feat: identify the device with an origin SD-ELEMENT

[DavidCozens]

Pull request

What this stage adds

SolidSyslogOriginSd (RFC 5424 section 7.2) carrying software, swVersion and
enterpriseId. The ip PARAM is left out: the address the collector sees is the one
that reached it.

Flash +11,972 B (+396 on the previous stage)
RAM +7,136 B (+44)
Log stack +448 B (unchanged)
Service +736 B (unchanged)

It lands after the store rather than before it. While a record went straight out,
"who sent this" was implied by the connection it arrived on; once records can
replay hours later that stops being true, and the record has to say so itself.

enterpriseId 32473 is the number reserved for documentation by RFC 5612. A device
shipping for real registers its own with IANA. It is defined in
app/syslog/SyslogEnterprise.h rather than beside the element that carries it,
because the number identifies the vendor and not the logger — anything else this
product puts its own name on wants the same one, and one definition cannot drift
from itself.

The record is now 245 bytes, against the 256-byte cap this device set when its
records were shorter.

Files

 README.md                     | 13 +++++++------
 app/syslog/Syslog.c           | 16 +++++++++++++++-
 app/syslog/SyslogEnterprise.h | 12 ++++++++++++
 measurements/origin.csv       | 13 +++++++++++++
 measurements/stages.tsv       |  1 +
 run-report.md                 | 34 +++++++++++++++++-----------------
 6 files changed, 65 insertions(+), 24 deletions(-)

Checklist

• The diff is application-only — no change to board bring-up, config headers, or build infra.
• measurements/origin.csv committed.
• Row added to measurements/stages.tsv.
• README regenerated: python3 scripts/gen-cost-table.py.
• ./run.sh green (build + QEMU + baseline self-check) — run-report.md committed.

---

Context for review: 12 of 21 sequential single-commit PRs replaying the integration on top of the Baseline root. Each lands green and reviewed before the next is built on it, because a change to an early commit would force every commit above it to be re-run and re-measured.

Summary by CodeRabbit

• New Features

  • Syslog records now include origin metadata identifying the sending software, version, and vendor.
  • Origin information is recorded directly in each event, rather than inferred from the source address.

• Documentation

  • Updated stage descriptions and resource estimates to document the Origin stage.
  • Refreshed device reports, memory metrics, and validation output to reflect the new configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

The syslog startup path now registers an Origin structured-data block containing software, version, and enterprise information. README cost documentation and run-report measurements are updated to describe the Origin stage instead of the File store stage.

Changes

Origin metadata

Layer / File(s)	Summary
Register origin structured data app/syslog/SyslogEnterprise.h, app/syslog/Syslog.c	Adds the enterprise identifier and initializes a third structured-data block with software, version, and enterprise metadata.
Document and report origin stage README.md, run-report.md	Replaces File store references with Origin descriptions and updates associated cost, memory, ELF, and self-check values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• cososo-ltd/solid-syslog-example#18: Directly overlaps the Origin structured-data integration and related documentation.
• cososo-ltd/solid-syslog-example#19: Modifies construction of the same SolidSyslogOriginSdConfig origin block.
• cososo-ltd/solid-syslog-example#23: Shares the enterprise header and structured-data registration mechanism.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: adding an origin SD-ELEMENT to identify the device.
Description check	✅ Passed	The description matches the template and includes the stage summary plus the required checklist items.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch stage/origin

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app/syslog/SyslogEnterprise.h`:
- Around line 1-10: Update the comments in app/syslog/SyslogEnterprise.h lines
1-10 to identify 32473 as a documentation-reserved example enterprise ID, not
the product/vendor’s production PEN, and state that production builds must
replace it with a registered PEN. Update README.md lines 15-18 with the same
deployment guidance; retain the example value and macro unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 550fd61d-e381-40c9-860b-60856b707f7b

📥 Commits

Reviewing files that changed from the base of the PR and between 8931a1e and b01a778.

⛔ Files ignored due to path filters (2)

• measurements/origin.csv is excluded by !**/*.csv
• measurements/stages.tsv is excluded by !**/*.tsv

📒 Files selected for processing (4)

• README.md
• app/syslog/Syslog.c
• app/syslog/SyslogEnterprise.h
• run-report.md