# EVENTS — `mgf-apiprobe`

Stable structured-log `event` names (LG-15). Each is emitted as the `event` field on an INFO+
record (or via `add_event` inside the suite operation span). Event names are **public-API-stable**
in `<subject>.<action>` form — renamed only via a deprecation cycle (LG-15 / LOGGING §4.5).

| Event | Level | Where | Meaning |
|---|---|---|---|
| `apiprobe.suite.run` | INFO | `core/suite.py` `Suite.run` | Operation start+end logged at INFO (`operation` field) + OTel span (trace context). LG-11. |
| `apiprobe.suite.completed` | INFO | `core/suite.py` `Suite.run` | INFO completion record (carries `operation` + `event`); attributes: `probes`, `findings`. |
| `apiprobe.probe.transport_error` | WARNING | `core/suite.py` `_run_one_probe` | A probe's HTTP transport call failed (translated to a synthetic finding). Attributes: `probe`. |
| `apiprobe.probe.exception` | WARNING | `core/suite.py` `_execute` | A probe raised unexpectedly inside the defensive wrap (RA-01). Attributes: `probe`, `fingerprint`. |
| `apiprobe.probe.escaped_wrap` | ERROR | `core/suite.py` `Suite.run` | A probe exception escaped the defensive wrap (should be unreachable). Attributes: `probe`, `fingerprint` (LG-17). |
| `apiprobe.check.exception` | WARNING | `core/suite.py` `_run_one_probe` | A check raised on a probe's response. Attributes: `check`, `probe`, `fingerprint`. |
| `mgf_apiprobe.severity_override` | WARNING | `core/suite.py` | A finding's severity was overridden by policy (audit event, `audit=true`). |

Logging is configured once at the console entry (`cli/__main__.py:_entry` → `mgf.common.bootstrap`,
LG-02/06): the federation JSON formatter adds OTel `trace_id`/`span_id` when a span is active (LG-03),
correlation propagates via the span context's `contextvars` (LG-14), and WARNING/ERROR records carry
WHAT/WHY/HOW (`extra={}` fields + `fingerprint`, LG-16/17).
