feat!: rewrite to local JSONL logging, replace Analysis Server architecture

Changes:
- Replace AnalysisFilter/AnalysisService/AnalysisConfig with
  RequestLogFilter/RequestLogService/RequestLogConfig
- Rename env vars from ANALYSIS_* to REQUEST_LOG_*
- Remove Guzzle dependency, queue system, and AnalysisSend command
- Write JSONL directly to writable/logs/analysis.log with daily
  rotation, gzip compression, and retention pruning
- Add requestlog:rotate spark command for manual/cron rotation
- Add docs/wazuh.md with agent config, JSON decoder, and
  detection rules (suspicious file upload, SQL injection, etc.)
- Update README, CHANGELOG (v2.0.0), .gitignore, composer.json

BREAKING CHANGE: Filter alias changes from 'analysis' to
'requestlog'. Config class Analysis -> RequestLog. Env vars
ANALYSIS_* -> REQUEST_LOG_*. No Guzzle/server/queue required.

Author: noplanalderson

.ai/INSTRUCTION.md

@@ -31,5 +31,4 @@ Thumbs.db
 /build/
 /dist/
 
-# Analysis queue (local spool)
-/analysis_queue/
+/ai/

.gitignore

@@ -5,37 +5,39 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.0] - 2026-08-31
+
+### Changed
+
+- **Architecture overhaul**: logs are no longer sent to an external Analysis
+  Server. The filter now writes directly to the CodeIgniter `writable/logs`
+  directory as JSON Lines.
+- Configuration renamed from `ANALYSIS_*` to `REQUEST_LOG_*`; config class
+  `Analysis` → `RequestLog`.
+- Filter renamed `AnalysisFilter` → `RequestLogFilter` (alias `requestlog`).
+- Service renamed `AnalysisService` → `RequestLogService`.
+- Single log file `analysis.log` with automatic daily rotation + gzip
+  compression + retention pruning.
+
+### Removed
+
+- `AnalysisSend` command, local queue, and `failed/` retry handling.
+- Guzzle dependency and `ANALYSIS_SERVER_URL` / `ANALYSIS_API_KEY` config.
+
+### Added
+
+- `requestlog:rotate` spark command — manual/cron fallback for rotation,
+  gzip compression and pruning of old logs.
+- `REQUEST_LOG_RETENTION_DAYS` config (default 30) to control how many days of
+  compressed logs are kept.
+
 ## [1.0.0] - 2026-08-31
 
 ### Added
 
-- `AnalysisFilter` (CI4 filter) — manual per-route attachment, enabled check,
-  IP whitelist skip, non-blocking queue + background send.
-- `AnalysisService` — request metadata collection (`timestamp`, `domain`,
-  `path`, `method`, `srcip`, `user_agent`, `query_string`, `headers`,
-  `raw_body`, `file_count`, `file_names`, `file_metadata`).
-- Sensitive-field redaction (recursive, case-insensitive; default:
-  `password`, `nik`, `Api-Key`, `no_telp`).
-- Body truncation at `ANALYSIS_MAX_BODY_SIZE` with configurable suffix.
-- File upload metadata (original name, size, MIME, extension, SHA-256 hash,
-  double-extension detection) — binary content is never sent.
-- Local file-based queue with `ANALYSIS_MAX_QUEUE` enforcement (oldest dropped).
-- `AnalysisSend` spark command — sends queued entries, retries on failure,
-  moves items to `failed/` after `ANALYSIS_MAX_RETRIES`.
-- `Analysis` config class reading all `ANALYSIS_*` environment variables.
-- IP/CIDR whitelist (RFC1918 + localhost by default) via `AnalysisService`.
-- Multi-tenant identification from `HTTP_HOST` subdomain.
-- Guzzle 7 HTTP client with configurable timeout.
-- PHP 7.4 and PHP 8.4+ support.
-
-## [Unreleased]
-
-### Planned
-
-- Unit tests (PHPUnit) for `AnalysisService` and `AnalysisSend`.
-- Analysis Server (Docker: PHP-FPM + Nginx on Alpine) with daily gzip log
-  rotation and Wazuh integration.
-- k6 load test script.
-- Sample CI4 application showing integration.
+- Initial release: `AnalysisFilter`, `AnalysisService`, `Analysis` config and
+  `AnalysisSend` command with queue-based asynchronous delivery to an Analysis
+  Server. Superseded by 2.0.0.
 
+[2.0.0]: https://github.com/mrnaeem4/ci4-request-analysis/releases/tag/v2.0.0
 [1.0.0]: https://github.com/mrnaeem4/ci4-request-analysis/releases/tag/v1.0.0

CHANGELOG.md

@@ -1,36 +1,34 @@
 # ci4-request-analysis
 
 CodeIgniter 4 library that intercepts incoming HTTP requests, extracts structured
-metadata (headers, body, files, tenant, source IP, etc.), and asynchronously sends a
-JSON log to a dedicated Analysis Server — with local file-based queuing, retry,
-sensitive-field redaction, body truncation, and IP whitelisting.
+metadata (headers, body, files, tenant, source IP, etc.), and writes one JSON
+Line per request directly to the CI4 `writable/logs` directory — with
+sensitive-field redaction, body truncation, IP whitelisting, and daily log
+rotation with gzip compression.
 
-> Client side only. The Analysis Server (Docker: PHP-FPM + Nginx on Alpine, log
-> rotation, Wazuh consumption) is delivered in the `server/` directory of this
-> repository.
+> Local logging only. No external server, no queue, no Guzzle.
 
 ## Features
 
 - Attachable per-route (manual), not global.
-- Non-blocking delivery: log is spooled locally, then sent by a background
-  `analysis:send` command (triggered by the filter and/or cron).
-- Local file-based queue with max-size enforcement (oldest dropped) and
-  exponential retry; items are moved to `failed/` after `max_retries`.
-- Multi-tenant identification via subdomain (`HTTP_HOST`).
+- Writes directly to `writable/logs/analysis.log` as JSON Lines (JSONL).
+- Daily rotation: a file from a previous day is renamed and gzip-compressed
+  automatically on the next write.
+- Retention pruning: compressed logs older than `REQUEST_LOG_RETENTION_DAYS`
+  (default 30) are deleted.
 - Configurable sensitive-field redaction (default: `password`, `nik`, `Api-Key`, `no_telp`).
 - Raw body truncation at 3 MB (configurable) with `... [truncated]` suffix.
 - File upload metadata captured without binary content (name, size, MIME,
   extension, SHA-256 hash, double-extension detection).
 - IP/CIDR whitelist to skip private/internal traffic.
-- API-key authentication on the Analysis Server.
+- Multi-tenant identification via subdomain (`HTTP_HOST`).
 - PHP 7.4 and PHP 8.4+.
 
 ## Requirements
 
-- PHP 7.4+ / 8.4+ (with `exec` enabled)
+- PHP 7.4+ / 8.4+
 - CodeIgniter 4 (>= 4.3)
-- Guzzle 7
-- A writable local queue directory
+- A writable `writable/logs` directory
 
 ## Installation
 
@@ -44,34 +42,28 @@ Set the following environment variables in your CI4 application `.env`
 (or system environment):
 
 ```ini
-ANALYSIS_ENABLED          = true
-ANALYSIS_SERVER_URL       = "http://host.docker.internal:8081/analyze"
-ANALYSIS_API_KEY          = "your-shared-api-key"
-ANALYSIS_TIMEOUT          = 2
-ANALYSIS_MAX_QUEUE        = 10000
-ANALYSIS_QUEUE_DIR        = "/tmp/analysis_queue"
-ANALYSIS_REDACT_FIELDS    = "password,nik,Api-Key,no_telp"
-ANALYSIS_MAX_BODY_SIZE    = 3145728
-ANALYSIS_WHITELIST_IPS    = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1"
-ANALYSIS_TRUNCATE_SUFFIX  = "... [truncated]"
-ANALYSIS_MAX_RETRIES      = 5
+REQUEST_LOG_ENABLED          = true
+REQUEST_LOG_DIR              = "writable/logs"
+REQUEST_LOG_FILE             = "analysis.log"
+REQUEST_LOG_REDACT_FIELDS    = "password,nik,Api-Key,no_telp"
+REQUEST_LOG_MAX_BODY_SIZE    = 3145728
+REQUEST_LOG_WHITELIST_IPS    = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,127.0.0.1"
+REQUEST_LOG_TRUNCATE_SUFFIX  = "... [truncated]"
+REQUEST_LOG_RETENTION_DAYS   = 30
 ```
 
 ### Config reference
 
 | Variable | Default | Description |
 |---|---|---|
-| `ANALYSIS_ENABLED` | `false` | Master switch for the filter. |
-| `ANALYSIS_SERVER_URL` | `''` | Analysis Server endpoint (POST `/analyze`). |
-| `ANALYSIS_API_KEY` | `''` | Shared static API key sent in the `X-API-Key` header. |
-| `ANALYSIS_TIMEOUT` | `2` | HTTP timeout (seconds) when sending a log entry. |
-| `ANALYSIS_MAX_QUEUE` | `10000` | Max queued items; oldest are dropped when exceeded. |
-| `ANALYSIS_QUEUE_DIR` | `sys_get_temp_dir()/analysis_queue` | Directory for the local spool. |
-| `ANALYSIS_REDACT_FIELDS` | `password,nik,Api-Key,no_telp` | Comma-separated sensitive fields (case-insensitive). |
-| `ANALYSIS_MAX_BODY_SIZE` | `3145728` (3 MB) | `raw_body` truncation length (bytes). |
-| `ANALYSIS_WHITELIST_IPS` | RFC1918 + localhost | CIDR ranges to skip. |
-| `ANALYSIS_TRUNCATE_SUFFIX` | `... [truncated]` | Appended when the body is truncated. |
-| `ANALYSIS_MAX_RETRIES` | `5` | Send attempts before moving to `failed/`. |
+| `REQUEST_LOG_ENABLED` | `false` | Master switch for the filter. |
+| `REQUEST_LOG_DIR` | `''` (→ `writable/logs`) | Directory for the log file. |
+| `REQUEST_LOG_FILE` | `analysis.log` | Log file name (single file, rotated daily). |
+| `REQUEST_LOG_REDACT_FIELDS` | `password,nik,Api-Key,no_telp` | Comma-separated sensitive fields (case-insensitive). |
+| `REQUEST_LOG_MAX_BODY_SIZE` | `3145728` (3 MB) | `raw_body` truncation length (bytes). |
+| `REQUEST_LOG_WHITELIST_IPS` | RFC1918 + localhost | CIDR ranges to skip. |
+| `REQUEST_LOG_TRUNCATE_SUFFIX` | `... [truncated]` | Appended when the body is truncated. |
+| `REQUEST_LOG_RETENTION_DAYS` | `30` | Days of compressed logs kept before pruning. |
 
 ## Usage
 
@@ -82,112 +74,127 @@ In `app/Config/Filters.php`:
 ```php
 public $aliases = [
     // ...
-    'analysis' => \MrNaeem\Ci4RequestAnalysis\Filters\AnalysisFilter::class,
+    'requestlog' => \MrNaeem\Ci4RequestAnalysis\Filters\RequestLogFilter::class,
 ];
 ```
 
 ### 2. Attach to specific routes
 
 ```php
-$routes->group('api', ['filter' => 'analysis'], function ($routes) {
+$routes->group('api', ['filter' => 'requestlog'], function ($routes) {
     $routes->post('profile/update', 'Profile::update');
     $routes->post('search', 'Search::index');
     $routes->post('upload/avatar', 'Upload::avatar');
 });
 ```
 
-Only these routes will be analyzed — nothing is logged globally.
+Only these routes are logged — nothing is logged globally.
 
-### 3. Ensure the queue directory is writable
+### 3. Verify writable logs directory
 
-The directory must be writable by the web server. It is created automatically,
-but on a persistent/containerized deployment mount it to a volume:
+The web server must be able to write to `writable/logs`. The directory is
+created automatically if missing:
 
 ```bash
-mkdir -p /tmp/analysis_queue && chown -R www-data:www-data /tmp/analysis_queue
+mkdir -p writable/logs && chown -R www-data:www-data writable/logs
 ```
 
-### 4. Run the sender
+### 4. (Optional) Run rotation via cron
 
-The filter spawns `analysis:send` in the background on each analyzed request.
-For retries of failed items, schedule it via cron (every minute):
+Rotation happens automatically on write. For a guaranteed nightly pass and
+retention cleanup, schedule `requestlog:rotate` daily:
 
 ```cron
-* * * * * cd /path/to/app && php spark analysis:send >/dev/null 2>&1
+0 0 * * * cd /path/to/app && php spark requestlog:rotate >/dev/null 2>&1
 ```
 
 Or run it manually:
 
 ```bash
-php spark analysis:send
+php spark requestlog:rotate
 ```
 
 ## Log payload
 
-Each entry sent to the Analysis Server is a JSON object:
+Each line in `analysis.log` is a JSON object (envelope + `log_data`):
 
 ```json
 {
-  "timestamp": "2026-08-31T02:15:04+00:00",
-  "domain": "app.example.com",
-  "path": "/api/profile/update",
-  "method": "POST",
-  "srcip": "203.0.113.10",
-  "user_agent": "Mozilla/5.0 ...",
-  "query_string": "page=1",
-  "headers": { "Content-Type": "application/json", ... },
-  "raw_body": "{\"name\":\"User\",\"email\":\"user@example.com\",\"password\":\"***REDACTED***\"}",
-  "file_count": 1,
-  "file_names": ["shell.php.jpg"],
-  "file_metadata": [
-    {
-      "original_name": "shell.php.jpg",
-      "size": 20480,
-      "mime_type": "image/jpeg",
-      "extension": "jpg",
-      "hash": "3c98...",
-      "has_double_extension": true
-    }
-  ]
+  "log_data": {
+    "timestamp": "2026-08-31T02:15:04+00:00",
+    "domain": "app.example.com",
+    "path": "/api/profile/update",
+    "method": "POST",
+    "srcip": "203.0.113.10",
+    "user_agent": "Mozilla/5.0 ...",
+    "query_string": "page=1",
+    "headers": { "Content-Type": "application/json", ... },
+    "raw_body": "{\"name\":\"User\",\"email\":\"user@example.com\",\"password\":\"***REDACTED***\"}",
+    "file_count": 1,
+    "file_names": ["shell.php.jpg"],
+    "file_metadata": [
+      {
+        "original_name": "shell.php.jpg",
+        "size": 20480,
+        "mime_type": "image/jpeg",
+        "extension": "jpg",
+        "hash": "3c98...",
+        "has_double_extension": true
+      }
+    ]
+  },
+  "retry_count": 0,
+  "last_attempt": null,
+  "created_at": "2026-08-31T02:15:04+00:00"
 }
 ```
 
+## Log rotation
+
+- Active file: `writable/logs/analysis.log`
+- Rotated file: `writable/logs/analysis-YYYY-MM-DD.log.gz`
+
+When a write detects the active file belongs to a previous day, it is renamed
+to `analysis-YYYY-MM-DD.log`, compressed with gzip, and the original removed.
+Compressed files older than `REQUEST_LOG_RETENTION_DAYS` are pruned.
+
 ## How it works
 
 ```
-Client (CI4)
-  Filter (before hook)
-    ├─ enabled? ──no──► done
-    ├─ IP whitelisted? ──yes──► done
-    ├─ collect: headers, body, files, tenant, srcip...
-    │    ├─ redact sensitive fields
-    │    ├─ truncate body at max size
-    │    └─ extract file metadata (no binary)
-    ├─ queue: write JSON to ANALYSIS_QUEUE_DIR
-    └─ triggerSend: background `php spark analysis:send`
-
-AnalysisSend (spark command)
-  └─ for each queue file:
-       ├─ send POST to ANALYSIS_SERVER_URL (X-API-Key header)
-       ├─ success → delete file
-       └─ failure → retry_count++, move to failed/ after max_retries
+Request → RequestLogFilter (before hook)
+  ├─ enabled? ──no──► done
+  ├─ IP whitelisted? ──yes──► done
+  ├─ collect: headers, body, files, tenant, srcip...
+  │    ├─ redact sensitive fields
+  │    ├─ truncate body at max size
+  │    └─ extract file metadata (no binary)
+  ├─ rotate if the active log is from a previous day (rename + gzip + prune)
+  └─ append one JSONL line to writable/logs/analysis.log
 ```
 
+The write is a single append with `LOCK_EX`, so it does not block the request
+and is safe for concurrent PHP-FPM workers.
+
 ## Security notes
 
-- Redaction happens client-side before the body is sent; binary file content is
-  never transmitted.
+- Redaction happens before the body is written; binary file content is never
+  stored.
 - Do not log `Authorization`/`Cookie` values unless required — redact them by
-  adding their field names to `ANALYSIS_REDACT_FIELDS`.
-- Keep `ANALYSIS_API_KEY` out of version control (use `.env`).
-- The `exec` PHP function must be enabled for background sending; otherwise use
-  cron only.
+  adding their field names to `REQUEST_LOG_REDACT_FIELDS`.
+- `writable/logs` should not be publicly accessible (CI4 already blocks it by
+  default); logs are git-ignored via `/writable/`.
 
 ## Multi-tenant
 
 The tenant is derived from the subdomain via `HTTP_HOST` and stored in the
 `domain` field of the payload. No extra configuration is required.
 
+## Wazuh integration
+
+The library ships with a ready-to-use Wazuh setup: a JSON decoder for the
+`analysis.log` envelope, detection rules, and agent config that points to
+`writable/logs/analysis.log`. See [docs/wazuh.md](docs/wazuh.md).
+
 ## Testing
 
 ```bash

README.md

@@ -1,20 +1,18 @@
 {
     "name": "mrnaeem4/ci4-request-analysis",
-    "description": "CodeIgniter 4 library that intercepts incoming HTTP requests and asynchronously sends structured JSON request logs to an Analysis Server.",
+    "description": "CodeIgniter 4 library that intercepts incoming HTTP requests and writes structured JSON request logs (JSONL) to the CI4 logs directory with daily rotation and gzip compression.",
     "type": "library",
     "license": "MIT",
     "keywords": [
         "codeigniter4",
         "request-log",
-        "analysis",
+        "jsonl",
         "filter",
-        "async",
-        "guzzle"
+        "log-rotation"
     ],
     "require": {
         "php": "^7.4 || ^8.0",
-        "codeigniter4/framework": "^4.3",
-        "guzzlehttp/guzzle": "^7.0"
+        "codeigniter4/framework": "^4.3"
     },
     "require-dev": {
         "phpunit/phpunit": "^9.5"