fix(bridge): isolate JSONL stdout

README.md

@@ -120,13 +120,18 @@ export ENCRYPTED_SPACES_SCHEMA_PATH=/path/to/app-schema.kdl
 export ENCRYPTED_SPACES_BACKEND_URL=ws://127.0.0.1:8080/ws
 # Optional, 1..3600000; defaults to 30000.
 export ENCRYPTED_SPACES_REQUEST_TIMEOUT_MS=30000
+# Optional diagnostics go to stderr; the default filter is `warn`.
+export RUST_LOG=encrypted_spaces_sdk=info,encrypted_spaces_changelog_core=debug
 encrypted-spaces-bridge
 ```
 
 Requests cannot override the schema, data commitment, or fast-forward guest
 image ID. `hello` reports those process-derived trust values and the diagnostic
 client label. The label is not an identity or authorization claim; Space
 credentials and membership proofs establish authorization. The
+bridge reserves stdout for JSONL responses. Configurable host SDK and verifier
+diagnostics use stderr through the standard `RUST_LOG` filter; verifier code
+inside a RISC Zero guest uses the zkVM debug console instead. The
 bridge supports Space create/join/snapshot/restore/sync, table insert/select,
 scoped list and collaborative text operations, encrypted file put/get,
 member invite/join/remove, cancellation, close, and shutdown. Request and

bridge/Cargo.toml

@@ -18,6 +18,8 @@ path = "src/main.rs"
 base64.workspace = true
 encrypted-spaces-ffproof = { workspace = true, features = ["prove"] }
 encrypted-spaces-sdk = { workspace = true, features = ["local-transport"] }
+env_logger.workspace = true
+log.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 sha2.workspace = true

bridge/src/main.rs

@@ -1,13 +1,25 @@
+#![deny(clippy::print_stdout)]
+
 mod protocol;
 mod runtime;
 mod schema;
 
 fn main() -> std::io::Result<()> {
+    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("warn"))
+        .target(env_logger::Target::Stderr)
+        .init();
+    log::debug!("bridge diagnostics initialized");
+
     let mut args = std::env::args_os();
     let _program = args.next();
     if args.next().is_some_and(|arg| arg == "--version") && args.next().is_none() {
-        println!("encrypted-spaces-bridge {}", env!("CARGO_PKG_VERSION"));
+        print_version();
         return Ok(());
     }
     protocol::run(std::io::stdin(), std::io::stdout())
 }
+
+#[allow(clippy::print_stdout)]
+fn print_version() {
+    println!("encrypted-spaces-bridge {}", env!("CARGO_PKG_VERSION"));
+}

bridge/tests/stdio.rs

@@ -28,17 +28,25 @@ struct Bridge {
 
 impl Bridge {
     fn spawn(client_label: &str) -> Self {
-        let mut child = Command::new(env!("CARGO_BIN_EXE_encrypted-spaces-bridge"))
+        Self::spawn_with_log_filter(client_label, None)
+    }
+
+    fn spawn_with_log_filter(client_label: &str, log_filter: Option<&str>) -> Self {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_encrypted-spaces-bridge"));
+        command
             .env("ENCRYPTED_SPACES_CLIENT_LABEL", client_label)
             .env(
                 "ENCRYPTED_SPACES_SCHEMA_PATH",
                 concat!(env!("CARGO_MANIFEST_DIR"), "/../demos/tauri/app_schema.kdl"),
             )
+            .env_remove("RUST_LOG")
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
-            .stderr(Stdio::piped())
-            .spawn()
-            .expect("spawn bridge");
+            .stderr(Stdio::piped());
+        if let Some(filter) = log_filter {
+            command.env("RUST_LOG", filter);
+        }
+        let mut child = command.spawn().expect("spawn bridge");
         let stdin = child.stdin.take().expect("bridge stdin");
         let stdout = child.stdout.take().expect("bridge stdout");
         let stderr = child.stderr.take().expect("bridge stderr");
@@ -177,6 +185,26 @@ impl Drop for Bridge {
     }
 }
 
+#[test]
+fn protocol_bridge_diagnostics_use_stderr_without_corrupting_jsonl() {
+    let mut bridge =
+        Bridge::spawn_with_log_filter(DEFAULT_CLIENT_LABEL, Some("encrypted_spaces_bridge=debug"));
+    bridge.send_request("diagnostic-hello", "hello", json!({}));
+
+    let response = bridge.receive();
+    assert_eq!(response["request_id"], "diagnostic-hello");
+    assert_eq!(response["ok"], true);
+
+    bridge.close_stdin();
+    bridge.expect_stdout_eof();
+    let (status, stderr) = bridge.finish();
+    assert!(status.success(), "bridge exited with {status}");
+    assert!(
+        stderr.contains("bridge diagnostics initialized"),
+        "configured diagnostics were not emitted to stderr: {stderr}"
+    );
+}
+
 fn request(request_id: &str, operation: &str, payload: Value) -> String {
     serde_json::to_string(&json!({
         "version": 1,

ffproof/changelog_core/Cargo.toml

@@ -10,6 +10,7 @@ postcard = { workspace = true }
 encrypted-spaces-acl-types = { workspace = true }
 hex.workspace = true
 instant.workspace = true
+log.workspace = true
 risc0-zkvm = { workspace = true, features = ["std"] }
 thiserror = { workspace = true }
 rand = { workspace = true, features = ["os_rng"] }