[kirre-bylund]

Implements T9d (logging) and T9e (log obfuscation). They are one change because the obfuscator exists to protect the logger, and splitting them would ship a logger that can leak a token for a commit.

Logging

An injected Logger with the eight-level enum, a stderr default, and a structured HttpEntry carrying method, URL, both bodies, status, duration, attempt number, request id and the server trace id. That entry is the point of the feature: a support ticket needs those as fields, not as prose to be parsed back out.

Three shapes differ from the sketch:

• LogHttp is not pure. The base implementation renders a one-line summary through Log(), so an adopter who only wants text does not reimplement the formatting.
• No built-in file sink. It is a dozen lines for an adopter, and building it in means owning rotation, flush policy and a path convention on every platform — three support surfaces for something the interface already makes possible.
• Config::log_level, defaulting to Warning. NoLogging silences the SDK without swapping the logger, which is what a shipped game wants.

Obfuscation

A scan and splice, not a parse and reserialise. Three reasons, and the first is the one that decided it:

• A round-trip does not preserve key order, whitespace or number formatting, so a log stops being comparable against a report.
• A non-JSON body — an HTML 502 page — is exactly the artefact a support ticket needs, and must reach the log untouched rather than be rewritten.
• A round-trip through a model silently drops unknown keys, which is the opposite of what a log is for.

The trade is more code and some string-skipping subtlety, both covered by tests. player_identifier joins the deny-list: it is a stable per-player id that survives sessions, so it is personal data in the same sense an email is.

Two testing notes worth reading

The first short-string test could not fail. It asserted only that the value did not appear in the output — which passes with the guard deleted, because a split mask also makes the whole string non-contiguous. I found it by deleting the guard and watching the test still pass. It now asserts the exact output at 4, 6, 8, 10 and 11 characters, and deleting the guard fails 4 checks.

Disabling the deny-list check entirely fails 19 assertions.

Verification

• 16 test functions; all 6 suites pass.
• Zero warnings on MSVC 19.33.
• Both boundary checks clean; -DLOOTLOCKER_MODULE_ONLY still configures for core, auth and auth;broadcasts.

Not done, deliberately

Headers are not in the HttpEntry. The spec listed them, but a token in a header would need its own obfuscation path, and no header the SDK sends carries one. It is a one-field addition when T10 lands the real transport, and I would rather add it with the transport than guess at the shape now.

The RequestId half of T9d's verification needs T11d. The entry carries request_id today and the test drives it through a recording logger, which is as far as it can be proved without the executor existing.

Spec

lootlocker/index#1881 records the three shape changes, the scan-and-splice decision, the guard boundary, and the player_identifier addition. It also closes out T9a, which was still open from last time.

[Copilot]

🟡 Changes recommended

Several unresolved critical issues can leak denied data or crash on malformed input, and the new log-level setting is not applied by the documented configuration loaders.

7 open issues

• Unicode-escaped keys bypass the secret deny-list · New
• Composite secret values retain nested content · New
• Unterminated strings can underflow the redaction length · New
• HTTP bodies reach log sinks without central sanitization · New
• Config loaders ignore the new log_level setting · New
• Non-JSON text can be incorrectly redacted · New
• Redaction alters whitespace around the value · New

What changed in this PR

Adds the SDK’s core logging and JSON log-obfuscation infrastructure, including injectable loggers, structured HTTP entries, configurable log levels, stderr output, deny-list masking, and dedicated tests.

Changes:

• Introduces Logger, LogLevel, HttpEntry, StderrLogger, and HTTP formatting APIs.
• Adds scan-and-splice obfuscation for built-in and adopter-defined sensitive fields.
• Exposes logging configuration through Config.
• Integrates the implementation and test suite with CMake.

This pull request requires changes.

File	Summary	Review notes
tests/​test_log.cpp	Adds logging and obfuscation coverage.	No findings.
tests/​CMakeLists.txt	Registers the logging test executable.	No findings.
src/​core/​log.cpp	Implements log levels, stderr output, HTTP formatting, deny-list management, and JSON masking.	Critical: Decode escaped key names before deny-list matching (4 votes); handle composite denied values without exposing nested secrets (4 votes); prevent unterminated-string range underflow (1 vote); sanitize bodies through a central dispatch before invoking sinks (1 vote). Moderate: Preserve non-JSON bodies rather than scanning text containing quoted fields (2 votes); avoid truncating long HTTP summaries (1 vote). Nit: Preserve separator bytes when replacing values (4 votes).
include/​lootlocker/​log.h	Defines the public logging, HTTP entry, and obfuscation interfaces.	No findings.
include/​lootlocker/​config.h	Adds configurable logging support to Config.	Moderate: Parse and validate log_level in both configuration loaders and add tests (2 votes). Append the new member to preserve compatibility with positional aggregate initialization (1 vote).
CMakeLists.txt	Adds the logging implementation to the core library.	No findings.

_{Review effort: Lite}