From 3e5d742ac786152828793d635f1b9427d2b4c5f7 Mon Sep 17 00:00:00 2001
From: Kevin Nguyen <kevinnguyen.alms@gmail.com>
Date: Sat, 1 Aug 2026 19:20:29 +0700
Subject: [PATCH] CB-506: keep the test suite out of the production audit log
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

main/resources/logback.xml routes the `audit` logger to a RollingFileAppender
at logs/audit.log — the CB-505 security trail. AuditLogTest and
BridgedAppAuthTest exercise that same logger, so every `mvn test` appended
fabricated records to the production file.

They are byte-identical to genuine ones: runs of denied/forbidden
SPAWN/STOP/SEND from worker:term_a, which read exactly like an intrusion
attempt. logs/audit.2026-07-29.0.log is 38 fabricated records out of 76 — half
that day's security log is test fixtures, and nothing distinguishes them.

Fix is one new file, src/test/resources/logback-test.xml: logback prefers it on
the test classpath, so tests get a console-only config with no file appender
and main/resources/logback.xml is untouched. The `audit` logger stays ENABLED
(INFO, additivity=false) because AuditLogTest attaches its own ListAppender and
asserts on emitted records — setting it OFF would have silently gutted those
assertions.

Verified: 311 tests green, and logs/audit.log line count is identical before
and after a full `mvn clean install` (zero new records).

Implemented by an opencode-free worker over the bridge in an isolated worktree
(branch worker/cb-506-audit-test-isolation-e4aa9c-2); it correctly reported it
could not run mvn rather than fabricating a result, so the build gate and the
before/after audit-count check were run primary-side. Header comment added on
integration.
---
 bridged/src/test/resources/logback-test.xml | 37 +++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 bridged/src/test/resources/logback-test.xml

diff --git a/bridged/src/test/resources/logback-test.xml b/bridged/src/test/resources/logback-test.xml
new file mode 100644
index 0000000..5ab6fee
--- /dev/null
+++ b/bridged/src/test/resources/logback-test.xml
@@ -0,0 +1,37 @@
+<configuration>
+    <!--
+      CB-506 — test-run logging. This file is NOT boilerplate; it exists to keep the test suite
+      out of the CB-505 audit trail.
+
+      main/resources/logback.xml routes the `audit` logger to a RollingFileAppender at
+      logs/audit.log. AuditLogTest and BridgedAppAuthTest exercise that same logger, so without
+      this file `mvn test` appends fabricated records — denied/forbidden SPAWN/STOP/SEND from
+      worker:term_a — to the production security log, byte-identical to real ones. An investigator
+      could not tell a test fixture from a genuine intrusion attempt. Logback prefers
+      logback-test.xml when it is on the test classpath, so this governs test runs only.
+
+      Two constraints if you edit this:
+        - NEVER add a FileAppender/RollingFileAppender here. That reintroduces the bug.
+        - Keep `audit` ENABLED (INFO, additivity=false). Setting it to OFF would silently break
+          AuditLogTest, which attaches its own ListAppender and asserts on emitted records.
+    -->
+
+    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+        </encoder>
+    </appender>
+
+    <logger name="audit" level="INFO" additivity="false">
+        <appender-ref ref="STDOUT"/>
+    </logger>
+
+    <logger name="dev.ltms.bridged" level="WARN"/>
+
+    <logger name="org.eclipse.jetty" level="WARN"/>
+
+    <root level="INFO">
+        <appender-ref ref="STDOUT"/>
+    </root>
+
+</configuration>
\ No newline at end of file