[log] Add debug logging to metrics, observability, and workflow compilation

pkg/cli/audit_cross_run.go

@@ -381,6 +381,7 @@ type metricsRawRow struct {
 // buildMetricsTrend computes aggregate metrics (min/max/avg/total, spike detection)
 // from a slice of per-run raw metric rows.
 func buildMetricsTrend(rows []metricsRawRow) MetricsTrendData {
+	auditCrossRunLog.Printf("Building metrics trend from %d rows", len(rows))
 	if len(rows) == 0 {
 		return MetricsTrendData{}
 	}
@@ -460,5 +461,8 @@ func buildMetricsTrend(rows []metricsRawRow) MetricsTrendData {
 		}
 	}
 
+	auditCrossRunLog.Printf("Metrics trend computed: avg_cost=%.4f, avg_tokens=%d, avg_turns=%.1f, cost_spikes=%d, token_spikes=%d",
+		trend.AvgCost, trend.AvgTokens, trend.AvgTurns, len(trend.CostSpikes), len(trend.TokenSpikes))
+
 	return trend
 }

pkg/cli/observability_insights.go

@@ -132,6 +132,7 @@ func buildAuditObservabilityInsights(processedRun ProcessedRun, metrics MetricsD
 		})
 	}
 
+	observabilityInsightsLog.Printf("Audit observability insights built: count=%d", len(insights))
 	return insights
 }
 
@@ -201,6 +202,7 @@ func buildLogsObservabilityInsights(processedRuns []ProcessedRun, toolUsage []To
 		if failureRate >= 0.5 {
 			severity = "high"
 		}
+		observabilityInsightsLog.Printf("Failure hotspot detected: workflow=%s failures=%d runs=%d rate=%.2f", failureHotspot.workflowName, failureHotspot.failures, failureHotspot.runs, failureRate)
 		insights = append(insights, ObservabilityInsight{
 			Category: "reliability",
 			Severity: severity,
@@ -224,6 +226,7 @@ func buildLogsObservabilityInsights(processedRuns []ProcessedRun, toolUsage []To
 	}
 	if driftHotspot != nil {
 		avgTurns := float64(driftHotspot.totalTurns) / float64(driftHotspot.runs)
+		observabilityInsightsLog.Printf("Execution drift detected: workflow=%s min_turns=%d max_turns=%d avg_turns=%.1f", driftHotspot.workflowName, driftHotspot.minTurns, driftHotspot.maxTurns, avgTurns)
 		insights = append(insights, ObservabilityInsight{
 			Category: "drift",
 			Severity: "medium",
@@ -316,6 +319,7 @@ func buildLogsObservabilityInsights(processedRuns []ProcessedRun, toolUsage []To
 		}
 	}
 
+	observabilityInsightsLog.Printf("Logs observability insights built: count=%d write_runs=%d read_only_runs=%d", len(insights), writeRuns, readOnlyRuns)
 	return insights
 }
 

pkg/workflow/command.go

@@ -164,12 +164,15 @@ func buildEventAwareCommandCondition(commandNames []string, commandEvents []stri
 		// No events enabled - this indicates a configuration error
 		return nil, fmt.Errorf("no valid comment events specified for commands %v - at least one event must be enabled", commandNames)
 	}
+	commandLog.Printf("Built %d command check(s) for commands: %v", len(commandChecks), commandNames)
 	commandCondition = BuildDisjunction(false, commandChecks...)
 
 	if !hasOtherEvents {
 		// If there are no other events, just use the simple command condition
+		commandLog.Print("Using simple command condition (no other events)")
 		return commandCondition, nil
 	}
+	commandLog.Print("Using event-aware condition (mixed command and non-command events)")
 
 	// Define which events should be checked for command
 	var commentEventTerms []ConditionNode

pkg/workflow/imports.go

@@ -357,6 +357,7 @@ func hasSafeOutputType(config *SafeOutputsConfig, key string) bool {
 
 // mergeSafeOutputConfig merges a single imported config map into the result SafeOutputsConfig
 func mergeSafeOutputConfig(result *SafeOutputsConfig, config map[string]any, c *Compiler) (*SafeOutputsConfig, error) {
+	importsLog.Printf("Merging imported safe-output config: key_count=%d", len(config))
 	// Create a frontmatter-like structure for extractSafeOutputsConfig
 	frontmatter := map[string]any{
 		"safe-outputs": config,
@@ -365,6 +366,7 @@ func mergeSafeOutputConfig(result *SafeOutputsConfig, config map[string]any, c *
 	// Use the existing extraction logic to parse the config
 	importedConfig := c.extractSafeOutputsConfig(frontmatter)
 	if importedConfig == nil {
+		importsLog.Print("Imported safe-output config extracted no fields, skipping merge")
 		return result, nil
 	}
 
@@ -555,6 +557,7 @@ func mergeSafeOutputConfig(result *SafeOutputsConfig, config map[string]any, c *
 	// The Jobs field is managed independently from other safe-output types to support
 	// complex merge scenarios and conflict detection across multiple imports.
 
+	importsLog.Print("Safe-output config merge completed")
 	return result, nil
 }
 

pkg/workflow/safe_outputs_tools_repo_params.go

@@ -5,6 +5,7 @@ import "fmt"
 // addRepoParameterIfNeeded adds a "repo" parameter to the tool's inputSchema
 // if the safe output configuration has allowed-repos entries or a wildcard "*" target-repo
 func addRepoParameterIfNeeded(tool map[string]any, toolName string, safeOutputs *SafeOutputsConfig) {
+	safeOutputsConfigLog.Printf("Checking if repo parameter needed for tool: %s", toolName)
 	if safeOutputs == nil {
 		return
 	}
@@ -138,6 +139,7 @@ func addRepoParameterIfNeeded(tool map[string]any, toolName string, safeOutputs
 
 	// Only add repo parameter if allowed-repos has entries or target-repo is wildcard ("*")
 	if !hasAllowedRepos && targetRepoSlug != "*" {
+		safeOutputsConfigLog.Printf("Skipping repo parameter for tool %s: no allowed-repos and target-repo is not wildcard", toolName)
 		return
 	}
 
@@ -176,6 +178,7 @@ func addRepoParameterIfNeeded(tool map[string]any, toolName string, safeOutputs
 // This mirrors the logic in addRepoParameterIfNeeded but returns the param instead
 // of modifying a tool in place, making it usable for generateToolsMetaJSON.
 func computeRepoParamForTool(toolName string, safeOutputs *SafeOutputsConfig) map[string]any {
+	safeOutputsConfigLog.Printf("Computing repo parameter definition for tool: %s", toolName)
 	// Reuse addRepoParameterIfNeeded by passing a scratch tool with an empty inputSchema.
 	scratch := map[string]any{
 		"name":        toolName,
@@ -193,7 +196,9 @@ func computeRepoParamForTool(toolName string, safeOutputs *SafeOutputsConfig) ma
 	}
 	repoProp, ok := properties["repo"].(map[string]any)
 	if !ok {
+		safeOutputsConfigLog.Printf("No repo parameter generated for tool: %s", toolName)
 		return nil
 	}
+	safeOutputsConfigLog.Printf("Repo parameter computed for tool: %s", toolName)
 	return repoProp
 }