feat: add a private enterprise SD-ELEMENT for the log pipeline

[DavidCozens]

Write a private enterprise SD-ELEMENT. RFC 5424 reserves this form for definitions of your own, and
SyslogPipelineSd.c is a complete example of one: it implements the library's structured-data
extension point in its own translation unit.

static void SyslogPipelineSd_Format(struct SolidSyslogStructuredData* base, struct SolidSyslogSdElement* element)
{
    (void) base;

    SolidSyslogSdElement_Begin(element, "logPipeline", SYSLOG_ENTERPRISE_NUMBER);
    SolidSyslogSdValue_String(SolidSyslogSdElement_Param(element, "transport"), "tls");
    SolidSyslogSdValue_String(SolidSyslogSdElement_Param(element, "atRest"), "hmac-sha256");
    SolidSyslogSdElement_End(element);
}

static struct SolidSyslogStructuredData s_pipelineSd = {SyslogPipelineSd_Format};

... [logPipeline@32473 transport="tls" atRest="hmac-sha256"] device started

The vtable has one entry, Format, and the library never allocates the object. A stateless source
therefore needs no _Create and no pool slot; it is a static this application owns and points the
config at. A source with per-instance state puts that state alongside the vtable in the same struct
and reads it back from the base parameter.

A non-zero enterprise number is what produces a private SD-ID: _Begin emits name@number for one
and a bare IANA name for zero. SyslogEnterprise.h now defines the number and derives the string
that origin's enterpriseId carries, so the two forms cannot drift.

What the element reports is the state of the logging path. A collector can confirm that a record
arrived over TLS and was sealed at rest, and can alert on a device whose pipeline has weakened. The
remaining stages change both values as the protection changes.

It lives in its own file rather than in Syslog.c because it is an object implementing a library
interface rather than wiring. The figures are identical either way.

Summary by CodeRabbit

• New Features

  • Added structured syslog metadata identifying TLS transport and HMAC-SHA256 at-rest protection.
  • Added a private logPipeline@32473 structured-data element to emitted records.

• Documentation

  • Updated usage guidance, output examples, implementation details, and cost estimates for pipeline structured data.

• Tests

  • Updated performance and size reports to validate the new pipeline metadata output.

[coderabbitai]

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 137d5113-7d33-4be3-80ae-1861be71a3f9

📥 Commits

Reviewing files that changed from the base of the PR and between d524d64 and 78867c9.

⛔ Files ignored due to path filters (2)

• measurements/pipeline-sd.csv is excluded by !**/*.csv
• measurements/stages.tsv is excluded by !**/*.tsv

📒 Files selected for processing (7)

• CMakeLists.txt
• README.md
• app/syslog/Syslog.c
• app/syslog/SyslogEnterprise.h
• app/syslog/SyslogPipelineSd.c
• app/syslog/SyslogPipelineSd.h
• run-report.md

---

📝 Walkthrough

Walkthrough

The change adds a private logPipeline@32473 structured-data provider. It reports TLS transport and HMAC-SHA256 at-rest protection, registers during syslog startup, builds in the baseline executable, and updates documentation and measurements.

Changes

Pipeline structured-data reporting

Layer / File(s)	Summary
Provider contract and formatter app/syslog/SyslogEnterprise.h, app/syslog/SyslogPipelineSd.h, app/syslog/SyslogPipelineSd.c	Defines enterprise number 32473 and adds a stateless provider that emits logPipeline@32473 with transport=tls and atRest=hmac-sha256.
Build and startup registration CMakeLists.txt, app/syslog/Syslog.c	Builds the provider and registers it as the fourth structured-data entry during Syslog_Start.
Documentation and run validation README.md, run-report.md	Documents the Private SD-ELEMENT stage and updates output, cost, size, and self-check measurements for pipeline-sd.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Syslog_Start
  participant SyslogPipelineSd
  participant Syslog_Record
  Syslog_Start->>SyslogPipelineSd: SyslogPipelineSd_Get()
  Syslog_Start->>Syslog_Record: register structured-data provider
  Syslog_Record->>SyslogPipelineSd: format pipeline metadata
  SyslogPipelineSd-->>Syslog_Record: logPipeline@32473 with TLS and HMAC-SHA256

Loading

Possibly related PRs

• cososo-ltd/solid-syslog-example#23: Implements the same SyslogPipelineSd private enterprise structured-data feature.
• cososo-ltd/solid-syslog-example#45: Makes the same provider, enterprise-ID, registration, documentation, and measurement changes.
• cososo-ltd/solid-syslog-example#24: Extends SyslogPipelineSd to report configured TLS transport.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch stage-15-pipeline-sd

---

_{Comment @coderabbitai help to get the list of available commands.}

[DavidCozens]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.