From 455f6400f81e14c667dff9868e79bc4e6ae1218f Mon Sep 17 00:00:00 2001
From: Vishnuvardhan Reddy <vvr3ddy@proton.me>
Date: Sun, 1 Mar 2026 15:18:51 +0000
Subject: [PATCH] feat(audit): Phase 1 - Add audit configuration schema

Add AuditConfig, RotationConfig, and AuditEvents structs to config.
Includes sensible defaults:
- Disabled by default
- Logs to workspace/logs
- 100MB max size, 30-day retention
- JSON format for structured logging
- Tool calls, messages, and errors enabled
---
 pkg/config/config.go   | 28 ++++++++++++++++++++++++++++
 pkg/config/defaults.go | 17 +++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/pkg/config/config.go b/pkg/config/config.go
index d84772d2b..0fe9520bc 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -58,6 +58,7 @@ type Config struct {
 	Tools     ToolsConfig     `json:"tools"`
 	Heartbeat HeartbeatConfig `json:"heartbeat"`
 	Devices   DevicesConfig   `json:"devices"`
+	Audit     AuditConfig     `json:"audit,omitempty"`
 }
 
 // MarshalJSON implements custom JSON marshaling for Config
@@ -382,6 +383,33 @@ type DevicesConfig struct {
 	MonitorUSB bool `json:"monitor_usb" env:"PICOCLAW_DEVICES_MONITOR_USB"`
 }
 
+// AuditConfig controls audit logging for tool calls, messages, and system events.
+// Audit logs provide a complete trail of bot activity for debugging, compliance,
+// and security analysis.
+type AuditConfig struct {
+	Enabled  bool        `json:"enabled"  env:"PICOCLAW_AUDIT_ENABLED"`
+	Location string      `json:"location" env:"PICOCLAW_AUDIT_LOCATION"`
+	Rotation RotationConfig `json:"rotation"`
+	Events   AuditEvents `json:"events"`
+	Format   string      `json:"format"   env:"PICOCLAW_AUDIT_FORMAT"` // "json" or "text"
+}
+
+// RotationConfig controls log file rotation to prevent disk space exhaustion.
+type RotationConfig struct {
+	MaxSizeMB  int  `json:"max_size_mb"  env:"PICOCLAW_AUDIT_ROTATION_MAX_SIZE_MB"`
+	MaxAgeDays int  `json:"max_age_days" env:"PICOCLAW_AUDIT_ROTATION_MAX_AGE_DAYS"`
+	MaxBackups int  `json:"max_backups"  env:"PICOCLAW_AUDIT_ROTATION_MAX_BACKUPS"`
+	Compress   bool `json:"compress"     env:"PICOCLAW_AUDIT_ROTATION_COMPRESS"`
+}
+
+// AuditEvents controls which event types are logged.
+type AuditEvents struct {
+	ToolCalls bool `json:"tool_calls" env:"PICOCLAW_AUDIT_EVENTS_TOOL_CALLS"`
+	Messages  bool `json:"messages"   env:"PICOCLAW_AUDIT_EVENTS_MESSAGES"`
+	Errors    bool `json:"errors"     env:"PICOCLAW_AUDIT_EVENTS_ERRORS"`
+	System    bool `json:"system"     env:"PICOCLAW_AUDIT_EVENTS_SYSTEM"`
+}
+
 type ProvidersConfig struct {
 	Anthropic     ProviderConfig       `json:"anthropic"`
 	OpenAI        OpenAIProviderConfig `json:"openai"`
diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go
index ebb924859..aaafe8a89 100644
--- a/pkg/config/defaults.go
+++ b/pkg/config/defaults.go
@@ -343,5 +343,22 @@ func DefaultConfig() *Config {
 			Enabled:    false,
 			MonitorUSB: true,
 		},
+		Audit: AuditConfig{
+			Enabled:  false,
+			Location: "workspace/logs",
+			Rotation: RotationConfig{
+				MaxSizeMB:  100,
+				MaxAgeDays: 30,
+				MaxBackups: 10,
+				Compress:   true,
+			},
+			Events: AuditEvents{
+				ToolCalls: true,
+				Messages:  true,
+				Errors:    true,
+				System:    false,
+			},
+			Format: "json",
+		},
 	}
 }