_code = code, runner_id = id, reason, event);
+```
+
+> [JUDGMENT → EVENT-COMPAT]
+
+Ports preserve existing event-name bytes by default. A Rust replacement for a
+Zig operation keeps the Zig event spelling so dashboards and alerts continue to
+match. Renaming is a separate, intentional observability migration.
+
+> [DETERMINISTIC → LOG]
+
+**Anti-patterns flagged by `logging.sh`:**
+
+| Pattern | Why banned | Fix |
+|---|---|---|
+| `println!`, `eprintln!`, or `dbg!` in non-test source | No level, event, or structured fields. | Convert to a `tracing` emit or delete. |
+| `tracing::<level>!` without `event = ...` | Drops the stable §3 event key. | Add the byte-stable snake_case event field. |
+| Positional formatting in a `tracing` message | Hides values inside text and defeats field queries. | Hoist values and emit named fields. |
+
 ## §9 · Pretty-printer (dev-only render variant)
 
 In production: every record on the wire is logfmt. No exceptions.
@@ -330,10 +379,10 @@ Failure modes the audit script and reviewer must close. These are **not aspirati
 
 | # | Rationalization | Closure |
 |---|---|---|
-| L1 | "Temporary debug print, I'll remove later" | `logging.sh` greps `std.debug.print` and `console.log` / `console.debug` / `console.info` in non-test source unconditionally. Found in commit → gate fails. No "temporary" carve-out. |
+| L1 | "Temporary debug print, I'll remove later" | `logging.sh` greps `std.debug.print`, Rust `println!` / `eprintln!` / `dbg!`, and `console.log` / `console.debug` / `console.info` in non-test source unconditionally. Found in commit → gate fails. No "temporary" carve-out. |
 | L2 | "`std.log.scoped` is fine, `obs.scoped` is just a wrapper" | `std.log.scoped` is **forbidden** in `src/**/*.zig` outside `src/lib/logging/`. Only `obs.scoped` is callable. Audit flags every `std.log.` call site. |
 | L3 | "I added `error_code=UZ-NEW-001` — registry entry coming next commit" | The registry entry **must land in the same commit** as the first reference. `error-codes.sh` runs against the staged diff; missing entry = blocking. |
-| L4 | "This per-iteration event matters for debugging — `info`-level" | Per-iteration and per-row paths are `debug`, no exception: a loop body is not a boundary, and `debug` is the level with a volume switch. This closes the ONLY `info` prohibition — there is no allow-list of event names and none may be reintroduced (§4). The inverse rationalization is closed too: "this operation is obviously fine, no need to log it" does not survive §4 rule 1, which requires a `_started`/`_completed`\|`_failed` pair on every boundary-crossing operation. Reviewer checks the pair and the loop, never the spelling. |
+| L4 | "This per-iteration event matters for debugging — `info`-level" | Per-iteration and per-row paths are `debug`, including mandatory boundary pairs on hot polls. `debug` is the level with a volume switch. This closes the ONLY `info` prohibition — there is no allow-list of event names and none may be reintroduced (§4). The inverse rationalization is closed too: "this operation is obviously fine, no need to log it" does not survive §4 rule 1, which requires a `_started`/`_completed`\|`_failed` pair on every boundary-crossing operation. Reviewer checks the pair and the loop, never the spelling. |
 | L5 | "Operator needs the full stack trace in `msg=`" | `msg=` capped at 300 chars; total fields per record capped at 15. Stack traces emit as a separate `event=stack_trace` record at `debug` level, correlated by `correlation_id`, not stuffed into `msg`. |
 | L6 | "Embedded newlines because I copy-pasted output" | Audit greps for raw newline byte inside quoted logfmt values. Must be `\n` literal (two chars). |
 | L7 | "Auto-mode is on, the gate block is ceremony" | **Auto-mode does NOT cover gate skips.** Skip without an explicit user-given override = automatic violation. No size threshold lets an edit bypass the gate. |
@@ -348,6 +397,9 @@ These are enforced by `logging.sh` (mechanical) and the dispatch façade (`dispa
 |---|---|
 | Free-form English log lines | Not greppable, not parseable, no event tag. |
 | `std.debug.print` outside tests | No level, no scope, no fields — dev debugging that escaped to main. |
+| Rust `println!`, `eprintln!`, or `dbg!` outside tests | No level, event, or structured fields — dev diagnostics that escaped to main. |
+| Rust `tracing` emit without `event` | Drops the stable event key required by §3. |
+| Positional formatting in a Rust `tracing` emit | Values become opaque message text instead of queryable fields. |
 | `console.log` in `agentsfleet` source | Bypasses logger, breaks `--json` mode, violates `dispatch/write_ts_adhere_bun.md` §10. |
 | Logging on hot per-iteration paths at `info` | Floods collectors. Use `debug` (gated off by default). |
 | `error_code=` missing on `err`/`warn` mapping to registry codes | Breaks traceability; future operator can't link log to docs. |
@@ -371,6 +423,7 @@ immediately preceding the edit. Generic "scope creep" is not a valid reason —
 - `dispatch/write_ts_adhere_bun.md` §10 — banned `console.log` in TS/JS source. Cross-referenced by `logging.sh`.
 - `dispatch/write_ts_adhere_bun.md` §9 — module-level error style (throw vs Result) for `agentsfleet`.
 - `dispatch/write_zig.md` — Zig discipline umbrella; this doc's §7 is the logging-specific layer.
+- `dispatch/write_rust.md` — Rust discipline umbrella; this doc's §8A is the logging-specific layer.
 - `LIFECYCLE_PATTERNS.md` — orthogonal: ownership/cleanup of structs, including allocator wiring for the thread-local log buffer.
 - M42_002 redaction harness (`src/runner/engine/runner_progress.zig`) — secret-redaction precondition; this doc's §6 inherits.
 - Universal rules (RULE UFS, RULE TGU, RULE PRI, RULE FLL, RULE ORP, RULE TST-NAM) live in `docs/greptile-learnings/RULES.md`.
@@ -388,10 +441,12 @@ its line covers the clauses under it until the next heading.
 
 | Tag | Meaning | Where the verdict comes from |
 |---|---|---|
-| `[DETERMINISTIC → LOG]` | a script decides; no talking past it | `audits/logging.sh` — `std.debug.print` and `console.*` in non-test source block; missing `error_code=` on `std.log.{err,warn}` reports as INFO |
+| `[DETERMINISTIC → LOG]` | a script decides; no talking past it | `audits/logging.sh` — direct Zig/Rust/TypeScript diagnostics and malformed Rust tracing emits in non-test source block; missing `error_code=` on `std.log.{err,warn}` reports as INFO |
 | `[JUDGMENT → BOUNDARY]` | is this operation boundary-crossing, and is its `_started`/`_completed`\|`_failed` pair complete | the agent at write time; the reviewer at `/review` |
 | `[JUDGMENT → REDACT]` | is this value a secret, or the label of one | the agent at write time; the M42_002 harness covers only executor-child output |
 | `[JUDGMENT → MSG-REVIEW]` | does this `msg=` carry a credential | the reviewer; no length or content check runs today |
 | `[JUDGMENT → TS-STYLE]` | throw-style or Result-style for this module | `dispatch/write_ts_adhere_bun.md` §9, agent-decided |
+| `[JUDGMENT → RUST-STYLE]` | does a Rust failure map to a registry code, and are field expressions safely hoisted | the agent at write time; the reviewer at `/review` |
+| `[JUDGMENT → EVENT-COMPAT]` | does a language port preserve the event bytes consumed by existing dashboards | the agent compares old and new event constants; the reviewer confirms intentional renames |
 | `[JUDGMENT → SECTION-SCAN]` | which sections of this file the current sub-task needs | the agent; `audits/doc-read.sh` records façade reads, not delegated-doc reads |
 | `[UNENFORCED → reason]` | acknowledged prose; the reason states why no check exists | nothing — that is the point of the class |

package/docs/ORLY_ARCHITECTURE.md

@@ -122,6 +122,25 @@ surfaces:
 
 Orly owns policy and invokes these commands. The repository owns what they do.
 
+## Usage telemetry
+
+Orly keeps usage telemetry off until a person enables anonymous collection in
+an interactive run. Hooks, Continuous Integration (CI), and other automated
+runs never ask for consent. Off writes no event and makes no network request.
+
+Anonymous events enter a bounded outbound spool under the agentsfleet state
+root. After each append, Orly launches a detached sync attempt and lets the
+command exit. The sync sends at most 100 events and exits without a fetch when
+another attempt ran within five minutes. A successful response removes the
+acknowledged prefix. Spool maintenance drops records older than seven days and
+keeps the file at or below 10 MiB, so an unavailable destination cannot create
+an unbounded local log. Orly runs no telemetry daemon.
+
+PostHog owns product-event storage and funnel analysis. Orly sends no source,
+path, repository, branch, argument, output, environment, hostname, username, or
+raw error value. A future Insights Fleet may query PostHog with a private key;
+the Fleet is an analysis consumer and never the public ingestion boundary.
+
 ## Evidence
 
 `orly verify --all --write-evidence` records the source commit and every check

package/docs/RULE_ENFORCEMENT.md

@@ -6,7 +6,7 @@ regenerates this file and fails on any difference. To update it, run
 
 | Rule document | enforced by | judged | acknowledged | classified | trigger |
 |---|---|--:|--:|--:|---|
-| `docs/LOGGING_STANDARD.md` | `LOG` → `logging.sh` | 10 | 13 | 26/26 | mechanical |
+| `docs/LOGGING_STANDARD.md` | `LOG` → `logging.sh` | 11 | 13 | 28/28 | mechanical |
 | `docs/REST_API_DESIGN_GUIDELINES.md` | — | 0 | 0 | 0/74 | mechanical |
 | `docs/SCHEMA_CONVENTIONS.md` | — | 0 | 0 | 0/16 | mechanical |
 | `docs/DOCUMENTATION_RULES.md` | — | 0 | 0 | 0/22 | latent |
@@ -14,7 +14,7 @@ regenerates this file and fails on any difference. To update it, run
 | `docs/CHANGELOG_VOICE.md` | — | 0 | 0 | 0/3 | latent |
 | `docs/VERIFY_TIERS.md` | — | 0 | 0 | 0/4 | uncited |
 | `docs/greptile-learnings/RULES.md` | — | 0 | 0 | 0/114 | mechanical |
-| **corpus** | | | | **26/281** | |
+| **corpus** | | | | **28/283** | |
 
 ## How to read this
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsfleet/orly",
-  "version": "0.6.9",
+  "version": "0.7.0",
   "description": "Repository-scoped engineering harness: renders agent rules, materialises the gates that enforce them, and proves the PR boundary \u2014 for any coding agent.",
   "license": "MIT",
   "type": "module",

package/skills/orly-babysit-prs/SKILL.md

@@ -13,6 +13,12 @@ description: |
 
 # orly-babysit-prs
 
+At invocation start, record the consent-gated usage signal without blocking the skill:
+
+```bash
+command -v orly >/dev/null 2>&1 && ORLY_INVOCATION=skill orly skill-event orly-babysit-prs >/dev/null 2>&1 || true
+```
+
 Review bots (greptile on GitHub; greptile or another review bot on GitLab)
 post auto-reviews **asynchronously**. They land as PR review comments / MR
 discussion threads, not check runs, so `gh pr checks --watch` (or the glab

package/skills/orly-spec-new/SKILL.md

@@ -11,6 +11,12 @@ description: |
 
 # orly-spec-new
 
+At invocation start, record the consent-gated usage signal without blocking the skill:
+
+```bash
+command -v orly >/dev/null 2>&1 && ORLY_INVOCATION=skill orly skill-event orly-spec-new >/dev/null 2>&1 || true
+```
+
 A spec is the **rulebook** the executing agent (Orly) plans and ships from. This
 skill makes me author one whose Pull Request (PR) lands **deterministic, review-clean, and
 reported** — without a 20-questions loop. It is written for my reasoning, not as

package/skills/orly-write-integration-test/SKILL.md

@@ -11,6 +11,12 @@ description: >
 
 # Write Integration Test
 
+At invocation start, record the consent-gated usage signal without blocking the skill:
+
+```bash
+command -v orly >/dev/null 2>&1 && ORLY_INVOCATION=skill orly skill-event orly-write-integration-test >/dev/null 2>&1 || true
+```
+
 Service-layer tests that prove real wiring works under real failure modes. Sits between unit tests (`make test`) and browser E2E (gstack `/qa`, `/e2e-qa-playwright`).
 
 > **What this guarantees / what it doesn't.** Integration tests don't prove "zero bugs

package/skills/orly-write-unit-test/SKILL.md

@@ -11,6 +11,12 @@ description: >
 
 # Write Unit Test
 
+At invocation start, record the consent-gated usage signal without blocking the skill:
+
+```bash
+command -v orly >/dev/null 2>&1 && ORLY_INVOCATION=skill orly skill-event orly-write-unit-test >/dev/null 2>&1 || true
+```
+
 Generate tests that catch bugs before they ship. Tests run *during* implementation, not after.
 
 > **What this guarantees / what it doesn't.** No test suite proves "zero bugs in