CerbiStream.GovernanceAnalyzer 1.1.22

CerbiStream Governance Analyzer

🛡️ What is CerbiStream Governance Analyzer?

A high‑performance Roslyn analyzer that enforces your organisation’s structured‑logging governance rules at build‑time – before code reaches production. It ships with a tiny runtime helper (optional) plus hot‑reloading JSON configs so you can evolve policy without redeploying.

• Prevents PII leakage and missing telemetry fields.
• Guarantees encryption settings for sensitive profiles.
• Emits actionable build errors (CERBI‑IDs) your CI pipeline can fail on.

One package. Zero code changes. Add the NuGet, drop a cerbi_governance.json, hit build.

🚀 Quick‑start

Why build‑time? Catch errors before they ship. Compilation fails fast, blocking merges and eliminating "fix‑it‑in‑prod" hot‑patches.

# inside your project
$ dotnet add package CerbiStream.GovernanceAnalyzer

Place cerbi_governance.json in your repo root (or anywhere – set the path via MSBuild/Env). Example profile:

{
  "EnforcementMode": "Strict",
  "LoggingProfiles": {
    "default": {
      "RequireTopic": true,
      "AllowedTopics": ["Auth","Payments"],
      "FieldSeverities": {
        "userId": "Required",
        "password": "Forbidden"
      },
      "EncryptionSettings": {
        "Mode": "AES",
        "FieldSeverity": "Required"
      }
    }
  }
}

Write logs the usual way. The analyzer handles the rest.

logger.LogInformation(new {
    Topic   = "Auth",        // ✅ whitelisted
    userId  = userId,
});

Missing required field? CERBI001. Wrong topic? CERBI020/021. CI fails – issue caught before merge.

✨ Feature Matrix

*Runtime checks live in GovernanceHelper.TryValidate() – optional for API‑level validation/tests.

🖇️ Topic Governance

Cerbi lets you declare a default topic once per class (or file) so individual calls stay clean.

using CerbiStream;

[CerbiTopic("Auth")]              // 👈 attribute sets the default
public class LoginController
{
    private readonly ILogger<LoginController> _log;

    public void SignIn(Guid userId)
    {
        _log.LogInformation(new { userId }); // Topic inferred = "Auth"
    }
}

Need to override inside a specific method? just add the property:

_log.LogInformation(new { Topic = "Auth:Reset", userId, reason });

// build errors
logger.LogInformation("ping");                         // CERBI021
logger.LogInformation(new { Topic = "Billing" });      // CERBI020

// success
logger.LogInformation(new { Topic = "Payments" });

Fast bypass for incident triage

for incident triage

logger.Relax().LogWarning("raw payload {json}", raw); // CERBI000 (Info)

If the profile sets "AllowRelax": false the build fails with CERBI007.

📄 Diagnostics Cheat‑sheet

All IDs use the CERBI‑prefix so you can filter easily in IDEs & pipelines.

🔌 Extensibility

• Plugin interface (ICustomGovernancePlugin) – add bespoke rules (e.g., team‑id in prod, audit score).
• Live reload – JSON file watcher reloads policy without restarting.

🌍 Logger ecosystem & plug‑in roadmap

The governance JSON is identical for every sink—no XML, no per‑logger quirks. What varies is how we intercept the call site to feed the analyzer and, optionally, append governance tags at runtime.

*Runtime tagging: when the plug‑in package is present, the logger automatically stamps GovernanceRelaxed (and phase‑2 GovernanceScore) on the emitted record so downstream pipelines or SIEM tools can filter.

🏆 Scoring (Phase 2 sneak‑peek)

Every violation will soon emit an impact score (0‑10). CI can fail on cumulative risk, not just presence of errors. Build output will include a summary table:

CERBI tally   :  4 errors   1 warning   26 score
Gate threshold: <=30  ✅ pass

Scoring is runtime‑friendly too—serialised as GovernanceScore for SIEM dashboards.

📚 Further reading

• Detailed schema – cerbi_governance.schema.json
• Blog post – "Shift‑Left Logging Governance with Roslyn" (coming soon)
• Governance FAQ – https://cerbi.systems/governance-faq

📦 Packaging & CI

📢 License & Contact

• License: MIT

• NuGet Packages:

  • CerbiStream.GovernanceAnalyzer
  • CerbiStream

• Website: https://cerbi.systems

• Email: mailto:hello@cerbi.io

• Discord: https://discord.gg/cerbi

Secure • Structured • Compliant

CerbiStream Governance Analyzer — © Cerbi LLC 2025