#Observability

UniCAS exposes three current diagnostic surfaces:

1. Server-Timing headers on tenant-plane responses.
2. Worker stdout/stderr through Cloudflare logs or the local Miniflare terminal.
3. Durable control-plane and Root Ref audit records through authenticated admin APIs, the unicas CLI, or MCP tools.

Do not log bearer capabilities, session cookies, CSRF tokens, private keys, or OAuth authorization codes.

#Server-Timing

Tenant routes return a Server-Timing header and Timing-Allow-Origin: *. Repeated operations are aggregated and include a call count. Depending on the request path, entries can include:

Inspect headers from a tenant request with curl -i or the browser network panel. A representative header is:

Server-Timing: cas_schema;dur=2.1, cas_auth;dur=4.5, cas_do;dur=11.8, cas_edge;dur=20.3
Timing-Allow-Origin: *

Use the metric breakdown to identify the controlling layer before changing timeouts: auth latency points at issuer/JWKS work, cas_do includes actor serialization, and an individual D1 or R2 metric points at storage.

The public GET /health endpoint intentionally returns only service health and does not initialize storage or emit timing metrics.

#Runtime logs

Production Worker logs are available with Wrangler:

pnpm --filter @unicas/service-cloudflare exec wrangler tail

The current structured events are:

• cas_stack_authorization: stack capability authorization decisions. The payload comes from the authority verifier and includes its decision kind.
• admin_oidc_callback_failed: administrator OIDC callback failures with a bounded reason such as state_mismatch or id_token_invalid.

Unexpected tenant authorization, service actor, Durable Object, administrator BFF, and R2 upload failures are written to stderr with an exception. These are incident signals; expected protocol rejections remain structured HTTP responses and are not logged as exceptions.

pnpm dev writes Miniflare and Worker logs to the terminal. It does not create a repository JSONL log file. Redirect terminal output only into a gitignored path when a reproducible local investigation needs a retained transcript, and review it for credentials before sharing.

#Control-plane audit

Control mutations append audit records containing the stack, actor, action, target, request identity, trace identity, caller channel, and timestamp. Read those records through authenticated control-plane surfaces:

unicas audit control <stackId> --limit 50
unicas ref-domains list <stackId>
unicas audit root-domain-refs <stackId> <refDomain> --limit 50
unicas audit root-domain-events <stackId> <refDomain> --limit 50

Use the returned cursor unchanged for the next control or balance page. Root Ref event pagination uses --after. A stale balance cursor means the snapshot changed; restart from the first page instead of combining revisions.

The Worker's /_internal/audit/* routes are private adapter RPCs protected by CAS_AUDIT_READER_KEY. They fail closed as 404 without the exact key and are not operator-facing public APIs. Prefer the CLI, WebUI, or MCP surface.

#Operational checks

For a basic local or production triage:

1. Check GET /health for edge reachability.
2. Reproduce one authenticated tenant request and inspect Server-Timing.
3. Correlate unexpected failures in wrangler tail or the local terminal.
4. Read the stack's control and Root Ref audit records for the business action.
5. Verify active issuer state with unicas oauth-issuer get <stackId> when authorization fails.

The detailed SLOs, alerts, backup procedure, and incident runbooks live in CAS middleware operations.