prep docs and service updates

src/AirGap/StellaOps.AirGap.Time/Controllers/TimeStatusController.cs

@@ -10,11 +10,13 @@ public class TimeStatusController : ControllerBase
 {
     private readonly TimeStatusService _statusService;
     private readonly TimeAnchorLoader _loader;
+    private readonly ILogger<TimeStatusController> _logger;
 
-    public TimeStatusController(TimeStatusService statusService, TimeAnchorLoader loader)
+    public TimeStatusController(TimeStatusService statusService, TimeAnchorLoader loader, ILogger<TimeStatusController> logger)
     {
         _statusService = statusService;
         _loader = loader;
+        _logger = logger;
     }
 
     [HttpGet("status")]
@@ -37,10 +39,17 @@ public class TimeStatusController : ControllerBase
             return ValidationProblem(ModelState);
         }
 
-        var trustRoot = new TimeTrustRoot(
-            request.TrustRootKeyId,
-            Convert.FromBase64String(request.TrustRootPublicKeyBase64),
-            request.TrustRootAlgorithm);
+        byte[] publicKey;
+        try
+        {
+            publicKey = Convert.FromBase64String(request.TrustRootPublicKeyBase64);
+        }
+        catch (FormatException)
+        {
+            return BadRequest("trust-root-public-key-invalid-base64");
+        }
+
+        var trustRoot = new TimeTrustRoot(request.TrustRootKeyId, publicKey, request.TrustRootAlgorithm);
 
         var result = _loader.TryLoadHex(
             request.HexToken,
@@ -50,6 +59,7 @@ public class TimeStatusController : ControllerBase
 
         if (!result.IsValid)
         {
+            _logger.LogWarning("Failed to ingest time anchor for tenant {Tenant}: {Reason}", request.TenantId, result.Reason);
             return BadRequest(result.Reason);
         }
 
@@ -58,6 +68,7 @@ public class TimeStatusController : ControllerBase
             request.BreachSeconds ?? StalenessBudget.Default.BreachSeconds);
 
         await _statusService.SetAnchorAsync(request.TenantId, anchor, budget, HttpContext.RequestAborted);
+        _logger.LogInformation("Time anchor set for tenant {Tenant} format={Format} digest={Digest} warning={Warning}s breach={Breach}s", request.TenantId, anchor.Format, anchor.TokenDigest, budget.WarningSeconds, budget.BreachSeconds);
         var status = await _statusService.GetStatusAsync(request.TenantId, DateTimeOffset.UtcNow, HttpContext.RequestAborted);
         return Ok(TimeStatusDto.FromStatus(status));
     }