Every fasten SDK ships three structured streams threaded by one request_id. They are not interchangeable. This page is the decision table and the tradeoffs so you write each event to the right stream the first time.
emit(), log.info(), or the API middleware for a given event.
| The event is… | Use | Why |
|---|---|---|
| A typed decision the system commits to (payment captured, belief updated, permission granted) | Audit trails | Durable, hash-chained, defensible to a regulator. |
| A structured event a human wants to see when debugging (drainer backpressure, retry attempt, cache miss) | Syslog | Structured but ring-buffered by default; opt-in persistence for durability without the audit-row overhead. |
| An inbound or outbound HTTP call (route, method, status, duration) | API access | Stamped by the transport shim automatically; correlates the wire with everything downstream. |
| A metric ("count of X in the last minute") | None | fasten is not a metrics store. Use your existing metrics pipeline. |
| A distributed trace span | None | fasten is not a tracer. Emit the span to your trace vendor and let fasten thread request_id through it. |
target, actor, request_id, code, domain, time range). Bitemporal query with ?as_of= via membrane.SHORT 30d · MEDIUM 180d · LONG 1095d). Purge is age-based on timestamp.verify_chain() runs offline and returns first_break_at.FASTEN_SYSLOG_DSN (Python) or explicit SyslogStore (Go).request_id, timestamp, level, service_id, event. Free-text ?q= substring search when persisted (with since= mandatory, gated behind search.enabled).FASTEN_API_DSN (Python).request_id, timestamp, method, path, status, service_id.The /logs/correlate endpoint fans out to all three streams for one request_id and returns a unified view.
The response has audit[], api[], and sys[] arrays, plus per-stream counts, totals, truncated, and completeness (ring, store, or store-degraded) so the caller knows whether the returned rows are the full picture or a truncated window. See the auditor's runbook for the completeness contract.
PII in Syslog with medium retention. Syslog is structured but not schema-enforced. If you write PII into a Syslog event and enable persistence, the retention setting alone doesn't scrub it. Use FASTEN_REDACT_KEYS and treat any Syslog event carrying user data as requiring the SHORT retention.
Do not put decisions in Syslog to save cost. A "user X approved by manager Y" event belongs in Audit trails (hash-chained, defensible). Putting it in Syslog makes it a debug log entry, not audit evidence. The cost delta is small; the defensibility delta is total.
Rings can silently drop. A ring-only stream reports completeness: ring, meaning rows can be lost during a burst that exceeds ring size, never that they were. If you need the row to survive a burst, persist the stream.
The audit substrate for distributed systems, and the belief layer for the AI agents on top of them.