nucleus/
telemetry.rs

1use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
2
3/// Initialize the tracing subscriber with env-filter.
4///
5/// RUST_LOG is respected but capped at `debug` to prevent `trace`-level
6/// output from leaking sensitive runtime data (syscall args, memory
7/// contents, etc.) in production.
8///
9/// L12: The level cap is enforced by wrapping the env_filter with a max_level
10/// directive, ensuring that even target-specific `RUST_LOG=trace` directives
11/// are capped at debug.
12pub fn init_tracing() {
13    // When RUST_LOG is set, respect it exactly (user controls verbosity).
14    // When unset, default to "info" with "nucleus=debug" for internal detail.
15    // The global cap at DEBUG prevents trace-level leaks in either case (L12).
16    let env_filter = match tracing_subscriber::EnvFilter::try_from_default_env() {
17        Ok(filter) => filter,
18        Err(_) => tracing_subscriber::EnvFilter::new("info")
19            .add_directive("nucleus=debug".parse().expect("valid tracing directive")),
20    };
21    let fmt_layer = tracing_subscriber::fmt::layer();
22
23    tracing_subscriber::registry()
24        .with(fmt_layer)
25        .with(env_filter)
26        .with(tracing_subscriber::filter::LevelFilter::DEBUG)
27        .init();
28}
nucleus/telemetry.rs

nucleus/
telemetry.rs
