From 48121aec0d6f6b74100993f9e8f739a4dfe8aa7f Mon Sep 17 00:00:00 2001
From: IgorRachkov <89467086+igor04091968@users.noreply.github.com>
Date: Sun, 14 Jun 2026 14:34:22 +0300
Subject: [PATCH] docs(portal): annotate structured access logging

---
 .../crates/detmir-portal/src/production/logging.rs    | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/adk-rust/crates/detmir-portal/src/production/logging.rs b/adk-rust/crates/detmir-portal/src/production/logging.rs
index 436843c..277cf16 100644
--- a/adk-rust/crates/detmir-portal/src/production/logging.rs
+++ b/adk-rust/crates/detmir-portal/src/production/logging.rs
@@ -1,3 +1,10 @@
+//! Structured HTTP access logging for the portal runtime.
+//!
+//! CONTRACT: logs are emitted as single-line JSON to stderr so systemd/journald,
+//! container runtimes and log forwarders can parse them without scraping free
+//! text. Do not log raw request bodies, secrets, evidence bytes or personal
+//! payloads here.
+
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
 
@@ -21,6 +28,10 @@ pub(crate) fn log_http_request(
     } else {
         Value::Null
     };
+
+    // SECURITY: include routing/correlation fields, but do not include query
+    // values, request body, headers or tokens. Those can contain employee data,
+    // screenshots, evidence references or API keys.
     eprintln!(
         "{}",
         json!({