Report detections the guard did not block, not only the ones it did

[patchstackdave]

A rule that blocks nothing reports nothing.

firewall-log.js posts enforced blocks in the WordPress-compatible shape and answers "what did we stop". There was no way to see that a rule carrying enforcement: dry-run matched traffic it would otherwise have blocked — so a rule that is quietly wrong and a rule that is protecting look identical from the outside.

This adds a second, deliberately narrow channel for that.

The payload

sent	not sent
rule id	the matched value
route — request path, query string removed	the request body
parameters — what the rule reads	headers
phase, enforced, rules_etag, detected_at	query-string values, IP, user-agent

A channel that counts detections is a different thing from a copy of an application's traffic, and the difference is one careless field. Once values are collected, every question about retention, access and jurisdiction arrives with them — so anything value-level belongs behind its own explicit opt-in with its own controls, not as a side effect of counting.

Two details worth review:

The regression guard is a scan of the serialized payload, not of the object being built. A field added later — message, value, headers — passes every structural assertion and only fails that scan, which is the direction this has to fail in.

parameters is the set the rule reads, from its own definition, not the condition that matched. The engine reports a rule, not which of its conditions fired, and threading that out would mean changing evaluation for the sake of a reporting field. A rule with a single parameter — the common case for a narrowly scoped rule — gives the same answer either way.

Off by default

Enabling it adds an outbound POST to every guard configured with a site UUID. That is a change in what an installed app does on the network, and it belongs in the shipped docs before it becomes a default rather than after. reportDetections: true switches it on; detectionFlushMs tunes the batch window.

Wiring it default-on also broke 32 existing tests — the same fact, stated by the suite.

Bounded (500 events, oldest dropped) and fail-open: an unreachable endpoint is silent and never retries into a loop. The drop count is sent with the batch, because a consumer computing a rate from these needs to know its denominator is short, and nobody infers that from a gap.

Verification

1249 tests, typecheck clean. Four guarantees mutation-checked — keeping the query string, adding the block message to the payload, removing the queue cap, and deriving enforced from the site mode rather than the rule each fail the assertion that names them.

[coderbuds]

Detection reporter reliably logs dry-run events without exposing sensitive data.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

🛡️ Standards: no pre-flight fit check ran for this change — wire assess-change-fit into your coding agents to catch size before opening.

📈 This month: Your 100th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review