System Log

shared/protocol.js

@@ -72,6 +72,8 @@ export const MethodRoles = Object.freeze({
   listAnomalies: Roles.viewer,
   listAlerts: Roles.viewer,
   getAlert: Roles.viewer,
+  /** Anomaly source: viewer; audit/journal enforced admin inside handler */
+  queryLogs: Roles.viewer,
 
   // alerts / thresholds (write)
   setAlertConfig: Roles.operator,

shared/schema.js

@@ -34,6 +34,29 @@ export function validateMethodArgs(method, args = {}) {
     case 'getWeights':
       return { ok: true, args }
 
+    case 'queryLogs': {
+      const source = String(args.source || 'anomaly').toLowerCase()
+      if (!['anomaly', 'audit', 'journal'].includes(source)) {
+        return { ok: false, error: 'source must be anomaly|audit|journal' }
+      }
+      const limit = args.limit == null ? 200 : Number(args.limit)
+      if (!Number.isFinite(limit) || limit < 1 || limit > 2000) {
+        return { ok: false, error: 'limit must be 1..2000' }
+      }
+      return {
+        ok: true,
+        args: {
+          ...args,
+          source,
+          limit,
+          q: args.q != null ? String(args.q) : '',
+          priority: args.priority != null ? String(args.priority) : '',
+          unit: args.unit != null ? String(args.unit) : '',
+          cursor: args.cursor != null ? Number(args.cursor) : 0,
+        },
+      }
+    }
+
     case 'setDisplayName': {
       const name = String(args.name ?? '').trim()
       if (!name) return { ok: false, error: 'name is required' }