## Summary Add an optional setting to the **Restrict to Topic** guardrail (`RestrictToTopic`) that logs to the standard Drupal log whenever the guardrail flags a topic. The setting is a checkbox, **disabled by default**, so existing behaviour is unchanged unless a site builder opts in. ## Problem The `RestrictToTopic` guardrail (`web/modules/custom/ai/src/Plugin/AiGuardrail/RestrictToTopic.php`) currently stops a request when invalid topics are present or no valid topics are found, but it does not record *that* it restricted the request anywhere observable. There is no way to see in the logs which guardrail flagged a request or which topics triggered it. This makes it hard for site builders and support staff to: - Confirm the guardrail is actually firing in production. - Understand *why* a given request was blocked. - Tune their valid/invalid topic lists based on real traffic. ## Proposed solution 1. Add a checkbox to the guardrail configuration form, e.g. **"Log when topics are flagged"**, defaulting to `FALSE` (disabled). 2. When the setting is enabled **and** one or more topics are found, write an entry to the normal Drupal log (the `ai` logger channel). The entry should identify the guardrail and list the topic(s) that were flagged. 3. Logging should cover the cases where the guardrail acts on topics — invalid topics found, and valid topics required but missing. 4. When the setting is disabled (the default), no log entries are written and behaviour is identical to today. ## Tasks * [ ] Add a `log_flagged_topics` (or similar) checkbox to `buildConfigurationForm()`, default `FALSE`, with a clear description. * [ ] Persist the new value via `submitConfigurationForm()` / `setConfiguration()` and add it to the config schema. * [ ] In `processInput()`, when the setting is enabled and topics are found, log the flagged topic(s) and the guardrail to the `ai` logger channel. * [ ] Add an update hook to backfill the new setting (`FALSE`) into existing guardrail configuration entities so they validate against the updated schema. The update hook must be numbered **`13xxx` on the 1.3 branch** and **`14xxx` on the 1.4 branch**. * [ ] Add/extend test coverage for both the enabled and disabled paths. ## Acceptance criteria * A site builder can enable logging for the Restrict to Topic guardrail via a checkbox in the UI; it is off by default. * When enabled and one or more topics are flagged, a log entry appears in the standard Drupal log naming the guardrail and the flagged topic(s). * When disabled (default), no new log entries are written and existing behaviour is unchanged. * Existing guardrail configuration entities continue to validate after update, via update hook `13xxx` (1.3) / `14xxx` (1.4). ## Affected modules / components * AI Core — `RestrictToTopic` guardrail plugin and `ai.install`.