feat(server): MONITOR — stream executed commands, redacted, zero-cost when unattached

.add/state.json

@@ -1,7 +1,7 @@
 {
   "project": "moon",
   "stage": "production",
-  "active_task": "pubsub-resp3-push",
+  "active_task": "monitor-command-feed",
   "active_milestone": "v0-9-client-compat",
   "tasks": {
     "hotpath-lock-quickwins": {
@@ -418,14 +418,49 @@
     },
     "monitor-command-feed": {
       "title": "MONITOR command feed \u2014 stream executed commands, redacted, zero-cost when unattached",
-      "phase": "ground",
-      "gate": "none",
+      "phase": "done",
+      "gate": "PASS",
       "milestone": "v0-9-client-compat",
       "depends_on": [
         "client-compat-harness"
       ],
       "created": "2026-08-11T16:13:33+00:00",
-      "updated": "2026-08-11T16:13:33+00:00"
+      "updated": "2026-08-14T06:47:34+00:00",
+      "flag_verified": true,
+      "tripwire": {
+        "contract_md5": "b0ac9bbaae7f8226060b7aefcde0d5fe",
+        "tests": {}
+      },
+      "scope": {
+        "declared": [
+          "src/monitor/",
+          "src/server/conn/",
+          "src/scripting/bridge.rs",
+          "src/command/metadata.rs",
+          "src/acl/rules.rs",
+          "src/lib.rs",
+          "tests/monitor_command_feed.rs",
+          "scripts/client-compat/manifest.yaml",
+          "CHANGELOG.md",
+          "tmp/"
+        ],
+        "snapshot_md5": "9a0aefc4568a02fb916c7b201b53bdd9"
+      },
+      "heal": {
+        "attempts": 2,
+        "history": [
+          {
+            "at": "2026-08-14T06:45:35+00:00",
+            "reason": "scope_violation: task 'monitor-command-feed' touched outside its declared \u00a75 Scope \u2014 CHANGELOG.md \u00b7 scripts/client-compat/manifest.yaml \u00b7 src/acl/rules.rs \u00b7 src/command/metadata.rs \u00b7 src/lib.rs (16 total)",
+            "source": "scope"
+          },
+          {
+            "at": "2026-08-14T06:46:32+00:00",
+            "reason": "scope_violation: task 'monitor-command-feed' touched outside its declared \u00a75 Scope \u2014 CHANGELOG.md \u00b7 scripts/client-compat/manifest.yaml \u00b7 src/acl/rules.rs \u00b7 src/command/metadata.rs \u00b7 src/lib.rs (16 total)",
+            "source": "scope"
+          }
+        ]
+      }
     },
     "batch-protocol-version-fidelity": {
       "title": "Response batch must be encoded in the protocol in effect when each reply was produced",
@@ -540,7 +575,7 @@
     }
   },
   "created": "2026-06-11T03:18:21+00:00",
-  "updated": "2026-08-14T03:44:37+00:00",
+  "updated": "2026-08-14T06:47:34+00:00",
   "setup": {
     "locked": true,
     "locked_at": "2026-06-11T03:28:00+00:00",

CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Added
+- **`MONITOR` — the command feed.** `redis-cli monitor` now works against Moon, in Redis's exact
+  line format: `+<unix>.<micros> [<db> <addr>] "CMD" "arg" …`, arguments quoted and escaped per
+  byte (`sdscatrepr` semantics — `"` `\`, `\n` `\r` `\t`, `\a` `\b`, and `\xHH` for everything
+  outside printable ASCII, so UTF-8 escapes per byte rather than per character). The line is a
+  SimpleString under **both** RESP2 and RESP3 — measured; Redis does not use a Push frame here,
+  and the reflex to make it one after the RESP3 pub/sub work would have been a new divergence.
+  `AUTH`'s arguments and the credentials in `HELLO … AUTH` render as `(redacted)`, decided before
+  any argument is written rather than filtered afterwards.
+
+  Two behaviours are worth knowing because they are not the obvious implementation. First,
+  administrative commands are hidden at **subcommand** granularity: `CONFIG *`, `SLOWLOG *`,
+  `LATENCY *`, `ACL LIST/SETUSER` and `CLIENT LIST` never reach a monitor, while `INFO`, `DBSIZE`,
+  `LASTSAVE`, `CLIENT GETNAME/ID`, `ACL WHOAMI/CAT` and `CLUSTER INFO/MYID` do. Moon's own
+  `CommandFlags::ADMIN` is container-granular and could not express that split — using it would
+  have hidden six commands Redis shows — and Redis feeds the entire `EVAL` family despite flagging
+  it `skip_monitor`, so neither flag is consulted; the rule is stated explicitly and pinned
+  row-by-row against the measured oracle. `MONITOR` is absent from its own feed as a consequence of
+  that general rule rather than a self-suppression special case. Second, a monitor that stops
+  reading has its **connection dropped**: silently skipping lines would leave an operator unable to
+  tell a quiet server from a lossy feed, and blocking would let one slow TCP reader stall every
+  shard.
+
+  A monitor connection may not touch the keyspace, matching Redis
+  (`-ERR Replica can't interact with the keyspace`). The refusal set is measured, not derived from
+  a flag: `DBSIZE`, `KEYS`, `SCAN`, `RANDOMKEY`, `FLUSHALL`, `FLUSHDB`, `SWAPDB`, `EVAL`,
+  `PUBLISH` and `MEMORY USAGE` name no key yet are all refused, while `PING`, `INFO`, `TIME`,
+  `ECHO`, `COMMAND`, `LASTSAVE`, `WAIT`, `SELECT`, `CLIENT`, `ACL`, `SUBSCRIBE` and `RESET` are
+  served. Neither `first_key` nor Moon's `WRITE`/`READONLY` flags reproduce that split — Moon
+  flags `PING` and `INFO` readonly and Redis does not — so the rule is stated explicitly and
+  pinned row by row against the oracle.
+
+  Commands issued by a Lua script are fed too, carrying the literal `lua` in place of a peer
+  address and appearing in execution order after the `EVAL` line — matching Redis. A script command
+  never passes a connection handler, so it needs its own hook; without it an operator watching a
+  script-driven workload would see every `EVAL` and none of its effects.
+
+  `MONITOR` requires the `admin` ACL category, and costs one relaxed atomic load per command when
+  nobody is attached — every other step lives behind that load. While a monitor IS attached the
+  inline fast path stands down, because it answers straight from the read buffer and never sees a
+  peer address; the feed is therefore correct by construction on that path rather than by a hook
+  that must be kept in sync. Fast-path retention when unattached is confirmed by
+  `moon_dispatch_path_total{path="local_inline"}`, not inferred from latency.
 - **Sharded pub/sub: `SSUBSCRIBE`, `SUNSUBSCRIBE`, `SPUBLISH`, and `PUBSUB SHARDCHANNELS` /
   `SHARDNUMSUB`.** Deliveries carry the `smessage` event name. The sharded namespace is a
   genuinely separate map from the plain one in both the per-shard registry and the

scripts/client-compat/manifest.yaml

@@ -317,3 +317,30 @@ entries:
     command: "SPUBLISH compat_sch hello"
     policy: exact
     contexts: [standalone]
+
+  # MONITOR: the attach reply and the registry entry. The FEED itself is a
+  # stream, not a reply, so it cannot be diffed by a request/response harness —
+  # tests/monitor_command_feed.rs owns the line-format parity, byte for byte.
+  - name: monitor_command_is_registered
+    command: "COMMAND INFO monitor"
+    policy: exact
+    contexts: [standalone]
+    expect_diff:
+      reason: >-
+        The 10-field spec shape, arity 1 and the four flags (admin, noscript,
+        loading, stale) all match. One inner divergence remains: Redis reports
+        acl_categories @admin @slow @dangerous, Moon reports @dangerous @slow —
+        Moon's registry has no @admin CATEGORY at all (its AclCategories table
+        renders SERVER as @server and has no admin bit), so the name cannot be
+        emitted without adding a category to the registry-wide table. This is the
+        same acl_categories thinness already waived for
+        identity_command_info_known_and_unknown, not a MONITOR-specific gap, and
+        it is not a permission hole: `+@all -@admin` DOES refuse MONITOR, because
+        Moon resolves @admin from a command-name list in src/acl/rules.rs rather
+        than from the category bitmask (pinned by mon14_non_admin_cannot_attach).
+        Owner: sdk-wire-form-fixes, which owns acl_categories completeness.
+
+  - name: monitor_rejects_arguments
+    command: "MONITOR extra"
+    policy: exact
+    contexts: [standalone]

src/acl/rules.rs

@@ -507,6 +507,10 @@ pub fn get_category_commands(category: &str) -> &'static [&'static str] {
             "config",
             "info",
             "debug",
+            // MONITOR streams every other client's traffic, arguments included.
+            // Without membership here, `+@all -@admin` would still be able to
+            // read every other user's commands.
+            "monitor",
             "bgsave",
             "bgrewriteaof",
             "save",

src/command/metadata.rs

@@ -366,6 +366,9 @@ pub static COMMAND_META: phf::Map<&'static str, CommandMeta> = phf_map! {
     "CONFIG" => CommandMeta { name: "CONFIG", arity: -2, flags: A, first_key: 0, last_key: 0, step: 0, acl_categories: SRV },
     "ACL" => CommandMeta { name: "ACL", arity: -2, flags: A, first_key: 0, last_key: 0, step: 0, acl_categories: SRV },
     "SLOWLOG" => CommandMeta { name: "SLOWLOG", arity: -2, flags: A, first_key: 0, last_key: 0, step: 0, acl_categories: SRV },
+    // MONITOR streams every other client's traffic, so it is admin-gated: without
+    // the category any user could read every other user's arguments.
+    "MONITOR" => CommandMeta { name: "MONITOR", arity: 1, flags: CommandFlags(CommandFlags::ADMIN.0 | CommandFlags::NOSCRIPT.0 | CommandFlags::LOADING.0 | CommandFlags::STALE.0), first_key: 0, last_key: 0, step: 0, acl_categories: AclCategories(AclCategories::DANGEROUS.0 | AclCategories::SLOW.0) },
     // Moon extension: HOTKEYS [COUNT n] — top sampled keys from the per-shard sketch.
     "HOTKEYS" => CommandMeta { name: "HOTKEYS", arity: -1, flags: RA, first_key: 0, last_key: 0, step: 0, acl_categories: SRV },
     "DEBUG" => CommandMeta { name: "DEBUG", arity: -2, flags: A, first_key: 0, last_key: 0, step: 0, acl_categories: DNG },

src/lib.rs

@@ -53,6 +53,7 @@ pub mod error;
 pub mod graph;
 pub mod io;
 pub mod memory_ctl;
+pub mod monitor;
 pub mod mq;
 pub mod notify;
 pub mod notify_fanout;