palarran-security-log

Topics in the source

• Log security audit

Invocation: /palarran:security:log {scope} [--plan]. First read the profile guide, dated primary sources, shared audit contract, global memory and decision memory. 1. Bind the review to the target, revision/configuration, environment, event producers and intended investigation needs. Read target instructions, .palarran/INDEX.md, prior decisions and language settings. Use existing local context; unavailable remote recall is NOTRUN, not permission to make an extra service call. 2. Default to local read-only logging code, schemas, collector/sink configuration and already sanitized evidence. --plan writes a review/evidence plan without executing commands, querying logs, contacting targets or refreshing remote state. Live read queries need explicit target/read-role scope, time range, selected fields, page/byte bounds and a known approved cost cap. Do not dump logs, install collectors/scanners or run failure/volume tests under audit scope. 3. Trace application, ingress, worker, traces/errors and CI output through buffer, collector, storage, dashboard, export and backup. Identify producers, readers, unmask/export privileges, configuration administrators and deletion/retention authority. I

This is an excerpt. Refer to the complete source and its current requirements.