docs: document audit sink configuration

[cursor]

Description

Updates the README audit documentation so operator-facing guidance matches the current registry audit implementation.

• Adds audit sink environment variables to the configuration table
• Replaces the stale write-only stderr audit blurb with current registry-mediated audit coverage
• Documents stderr, JSONL file, webhook, and OpenTelemetry sink behavior and best-effort delivery constraints

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other

Checklist

• Tests pass
• Typecheck passes

Verification note: attempted pnpm docs:check, but the automation image has neither pnpm nor node on PATH. Verified source-backed docs claims with targeted rg checks against src/config.ts, src/audit/*, and src/registry/index.ts, and verified the committed change set is docs-only with git show --stat --oneline HEAD.

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Findings:

1. README.md now promises an "always enabled" stderr audit trail, but the implementation routes that sink through createLogger(), so it inherits LOG_LEVEL filtering. With LOG_LEVEL=warn, success audit events disappear; with LOG_LEVEL=error, even failed audit events disappear. That is a docs/runtime contract mismatch on a compliance-sensitive path.
2. The branch is currently failing build-and-test because pnpm docs:check reports README.md is stale. Run \pnpm docs:generate` to refresh.On this repo,README.md` is a generated/validated surface, so the hand-edited doc change needs the generated refresh before it meets the documentation contract.

Open questions / assumptions:

• I’m assuming Sunil’s architecture standards here mean keeping operator-facing docs aligned with the implemented contract and respecting repo-managed generated surfaces. I didn’t find other architecture-standard issues in this small diff.

Change summary:

• The PR adds audit sink env-var docs and expands the audit logging section in README.md, plus records the docs-only automation run in tasks/todo.md.

  

_{Sent by Cursor Automation: Sunil On Demand Architecture Review}

[cursor]

This repo treats README.md as a generated/validated artifact via scripts/generate-docs.js, and CI is already failing pnpm docs:check on this branch with README.md is stale. Run pnpm docs:generate to refresh. Please regenerate the README before merge; otherwise the docs change doesn’t satisfy the repo’s source-of-truth workflow.

[cursor]

StderrSink is registered unconditionally, but it writes through createLogger("audit"), so it is still gated by the global LOG_LEVEL. That means this "Always enabled" row overstates the current behavior: at LOG_LEVEL=warn successful audit events are suppressed, and at LOG_LEVEL=error even failed audit events are suppressed. The docs should mention the log-level dependency, or the sink should bypass normal logger filtering if an always-on audit trail is the intended standard.