Health, logging & monitoring

Logging posture

VerifAIer emits structured JSON logs via a component-scoped StructuredLogger. Each entry is a deterministic, sorted-key JSON object with mandatory component + severity attribution; INFO/WARNING go to stdout, ERROR/CRITICAL to stderr.

json log line

{"actor_id":"","component":"auth","created_at":"2026-07-05T12:00:00+00:00",
 "event_id":"…","event_type":"login_succeeded","metadata":{},
 "organization_id":"","severity":"INFO"}

• 12-factor: logs stream to stdout/stderr. Collect them with your platform's log aggregator; the app does not manage log files.
• Optional DB persistence: a logger created with persist=True also writes events to the observability store (default off to avoid startup coupling); logging never crashes the caller.
• No secrets or prompts: log metadata is JSON-safe-serialized and carries no key material or raw prompt/input text.
• Startup advisories: missing secrets print [SECURITY] … warnings to stderr at boot (informational; the app still starts).
• LOG_LEVEL (default INFO) is available for level configuration.

Smoke tests

Run these after every deploy/upgrade. All hit the open tier, no credentials needed, and exercise the full evidence → intelligence → registry path:

bash

BASE=http://localhost:8000
set -e
curl -sf $BASE/health | grep -q '"status":"ok"'                      # liveness + version
curl -sf -X POST $BASE/api/v1/audit/conversation \
  -H 'Content-Type: application/json' -d '{"input":"smoke test"}' >/dev/null   # audit
curl -sf -X POST $BASE/api/v1/trust/assess \
  -H 'Content-Type: application/json' -d '{"evidence":{}}' >/dev/null          # assess (safe on empty)
curl -sf -X POST $BASE/api/v1/registry/observe \
  -H 'Content-Type: application/json' -d '{"evidence":{}}' >/dev/null          # registry write
curl -sf $BASE/api/v1/registry/agents | grep -q '"count"'            # registry read
curl -sf $BASE/api/v1/control-center/overview >/dev/null              # fleet overview
echo "smoke OK"

For a fuller guided run with real evidence, use the First audit sample project. The full test suite (python -m pytest tests/ -q) is the pre-release gate.

Monitoring checklist