Description
BMCs, switches, storage arrays and management-plane appliances in an AI Factory cannot run an agent; they send RFC 5424 or RFC 3164 syslog to a central Alloy listener (loki.source.syslog or otelcol.receiver.syslog), which maps source IPs to device names, labels by site, device, source type and severity, and forwards to Loki. Messages that fail parsing are dropped and only visible through the receiver’s error counters. synthkit emits journald-shaped host logs but nothing shaped like a syslog receiver’s output, so every network-attached source below would otherwise reinvent it. This is a mechanic library shared by the owning constructs, not a construct of its own.
Acceptance Criteria
- #1 A shared mechanic renders syslog-received streams in both the loki.source.syslog and the otelcol.receiver.syslog output shapes, selectable per blueprint, with label and attribute names taken from the Alloy documentation and recorded in signals/logs.md
- #2 Stream labels stay bounded (site, device, source type, severity, service); message ID, PID, structured data and source IP ride in structured metadata or the body
- #3 For each receiver, assert its real health surface: for otelcol.receiver.syslog, use the receiver accepted/refused/failed log-record handoff counters and document that the default on_error = “send” forwards malformed syslog messages without a parse-failure counter; for loki.source.syslog, use loki_source_syslog_entries_total, loki_source_syslog_parsing_errors_total and loki_source_syslog_empty_messages_total (unlabelled).
- #4 Tests cover RFC 5424 and RFC 3164 rendering and the parse-failure path
- #5 Every metric, label, attribute and log field is sourced from vendor documentation or a capture at a pinned version and recorded with provenance in the named signals/ area file; anything unconfirmed is a PENDING in cantfind.md, never an invented name
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Final specialist rescue: move the unchanged public-loader regression from the construct directory to the shared mechanic external test package; preserve every assertion and fix only package/relative fixture path. Run focused public boundary and architecture tests, generator, custom receiver inventories, commit explicit owned paths and run just check once on exact candidate; root then verifies source/scope, integrates, batch-reviews and observes landing CI.
Implementation Notes
loop47: admitted vendor-contract research R02; implementation waits for fixture landing
loop47 I02 bounded feasibility commission1 stopped before edits, implementation performed0/infra0, clean isolated d592c9a. Unchanged AC3 requires receiving OTel collector parser-error series, confirmed absent in Alloy1.20.1/Contrib0.161.0/receiverhelper1.67.0 path. Loki3counters sourced; OTLP accepted/refused/failed handoff and TCPconnection metrics are not parse counters. Resume only approved pinned parser-signal contract or owner-approved AC amendment; partial library not authorized, no unchanged retry. Default OTel on_error=send is not blanket drop. Evidence codex/scratch/loop47/I02/attempt1-return.md; batched owner decision at run end.
loop48 R0: admitted narrowed AI Factory research/design under Rob 2026-10-03 decisions; implementation dependency-gated; prior commission1 retained for syslog/DCGM.
loop48: Rob 2026-10-03 decision applied to AC3 after independent V02 verification; contract codex/packets-2026-10-03-loop48/contracts/syslog-ac3-verify.md sha256 4c20b689d822aa85ff36030831f6645134a6ae089128cb67a9f0d2ae92042df4. Prior commission1 blocked on absent OTel parse counter; changed premise real receiver health criterion; discriminator malformed send/drop plus health inventory; implementation2 remains last worker attempt.
loop48: implementation2 ended partial on an implementation-red public-loader test harness missing the existing cluster log writer; no candidate commit or full gate. Attempts1+2 consumed, infra0, review-repair0. Root inspected causal nil Logs and reserved root-directed rescue implementation3 on root route in the same preserved worktree; decoded synthetic RFC renderer plus sourced decoder-error behavior satisfies rendering scope, not a raw network parser claim. No AC waived; only specialist implementation4 remains after this rescue.
loop48 implementation3 candidate fbddc13aa14b3586464680fa4d16c0e25ccde668 passed focused/gen/custom inventories but just check rejected the public-loader test under the construct directory. Attempt3 settled implementation red, infra0. Final specialist implementation4 reserved with the exact architecture-compliant relocation; earlier worktree and candidate preserved, no architecture waiver or assertion weakening. Cumulative attempts4 reserved, review-repair0, no extra grant.
loop48 terminal task acceptance: cumulative implementation attempts4, review-repair0, infra0, no extra grants. Attempts2/3 caught nil log collaborator and wrong public-test directory; final specialist4 preserved assertions and passed. Landing ea510aa3198e3775105f9b05b963760374be67ee ci37132572797 exact-head success; integrated local neutral-env gate and root one-batch CodeRabbit0 findings. Root first gate wrapper red was corrected without source/test changes and is not a task attempt. Subsequent live evidence may be appended separately.
loop48 retrospective LIVE1 partial readback: original application89f4c81fe2368df95f695c5d0a7868d384b9235c/localbinarye4920f8fa807d22dae21e8d4cc347400c95f307d (tracker-only difference), UTC17:49:05.326109389Z-18:06:49Z. Explicit datasource UID queries found all three OTEL syslog health families, two member series each with exact expected label keys; node identity three series full label-key match and bounded K8s event logs also present. Loki/promrw transports successful with zero failures. OTLP never attempted and global readiness failed; sparse automation, no forced rates. This is not full healthy LIVE, device/syslog-log, immutable backend-origin or final-gateway proof. Evidence codex/scratch/loop48/L1-readback/.
Final Summary
Shared decoded RFC5424/RFC3164 Loki/OTel rendering and default error/handoff semantics, bounded metadata and opt-in cumulative collector health are implemented. Real loopback Loki/OTLP wire tests, public loader tests and three custom inventories passed; enabled profiles add six series per cluster and disabled adds zero. Integrated generator/dump/check and CodeRabbit zero findings passed; exact landing ea510aa3198e3775105f9b05b963760374be67ee ci37132572797 succeeded. No raw parser/network listener or CLI device-log claim; live read-back is separate and pending. Eight optional external troubleshooting rows stayed blocked, not passed.