ADR-0014: Bounded log retention and redaction

• Status: Accepted
• Date: 2026-07-15

Context

Runtime logs are high-volume, may contain credentials, and are consumed live, persisted, exported, searched, and sent in optional diagnostics or provider evidence.

Decision

Keep a bounded in-memory ring per active service and rotating NDJSON files per run. Store segment identity, time ranges, checksums, and optional indexes in SQLite. Apply the same configurable redaction pipeline before display, persistence, export, diagnostics, or AI use. Enforce retention by age and disk cap and indicate that a value was redacted without exposing it.

Consequences

Log memory and disk use stay predictable. Redaction correctness is a security quality gate across every sink. Full-text indexing and compression may be added without changing the canonical event model.