Module debug 

Admin API for debug mode: trace listing/retrieval and the plugin sandbox.

Every route except GET /api/debug/config responds 404 while debug.enabled is false. A 403 would confirm the surface exists, and these endpoints dump request contexts and execute plugins — the highest value target on the box. The 404 is defence in depth behind the Basic Auth layer, not a replacement for it.

Discoverability is preserved two ways: each gated rejection logs a warning naming the exact config key, and GET /api/debug/config always answers so the web UI can render an explanatory empty state instead of a mystery.

Structs

StepWithChanges 🔒

A step plus the changes derived from the preceding snapshot.

TraceFilter 🔒

Optional filters for the trace list, so a developer can pull just the recent requests on the policy or route they are working on. All are ANDed; empty strings are ignored (a bare ?route= is not a filter).

Functions

apply_filter 🔒

Keeps only the summaries matching every supplied filter.

bad_request 🔒

clear_traces 🔒

DELETE /api/debug/traces — empties the buffer.

disabled 🔒

The 404 returned when debug mode is off, matching the shape the rest of the Admin API uses for a missing resource.

get_config 🔒

GET /api/debug/config — the effective debug settings.

get_trace 🔒

GET /api/debug/traces/{id} — one trace with computed changes.

list_traces 🔒

GET /api/debug/traces — summaries, newest first.

non_empty 🔒

render_trace 🔒

Renders a trace with per-step changes computed at read time.

router

Builds the router for the /api/debug/* endpoints.

run_sandbox 🔒

POST /api/debug/sandbox — run ad-hoc nodes or a named policy against a synthetic context.

source_str 🔒