feat(observability): 日志聚合后端 — logger环形缓冲 + GET /admin/observability/logs

- internal/logger/ring.go: Entry{time,level,source,msg} + RingBuffer(2000,满覆盖最旧,不阻塞)+ringHandler(slog旁路,Enabled委托内层,sourceOf提取source=再回落Scoped); Options.Ring非nil才包
- gateway/observability_logs.go: GET /admin/observability/logs?level=&limit= (writeAuth owner/admin) → {data:[{time(RFC3339 UTC),level,source,msg}]} 最新在前; level阈值过滤(warn=warn+error,已标注取舍); limit缺省200上限1000; 未知level400/未注入501
- routes.go注册 + observability.go SetLogBuffer(atomic.Pointer) + cmd/cyrene main.go/wireGatewayLogBuffer接线(logger先于gateway)
- 控制台/文件输出零变化; 记录只源自已产出日志,不额外打印敏感
- Docs/api-client v0.35; 测试(ring 10 + observability_logs 8 + cmd端到端2); build/vet/test绿(56)+win/darwin交叉编译

cmd/cyrene/main.go

@@ -70,7 +70,8 @@ func run() error {
 	if cfg.Env == "production" {
 		format = logger.FormatJSON
 	}
-	log := logger.New(logger.Options{Level: cfg.LogLevel, Format: string(format)})
+	logRing := logger.NewRingBuffer(logger.DefaultRingCapacity)
+	log := logger.New(logger.Options{Level: cfg.LogLevel, Format: string(format), Ring: logRing})
 	log = logger.WithSource(log, "main")
 
 	ctx, stop := platform.SignalContext()
@@ -80,6 +81,9 @@ func run() error {
 	if err != nil {
 		return err
 	}
+	// Observability log tail: the logger's ring buffer is built above (before the
+	// gateway), so hand it to the gateway now that the gateway exists.
+	wireGatewayLogBuffer(a, logRing)
 
 	if err := a.automation.Start(ctx); err != nil {
 		return fmt.Errorf("start automations: %w", err)

cmd/cyrene/observability.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"sync"
 
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/trace"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/services/gateway"
 )
@@ -81,6 +82,20 @@ func (f *traceFanout) WriteSpan(rec trace.SpanRecord) error {
 	return firstErr
 }
 
+// wireGatewayLogBuffer hands the composition root's log ring buffer to the
+// gateway, so GET /api/v1/admin/observability/logs serves the recent backend log
+// tail. The logger is built before the gateway (its records must be captured
+// from the first log line), so the buffer is injected here, the first moment the
+// gateway exists — like wireGatewayTraceSink does for spans. It is a no-op on a
+// boot without a gateway.
+func wireGatewayLogBuffer(a *app, buf *logger.RingBuffer) {
+	if a == nil || a.gw == nil || buf == nil {
+		return
+	}
+	a.gw.SetLogBuffer(buf)
+	a.log.Info("observability log buffer wired", "capacity", buf.Len())
+}
+
 // gatewaySpanSink adapts *gateway.Server to trace.Writer through its ObserveSpan
 // entry point, so an emitted span lands in the admin panel's trace ring buffer
 // AND in the LLM/subagent metric counters (ObserveSpan appends to the buffer and

cmd/cyrene/observability_test.go

@@ -11,6 +11,7 @@ import (
 
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/trace"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/services/gateway"
 )
@@ -142,6 +143,80 @@ func TestGatewaySpanSink_FeedsTraceEndpointAndMetrics(t *testing.T) {
 	}
 }
 
+// TestWireGatewayLogBuffer_Guards proves the boot helper tolerates a missing
+// gateway or buffer, so a degraded boot cannot panic on the log-tail path.
+func TestWireGatewayLogBuffer_Guards(t *testing.T) {
+	t.Parallel()
+	wireGatewayLogBuffer(nil, nil)
+	wireGatewayLogBuffer(&app{log: testLog()}, logger.NewRingBuffer(4))
+	wireGatewayLogBuffer(&app{log: testLog()}, nil)
+
+	jwt := auth.New(config.AuthConfig{JWTSecret: obsTestSecret})
+	gw, err := gateway.New(&config.Config{}, gateway.Deps{Log: testLog(), Auth: jwt})
+	if err != nil {
+		t.Fatalf("gateway.New: %v", err)
+	}
+	t.Cleanup(gw.Close)
+	wireGatewayLogBuffer(&app{log: testLog(), gw: gw}, nil)
+}
+
+// TestWireGatewayLogBuffer_FeedsLogEndpoint is the log-tail acceptance: the
+// process logger's ring buffer is handed to the gateway by the same helper run()
+// calls, and the records the app logged surface newest-first on
+// GET /api/v1/admin/observability/logs.
+func TestWireGatewayLogBuffer_FeedsLogEndpoint(t *testing.T) {
+	t.Parallel()
+	jwt := auth.New(config.AuthConfig{JWTSecret: obsTestSecret})
+	gw, err := gateway.New(&config.Config{}, gateway.Deps{Log: testLog(), Auth: jwt})
+	if err != nil {
+		t.Fatalf("gateway.New: %v", err)
+	}
+	t.Cleanup(gw.Close)
+	ts := httptest.NewServer(gw.Handler())
+	t.Cleanup(ts.Close)
+
+	// Exactly the boot path: run() builds the logger with the ring buffer before
+	// newApp and hands it to the gateway afterwards.
+	ring := logger.NewRingBuffer(8)
+	log := logger.WithSource(logger.New(logger.Options{
+		Level: "debug", Format: "text", Out: io.Discard, Ring: ring,
+	}), "main")
+	log.Info("boot ok")
+	log.Warn("disk filling")
+
+	a := &app{log: testLog(), gw: gw}
+	wireGatewayLogBuffer(a, ring)
+
+	tok, err := jwt.Sign("acct", auth.RoleOwner, time.Hour)
+	if err != nil {
+		t.Fatalf("sign token: %v", err)
+	}
+	var body struct {
+		Data []struct {
+			Time   string `json:"time"`
+			Level  string `json:"level"`
+			Source string `json:"source"`
+			Msg    string `json:"msg"`
+		} `json:"data"`
+	}
+	status, raw := obsGet(t, ts.URL+"/api/v1/admin/observability/logs", tok)
+	if status != http.StatusOK {
+		t.Fatalf("logs status = %d, want 200 (body=%s)", status, raw)
+	}
+	if err := json.Unmarshal(raw, &body); err != nil {
+		t.Fatalf("decode logs: %v (body=%s)", err, raw)
+	}
+	if len(body.Data) != 2 {
+		t.Fatalf("logs = %+v, want the two records logged above", body.Data)
+	}
+	if body.Data[0].Msg != "disk filling" || body.Data[0].Level != "warn" || body.Data[0].Source != "main" {
+		t.Fatalf("logs[0] = %+v, want the newest record (warn/disk filling/main)", body.Data[0])
+	}
+	if body.Data[1].Msg != "boot ok" || body.Data[1].Level != "info" {
+		t.Fatalf("logs[1] = %+v, want the older info record", body.Data[1])
+	}
+}
+
 // obsGet performs an authenticated owner GET and returns the status plus the raw
 // body.
 func obsGet(t *testing.T, url, token string) (int, []byte) {