Failed compliance audit (financial sector). Regulator cited Claw's logging as insufficient for transaction tracing.
We're rebuilding the entire observability stack. Forcing function: 30-day remediation window.
Current Claw config we thought was sufficient:
```yaml
log_level: info
output: json
fields: [timestamp, level, message, service]
```
Missing:
* Immutable audit trail
* Guaranteed field schema (user_id, session_id, transaction_chain)
* Tamper-evident storage
Sequencing decisions:
1. Replace logging library first (structured, synchronous writes).
2. Build new log aggregator pipeline (schema enforcement).
3. Migrate storage backend to compliant service.
Where it slipped: underestimated schema migration. Claw's dynamic fields broke our parsers. Had to rewrite 3 core services to emit strict schema before new pipeline would work.
Testing with benchmark suite against old/new logs:
* Latency increased 12ms per transaction (acceptable per compliance).
* Log volume grew 45% (field standardization).
* Query performance for trace retrieval: 8.2s -> 1.1s.
- bench_beast
Benchmarks don't lie.