Compliance: audit log of config reloads, AI calls, and finding emissions

[btwshivam]

Problem

For SOC 2 / ISO 27001 / HIPAA compliance, an observability daemon needs an audit log: every privileged action it took, who triggered it, and when. Kerno today logs operational stuff (load, error, debug) but not auditable events. Compliance reviewers will flag this.

Goal

A separate, append-only audit log stream emitting structured records for every:

1. Config change: file path, fields that changed, before / after values, source (file vs SIGHUP), user (uid)
2. AI call: provider, model, tokens used, prompt size, response size, redaction summary (how many PIDs/IPs/paths were stripped per privacy mode), no actual prompt/response bodies (privacy)
3. Finding emission to a sink: rule, severity, target sink (Slack, PagerDuty), payload hash (for traceability without leaking PII)
4. Authentication: `/metrics` token mismatch (issue Security: authenticate /metrics endpoint (bearer token + optional mTLS) #41), mTLS verification failure
5. Daemon lifecycle: start, stop, restart, panic with stack trace digest

Output formats:

• stderr with `audit` slog group — picked up by journalctl when run via systemd
• file at configurable path (`/var/log/kerno-audit.jsonl`) with rotation handled by the OS or the user's log shipper
• OTLP audit logs (issue OpenTelemetry OTLP export for findings, signals, and metrics #30) for stacks that prefer that

Schema (NDJSON):

```json
{
"ts": "2026-05-10T14:32:01.123Z",
"type": "ai.call",
"actor": "kerno/start",
"details": {
"provider": "anthropic",
"model": "claude-sonnet-4-…",
"tokens": 412,
"redactions": {"pid": 3, "ip": 1, "path": 0},
"duration_ms": 854
}
}
{
"ts": "2026-05-10T14:32:05.000Z",
"type": "config.reload",
"actor": "SIGHUP",
"details": {
"path": "/etc/kerno/config.yaml",
"changed_fields": ["log_level", "doctor.thresholds.fsync_p99_critical_ns"],
"applied": 2,
"restart_required": 0
}
}
```

Files to add

• `internal/audit/audit.go` — `Logger` with `Record(type, details)` API
• `internal/audit/redact.go` — verifiable redaction (already partial in AI privacy modes, formalize and centralize)
• `internal/cli/start.go` — wire audit logger; call `audit.Record(...)` at every event listed above
• `internal/audit/audit_test.go` — tests verifying redaction + schema stability

Acceptance criteria

• Every event listed above produces an audit record (verify by exercising each path in a test)
• No PII leaks in audit records (PIDs/IPs/paths redacted per the configured privacy mode)
• JSON schema is documented in `docs/audit-schema.md` and versioned
• File output rotates cleanly (use `lumberjack` or expect logrotate; document)
• Compliance reviewer can trace a finding from sink emission back to the cycle, the AI call, and the underlying signals

Why this matters

Some buyers will not deploy without this. Adding it now (when the codebase is small) is cheap. Adding it later (when 30 callers need to be retrofitted) is expensive.

Effort

~3 days including the redaction formalization and the doc.

[himanshu2394i]

Hey can you assign this to me I would like to work on it.

[abhinav-1504]

/assign

[github-actions]

Assigned to @abhinav-1504. Thanks for picking this up! 🚀

Heads-up: if there's no activity (comment or PR linked here) within 10 days, the issue will be auto-released so others can pick it up. Comment any time to reset that timer.

Need help getting started? Check CONTRIBUTING.md or ask in the issue thread.

[oksaumya]

Hii @himanshu2394i use /assign to claim the issue.

[btwshivam]

@himanshu2394i @abhinav-1504 Hi welcome! go ahead give a try.. fee freel to ping when stuck.
also make sure to give star the kerno and Optiqor repo

[abhinav-1504]

PR raised: #102

Implements the full audit log as described in the issue — NDJSON schema, PII redaction, lumberjack rotation, and all 8 event types wired. Ready for review.