agentirc-cli 8.3.0__tar.gz → 8.5.0__tar.gz

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to this project will be documented in this file.
 
 Format follows [Keep a Changelog](https://keepachangelog.com/).
 
+## [8.5.0] - 2026-04-25
+
+### Added
+
+- `culture/telemetry/audit.py` — `AuditSink` with bounded `asyncio.Queue` + dedicated writer task + daily/size rotation + `0600`/`0700` perms.
+- Public `culture.telemetry.AuditSink`, `init_audit`, `build_audit_record`, `utc_iso_timestamp`.
+- `TelemetryConfig.audit_enabled` (default `True`), `audit_dir`, `audit_max_file_bytes`, `audit_rotate_utc_midnight`, `audit_queue_depth` — independent of `telemetry.enabled` (audit fires even with OTEL off).
+- `culture/protocol/extensions/audit.md` — JSONL record schema as a stable contract.
+- `docs/agentirc/audit.md` — operator guide.
+- Audit metrics extend the Plan-3 `MetricsRegistry`: `culture.audit.writes` (Counter, labels `outcome=ok|error`) and `culture.audit.queue_depth` (UpDownCounter).
+- `IRCd.__init__` creates the sink; `IRCd.start()` awaits `sink.start()`; `IRCd.stop()` awaits `sink.shutdown()` so SERVER_WAKE / SERVER_SLEEP both land in the JSONL.
+- `IRCd.emit_event` submits one record per event after the `irc.event.emit` span; `trace_id` / `span_id` captured inside the span for cross-pillar joins.
+- `Client._process_buffer` submits `PARSE_ERROR` records for malformed inbound lines.
+- Federation audit: federated `message` events arrive on the receiver with `origin=federated`, `peer=<peer_name>`. Federated lifecycle events (JOIN/PART/QUIT) are deferred — see #296.
+
+## [8.4.0] - 2026-04-25
+
+### Added
+
+- `culture/telemetry/metrics.py`: `init_metrics(config)` + `MetricsRegistry` dataclass for all 15 server-side instruments — mirrors `tracing.py`'s idempotency + no-op pattern.
+- Public `culture.telemetry.MetricsRegistry` and `culture.telemetry.init_metrics`.
+- `TelemetryConfig.metrics_enabled` (default `True`) and `metrics_export_interval_ms` (default 10000).
+- Message-flow metrics: `culture.irc.bytes_sent`, `culture.irc.bytes_received`, `culture.irc.message.size`, `culture.privmsg.delivered`.
+- Events metrics: `culture.events.emitted`, `culture.events.render.duration`.
+- Federation metrics: `culture.s2s.messages` (inbound), `culture.s2s.relay_latency`, `culture.s2s.links_active`, `culture.s2s.link_events`.
+- Client metrics: `culture.clients.connected`, `culture.client.session.duration`, `culture.client.command.duration`.
+- `culture.trace.inbound` counter — closes Plan 2's deferral.
+- `tests/conftest.py` `metrics_reader` fixture parallel to `tracing_exporter`.
+- `tests/telemetry/_metrics_helpers.py` — `get_counter_value`, `get_histogram_count`, `get_up_down_value`.
+
 ## [8.3.0] - 2026-04-25
 
 ### Added

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentirc-cli
-Version: 8.3.0
+Version: 8.5.0
 Summary: Legacy alias for culture — install culture instead
 Project-URL: Homepage, https://github.com/OriNachum/culture
 Author: Ori Nachum

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/culture/agentirc/client.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 import asyncio
 import logging
 import re
+import time
 from typing import TYPE_CHECKING
 
 from opentelemetry import trace as _otel_trace
@@ -16,6 +17,7 @@ from culture.aio import maybe_await
 from culture.constants import SYSTEM_USER_PREFIX
 from culture.protocol import replies
 from culture.protocol.message import Message
+from culture.telemetry.audit import utc_iso_timestamp as _utc_iso_timestamp
 from culture.telemetry.context import TRACEPARENT_TAG as _TP_TAG_NAME
 from culture.telemetry.context import (
     context_from_traceparent,
@@ -77,8 +79,12 @@ class Client:
             if tp is not None:
                 _inject_traceparent(message, traceparent=tp, tracestate=None)
         try:
-            self.writer.write(message.format().encode("utf-8"))
+            wire = message.format().encode("utf-8")
+            self.writer.write(wire)
             await self.writer.drain()
+            # Record bytes after a successful drain so we don't count
+            # writes that immediately faulted.
+            self.server.metrics.irc_bytes_sent.add(len(wire), {"direction": "s2c"})
         except OSError:
             pass  # Client disconnected; cleanup happens in ircd._handle_connection
 
@@ -96,8 +102,10 @@ class Client:
                 # block; prefix a fresh @tag.
                 line = f"@{_TP_TAG_NAME}={tp} {line}"
         try:
-            self.writer.write(f"{line}\r\n".encode("utf-8"))
+            wire = f"{line}\r\n".encode("utf-8")
+            self.writer.write(wire)
             await self.writer.drain()
+            self.server.metrics.irc_bytes_sent.add(len(wire), {"direction": "s2c"})
         except OSError:
             pass  # Client disconnected; cleanup happens in ircd._handle_connection
 
@@ -141,14 +149,68 @@ class Client:
                             "error": type(exc).__name__,
                         },
                     )
+                    self._submit_parse_error_audit(line, exc)
                     continue
+                # Record received bytes + message size for every successfully-parsed
+                # line.  +2 accounts for the \r\n that was stripped during line-split.
+                line_bytes = len(line.encode("utf-8")) + 2
+                self.server.metrics.irc_bytes_received.add(line_bytes, {"direction": "c2s"})
+                self.server.metrics.irc_message_size.record(
+                    line_bytes, {"verb": msg.command, "direction": "c2s"}
+                )
                 if msg.command:
                     await self._dispatch(msg)
             return buffer
 
+    def _submit_parse_error_audit(self, line: str, exc: BaseException) -> None:
+        """Build and submit a PARSE_ERROR audit record for a malformed inbound line.
+
+        The record cannot go through build_audit_record (which expects an Event);
+        PARSE_ERROR is a synthetic event_type with no Event object behind it.
+        """
+        # Capture trace/span ids from the active span (the
+        # `irc.client.process_buffer` we're inside of).
+        span = _otel_trace.get_current_span()
+        ctx = span.get_span_context()
+        trace_id_hex = format(ctx.trace_id, "032x") if ctx.is_valid else ""
+        span_id_hex = format(ctx.span_id, "016x") if ctx.is_valid else ""
+
+        peer_info = self.writer.get_extra_info("peername")
+        remote_addr = f"{peer_info[0]}:{peer_info[1]}" if peer_info else ""
+
+        tags: dict[str, str] = {}
+        tp = current_traceparent()
+        if tp:
+            tags["culture.dev/traceparent"] = tp
+
+        record = {
+            "ts": _utc_iso_timestamp(time.time()),
+            "server": self.server.config.name,
+            "event_type": "PARSE_ERROR",
+            "origin": "local",
+            "peer": "",
+            "trace_id": trace_id_hex,
+            "span_id": span_id_hex,
+            "actor": {
+                "nick": self.nick or "",
+                "kind": "human",
+                "remote_addr": remote_addr,
+            },
+            "target": {"kind": "", "name": ""},
+            "payload": {
+                "line_preview": line[:64],
+                "error": type(exc).__name__,
+            },
+            "tags": tags,
+        }
+        self.server.audit.submit(record)
+
     async def handle(self, initial_msg: str | None = None) -> None:
         peer_info = self.writer.get_extra_info("peername")
         remote_addr = f"{peer_info[0]}:{peer_info[1]}" if peer_info else ""
+        kind = "human"  # Plan 5/6 will refine to bot/harness
+        self.server.metrics.clients_connected.add(1, {"kind": kind})
+        session_started = time.perf_counter()
         with _otel_trace.get_tracer(_TRACER_NAME).start_as_current_span(
             "irc.client.session",
             attributes={"irc.client.remote_addr": remote_addr},
@@ -172,9 +234,15 @@ class Client:
                     buffer = await self._process_buffer(buffer)
             except (ConnectionError, asyncio.IncompleteReadError):
                 pass
+            finally:
+                self.server.metrics.clients_connected.add(-1, {"kind": kind})
+                self.server.metrics.client_session_duration.record(
+                    time.perf_counter() - session_started, {"kind": kind}
+                )
 
     async def _dispatch(self, msg: Message) -> None:
         extract = extract_traceparent_from_tags(msg, peer=None)
+        self.server.metrics.trace_inbound.add(1, {"result": extract.status, "peer": ""})
         if extract.status == "valid":
             parent_ctx: _OtelContext | None = context_from_traceparent(extract.traceparent)
         else:
@@ -190,6 +258,7 @@ class Client:
             attrs["culture.trace.dropped_reason"] = extract.status
 
         # Per-call get_tracer: test fixture swaps provider between tests.
+        cmd_started = time.perf_counter()
         with _otel_trace.get_tracer(_TRACER_NAME).start_as_current_span(
             f"irc.command.{verb}",
             context=parent_ctx,
@@ -211,6 +280,9 @@ class Client:
                     await self.send_numeric(
                         replies.ERR_UNKNOWNCOMMAND, msg.command, "Unknown command"
                     )
+        self.server.metrics.client_command_duration.record(
+            (time.perf_counter() - cmd_started) * 1000.0, {"verb": verb}
+        )
 
     async def _handle_ping(self, msg: Message) -> None:
         token = msg.params[0] if msg.params else ""
@@ -724,6 +796,7 @@ class Client:
             for member in list(channel.members):
                 if member is not self:
                     await member.send(relay)
+            self.server.metrics.privmsg_delivered.add(1, {"kind": "channel", "channel": target})
             event_data = {"text": text}
             if is_notice:
                 event_data["notice"] = True
@@ -758,6 +831,7 @@ class Client:
                 )
             else:
                 await recipient.send(relay)
+            self.server.metrics.privmsg_delivered.add(1, {"kind": "dm"})
             event_data = {"text": text, "target": target}
             if is_notice:
                 event_data["notice"] = True

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/culture/agentirc/config.py

@@ -24,6 +24,15 @@ class TelemetryConfig:
     otlp_compression: str = "gzip"  # gzip | none
     traces_enabled: bool = True
     traces_sampler: str = "parentbased_always_on"
+    metrics_enabled: bool = True
+    metrics_export_interval_ms: int = 10000
+    # Audit JSONL sink (Plan 4). Independent of `enabled` — audit fires
+    # even when telemetry is off so admins always have the trail.
+    audit_enabled: bool = True
+    audit_dir: str = "~/.culture/audit"
+    audit_max_file_bytes: int = 256 * 1024 * 1024  # 256 MiB
+    audit_rotate_utc_midnight: bool = True
+    audit_queue_depth: int = 10000
 
 
 @dataclass

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/culture/agentirc/ircd.py

@@ -5,6 +5,7 @@ import asyncio
 import base64
 import json
 import logging
+import time
 from collections import deque
 from typing import TYPE_CHECKING
 
@@ -22,9 +23,14 @@ from culture.constants import (
     SYSTEM_USER_PREFIX,
 )
 from culture.protocol.message import Message
+from culture.telemetry import build_audit_record, current_traceparent
 
 logger = logging.getLogger(__name__)
 
+# Span/metric attribute keys defined once so a future rename has one edit point.
+_ATTR_EVENT_TYPE = "event.type"
+
+
 if TYPE_CHECKING:
     from culture.agentirc.client import Client
     from culture.agentirc.remote_client import RemoteClient
@@ -35,10 +41,12 @@ class IRCd:
     """The culture IRC server."""
 
     def __init__(self, config: ServerConfig):
-        from culture.telemetry import init_telemetry
+        from culture.telemetry import init_audit, init_metrics, init_telemetry
 
         self.config = config
         self.tracer = init_telemetry(config)
+        self.metrics = init_metrics(config)
+        self.audit = init_audit(config, self.metrics)
         self.clients: dict[str, Client | VirtualClient] = {}  # nick -> Client
         self.channels: dict[str, Channel] = {}  # name -> Channel
         self.skills: list[Skill] = []
@@ -69,6 +77,8 @@ class IRCd:
         logger.info("Bootstrapping system identity...")
         self._bootstrap_system_identity()
 
+        await self.audit.start()
+
         await self.emit_event(
             Event(
                 type=EventType.SERVER_WAKE,
@@ -178,7 +188,7 @@ class IRCd:
         # server_link.py).
         event_type_str = event.type.value if hasattr(event.type, "value") else str(event.type)
         attrs: dict[str, str] = {
-            "event.type": event_type_str,
+            _ATTR_EVENT_TYPE: event_type_str,
             "event.origin": "federated" if origin_tag else "local",
         }
         if event.channel:
@@ -212,20 +222,56 @@ class IRCd:
     async def emit_event(self, event: Event) -> None:
         origin_tag = event.data.get("_origin")
         attrs = self._build_event_span_attrs(event, origin_tag)
+        event_type_str = attrs[_ATTR_EVENT_TYPE]
+        origin_str = "federated" if origin_tag else "local"
+
+        self.metrics.events_emitted.add(1, {_ATTR_EVENT_TYPE: event_type_str, "origin": origin_str})
+        render_started = time.perf_counter()
+
+        trace_id_hex = ""
+        span_id_hex = ""
+        tp: str | None = None
+
         # Per-call get_tracer: the `tracing_exporter` test fixture swaps the
         # global provider between tests; a cached Tracer would bind to the
         # first test's provider and stop delivering to later ones.
         with _otel_trace.get_tracer("culture.agentirc").start_as_current_span(
             "irc.event.emit", attributes=attrs
-        ):
+        ) as span:
             seq = self.next_seq()
             self._event_log.append((seq, event))
+            ctx = span.get_span_context()
+            if ctx.is_valid:
+                trace_id_hex = format(ctx.trace_id, "032x")
+                span_id_hex = format(ctx.span_id, "016x")
+            # Capture traceparent inside the span so trace_flags reflect
+            # the actual sampling decision for this span, not a hardcoded -01.
+            tp = current_traceparent()
             await self._run_skill_hooks(event)
             if not origin_tag:
                 await self._relay_to_peers(event)
             await self._dispatch_to_bots(event)
             await self._surface_event_privmsg(event)
 
+        render_ms = (time.perf_counter() - render_started) * 1000.0
+        self.metrics.events_render_duration.record(render_ms, {_ATTR_EVENT_TYPE: event_type_str})
+
+        # Audit submit happens after the span exits so it doesn't sit inside
+        # the irc.event.emit span (would skew render duration). The trace_id/
+        # span_id captured inside the span point back at it for cross-pillar
+        # joins.
+        tags: dict[str, str] = {"culture.dev/traceparent": tp} if tp else {}
+        self.audit.submit(
+            build_audit_record(
+                server_name=self.config.name,
+                event=event,
+                origin_tag=origin_tag,
+                trace_id=trace_id_hex,
+                span_id=span_id_hex,
+                extra_tags=tags,
+            )
+        )
+
     _NO_SURFACE_TYPES = NO_SURFACE_EVENT_TYPES
 
     @staticmethod
@@ -381,6 +427,7 @@ class IRCd:
             if self._server:
                 self._server.close()
                 await self._server.wait_closed()
+            await self.audit.shutdown()
         finally:
             self._stopped.set()
 

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/culture/agentirc/server_link.py

@@ -5,6 +5,7 @@ import asyncio
 import base64
 import json
 import logging
+import time
 from typing import TYPE_CHECKING
 
 from opentelemetry import trace as otel_trace
@@ -137,8 +138,11 @@ class ServerLink:
             except Exception:  # noqa: BLE001 - telemetry must never break the link
                 logger.debug("traceparent injection failed; sending untagged", exc_info=True)
         try:
-            self.writer.write(f"{line}\r\n".encode("utf-8"))
+            wire = f"{line}\r\n".encode("utf-8")
+            self.writer.write(wire)
             await self.writer.drain()
+            if self.server is not None:
+                self.server.metrics.irc_bytes_sent.add(len(wire), {"direction": "s2s"})
         except OSError:
             pass
 
@@ -155,6 +159,13 @@ class ServerLink:
             line, buffer = buffer.split("\n", 1)
             if line.strip():
                 msg = Message.parse(line)
+                if self.server is not None:
+                    # +2 accounts for the \r\n that was stripped during line-split.
+                    line_bytes = len(line.encode("utf-8")) + 2
+                    self.server.metrics.irc_bytes_received.add(line_bytes, {"direction": "s2s"})
+                    self.server.metrics.irc_message_size.record(
+                        line_bytes, {"verb": msg.command, "direction": "s2s"}
+                    )
                 if msg.command:
                     await self._dispatch(msg)
         return buffer
@@ -187,6 +198,14 @@ class ServerLink:
             except (ConnectionError, asyncio.IncompleteReadError):
                 pass
             finally:
+                if self._authenticated:
+                    direction = "outbound" if self.initiator else "inbound"
+                    self.server.metrics.s2s_links_active.add(
+                        -1, {"peer": self.peer_name or "", "direction": direction}
+                    )
+                    self.server.metrics.s2s_link_events.add(
+                        1, {"peer": self.peer_name or "", "event": "disconnect"}
+                    )
                 await self.server._remove_link(self, squit=self._squit_received)
                 self.writer.close()
                 try:
@@ -203,11 +222,20 @@ class ServerLink:
         handler = getattr(self, f"_handle_{msg.command.lower()}", None)
 
         extracted = extract_traceparent_from_tags(msg, peer=self.peer_name)
+        self.server.metrics.trace_inbound.add(
+            1, {"result": extracted.status, "peer": self.peer_name or ""}
+        )
         if extracted.status == "valid":
             parent_ctx: _OtelContext | None = context_from_traceparent(extracted.traceparent)
         else:
             parent_ctx = _OtelContext()  # force root: detach from session span
 
+        if self.server is not None:
+            self.server.metrics.s2s_messages.add(
+                1,
+                {"verb": verb, "direction": "inbound", "peer": self.peer_name or ""},
+            )
+
         attrs = {
             "irc.command": verb,
             "culture.trace.origin": "remote",
@@ -266,17 +294,26 @@ class ServerLink:
         """
         if self._peer_pass != self.password:
             logger.warning("Bad password from peer %s", self.peer_name)
+            self.server.metrics.s2s_link_events.add(
+                1, {"peer": self.peer_name or "", "event": "auth_fail"}
+            )
             await self.send_raw("ERROR :Bad password")
             raise ConnectionError("Bad S2S password")
 
         # Check for duplicate server name
         if self.peer_name in self.server.links:
             logger.warning("Duplicate server name %s", self.peer_name)
+            self.server.metrics.s2s_link_events.add(
+                1, {"peer": self.peer_name or "", "event": "auth_fail"}
+            )
             await self.send_raw(f"ERROR :Server name {self.peer_name} already linked")
             raise ConnectionError("Duplicate server name")
 
         if self.peer_name == self.server.config.name:
             logger.warning("Peer has same name as us: %s", self.peer_name)
+            self.server.metrics.s2s_link_events.add(
+                1, {"peer": self.peer_name or "", "event": "auth_fail"}
+            )
             await self.send_raw("ERROR :Cannot link to self")
             raise ConnectionError("Cannot link to self")
 
@@ -291,6 +328,11 @@ class ServerLink:
         await self._validate_peer_credentials()
 
         self._authenticated = True
+        direction = "outbound" if self.initiator else "inbound"
+        self.server.metrics.s2s_links_active.add(
+            1, {"peer": self.peer_name, "direction": direction}
+        )
+        self.server.metrics.s2s_link_events.add(1, {"peer": self.peer_name, "event": "connect"})
         if self._session_span is not None:
             self._session_span.set_attribute("s2s.peer", self.peer_name)
         self.server.links[self.peer_name] = self
@@ -900,6 +942,10 @@ class ServerLink:
         except ValueError:
             return
 
+        self.server.metrics.s2s_link_events.add(
+            1, {"peer": self.peer_name or "", "event": "backfill_start"}
+        )
+
         # Use the higher of: what peer claims, or what we know they acked
         # (during real-time relay, peer saw everything up to our _seq at link drop)
         acked = self.server._peer_acked_seq.get(self.peer_name, 0)
@@ -910,6 +956,9 @@ class ServerLink:
                 await self._replay_event(seq, event)
 
         await self.send_raw(f":{self.server.config.name} BACKFILLEND {self.server._seq}")
+        self.server.metrics.s2s_link_events.add(
+            1, {"peer": self.peer_name or "", "event": "backfill_complete"}
+        )
 
     def _handle_backfillend(self, msg: Message) -> None:
         """Peer finished backfilling."""
@@ -946,6 +995,8 @@ class ServerLink:
             "event.type": event_type_str,
             "s2s.peer": self.peer_name or "",
         }
+        relay_started = time.perf_counter()
+        relayed = False
         # Single span name (no verb suffix): the wire verb is decided downstream
         # by _RELAY_DISPATCH or the SEVENT fallback, after this span opens.
         with otel_trace.get_tracer(_TRACER_NAME).start_as_current_span(
@@ -955,19 +1006,29 @@ class ServerLink:
             handler = self._RELAY_DISPATCH.get(event.type)
             if handler:
                 await maybe_await(handler(self, event, origin))
-                return
-
-            # If no typed relay exists, fall back to generic SEVENT.
-            # v1 assumes all peers support SEVENT; cap negotiation is deferred — see plan task 12.
-            payload = self.server._build_event_payload(event)
-            encoded = self.server._encode_event_data(payload, event_type_str)
-            target = event.channel or "*"
-            # Egress trust check: channel-scoped events respect should_relay; global events always relay
-            if event.channel is not None and not self.should_relay(event.channel):
-                return
-            seq = self.server._seq  # current local seq; peer stores but doesn't re-sequence
-            await self.send_raw(
-                f":{origin} SEVENT {origin} {seq} {event_type_str} {target} :{encoded}"
+                # v1: typed _relay_* handlers may early-return on internal trust checks
+                # without signaling. We optimistically count typed dispatch as relayed.
+                # Future: refactor _relay_* to return bool so latency only fires on
+                # genuine sends.
+                relayed = True
+            else:
+                # If no typed relay exists, fall back to generic SEVENT.
+                # v1 assumes all peers support SEVENT; cap negotiation is deferred — see plan task 12.
+                payload = self.server._build_event_payload(event)
+                encoded = self.server._encode_event_data(payload, event_type_str)
+                target = event.channel or "*"
+                # Egress trust check: channel-scoped events respect should_relay; global events always relay
+                if event.channel is None or self.should_relay(event.channel):
+                    seq = self.server._seq  # current local seq; peer stores but doesn't re-sequence
+                    await self.send_raw(
+                        f":{origin} SEVENT {origin} {seq} {event_type_str} {target} :{encoded}"
+                    )
+                    relayed = True
+
+        if relayed:
+            self.server.metrics.s2s_relay_latency.record(
+                (time.perf_counter() - relay_started) * 1000.0,
+                {"event.type": event_type_str, "peer": self.peer_name or ""},
             )
 
     async def _relay_message(self, event: Event, origin: str) -> None:

agentirc_cli-8.5.0/culture/protocol/extensions/audit.md

@@ -0,0 +1,109 @@
+# Extension: Audit JSONL Sink
+
+The audit log is a durable, file-based JSON-Lines (`.jsonl`) trail of every event the server
+emits. It is **separate from OTEL traces / metrics / logs** — audit lands directly on local disk
+and never depends on a running collector. Admin-only "who said what to whom, when, via what path."
+
+## File Layout
+
+- **Path:** `<audit_dir>/<server_name>-<YYYY-MM-DD>.jsonl` where `<audit_dir>` defaults to
+  `~/.culture/audit/` (configurable via `telemetry.audit_dir`). The date is **UTC**.
+- **File mode:** `0600` (owner read/write only).
+- **Directory mode:** `0700` (owner only). Created on demand if missing; existing dir mode is
+  left as-is.
+- **Rotation suffix:** when the daily file hits the size cap, the next file gets `.1`, then
+  `.2`, … same date. New day starts a fresh file with no suffix.
+
+Example for server `spark` on 2026-04-27 with two size-cap rotations:
+
+```text
+~/.culture/audit/spark-2026-04-27.jsonl     # first 256 MiB
+~/.culture/audit/spark-2026-04-27.1.jsonl   # next 256 MiB
+~/.culture/audit/spark-2026-04-27.2.jsonl   # current
+```
+
+## Record Schema
+
+Each line in the file is a single JSON object. Lines never wrap. Keys are lowercase with `_`
+separators. Order is canonicalized at write time (stable across writes). Future schema additions
+are additive only — consumers must tolerate unknown keys.
+
+Keys within each record are alphabetically sorted (the writer uses
+`json.dumps(..., sort_keys=True)`). Consumers SHOULD NOT rely on
+insertion order; future producers may emit keys in any order.
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `ts` | string | yes | ISO 8601 UTC timestamp with microsecond precision and trailing `Z` (e.g. `2026-04-27T14:32:05.123456Z`). |
+| `server` | string | yes | Server name from `ServerConfig.name`. |
+| `event_type` | string | yes | `EventType.value` (e.g. `message`, `user.join`, `room.create`) or the special string `PARSE_ERROR` for malformed inbound lines. |
+| `origin` | string | yes | `local` if the event originated on this server; `federated` if it arrived via a peer link. |
+| `peer` | string | yes | Peer server name when `origin=federated`; empty string `""` otherwise. |
+| `trace_id` | string | yes | OTEL trace-id (32 hex chars) of the active span at submit time, or `""` if no span. |
+| `span_id` | string | yes | OTEL span-id (16 hex chars) of the active span, or `""`. |
+| `actor` | object | yes | `{nick, kind, remote_addr}` describing who/what produced the event. |
+| `actor.nick` | string | yes | The nick from the event (`event.nick`), or `""`. |
+| `actor.kind` | string | yes | One of `human`, `bot`, `harness`. v1 always emits `human` — Plans 5/6 refine. |
+| `actor.remote_addr` | string | yes | `"<ip>:<port>"` if known (PARSE_ERROR via Client; empty for server-internal sites). |
+| `target` | object | yes | `{kind, name}` describing what the event affected. |
+| `target.kind` | string | yes | `channel` (event.channel set), `nick` (DM target), or `""` for global events. |
+| `target.name` | string | yes | The channel or nick; `""` for global. |
+| `payload` | object | yes | `event.data` with all underscore-prefix keys (`_origin`, etc.) stripped. May include `nick` / `channel` defaulted from `event.nick`/`event.channel`. |
+| `tags` | object | yes | IRCv3-style tag bag. v1 emits at most `culture.dev/traceparent` derived from the active span; empty `{}` if no span. |
+
+## Rotation
+
+Rotation fires when **either** condition is met, checked at the top of every record write:
+
+1. The current UTC date differs from `current_date` (daily roll, controlled by
+   `telemetry.audit_rotate_utc_midnight`).
+2. The current file size + the about-to-be-written record size exceeds
+   `telemetry.audit_max_file_bytes` (default 256 MiB).
+
+The new file is opened with `O_WRONLY | O_APPEND | O_CREAT` mode `0600`. Writes use a single
+`os.write` per record so partial-line interleaving is impossible.
+
+A record larger than `audit_max_file_bytes` is still written — the cap is a soft
+ceiling for accumulated bytes, not a hard reject. The oversized record lands in
+its own freshly-rotated file, and the next record triggers another rotation.
+
+## Durability
+
+Records flow through a bounded `asyncio.Queue` (depth `telemetry.audit_queue_depth`, default
+10000). A dedicated writer task drains the queue and writes each record. On queue overflow, the
+record is **dropped** and `culture.audit.writes{outcome=error}` increments. A stderr warning is
+logged.
+
+This is a deliberate trade-off: dropping records is preferable to blocking `IRCd.emit_event`. A
+real-world audit gap is rare and recoverable; a blocked event loop is catastrophic.
+
+No `fsync` per record — writes hit the page cache and rely on the OS to flush. A hard crash can
+lose the in-flight record.
+
+## Retention
+
+Files are not auto-pruned in v1. Operators prune manually:
+
+```bash
+find ~/.culture/audit -name 'spark-*.jsonl*' -mtime +30 -delete
+```
+
+A future `audit-prune` CLI is TODO.
+
+## Compat
+
+The schema is a stable contract:
+
+- New fields can be added in future versions; old consumers must tolerate unknown keys.
+- Existing keys keep their type and semantics across versions.
+- If a future version needs a breaking change, a top-level `schema_version` integer will be
+  added and bumped — until that exists, treat the schema as version 1.
+
+## Example
+
+PRIVMSG from `alpha-alice` (a federated client on the `alpha` peer) to channel `#general` on
+the local server `spark`:
+
+```json
+{"ts":"2026-04-27T14:32:05.123456Z","server":"spark","event_type":"message","origin":"federated","peer":"alpha","trace_id":"4bf92f3577b34da6a3ce929d0e0e4736","span_id":"00f067aa0ba902b7","actor":{"nick":"alpha-alice","kind":"human","remote_addr":""},"target":{"kind":"channel","name":"#general"},"payload":{"text":"hi","nick":"alpha-alice","channel":"#general"},"tags":{"culture.dev/traceparent":"00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"}}
+```

{agentirc_cli-8.3.0 → agentirc_cli-8.5.0}/culture/protocol/extensions/tracing.md

@@ -11,7 +11,7 @@
 
 1. Tag absent → start a new root span. Attribute: `culture.trace.origin=local`.
 2. Tag present and valid → start a child span linked to the extracted context. Attributes: `culture.trace.origin=remote`, `culture.federation.peer=<peer>`.
-3. Tag present but malformed or over the length cap → drop the tag, start a new root span. Attributes: `culture.trace.origin=remote`, `culture.trace.dropped_reason=malformed|too_long`, `culture.federation.peer=<peer>`. Log a rate-limited warning. Increment `culture.trace.inbound{result=malformed|too_long, peer=<peer>}`.
+3. Tag present but malformed or over the length cap → drop the tag, start a new root span. Attributes: `culture.trace.origin=remote`, `culture.trace.dropped_reason=malformed|too_long`, `culture.federation.peer=<peer>`. Log a rate-limited warning. Increment `culture.trace.inbound{result=malformed|too_long, peer=<peer>}` (shipped in culture 8.4.0; on every inbound regardless of result, so `result=valid` and `result=missing` are also recorded).
 
 **Length caps** (hard-coded, not configurable):