Document audit log search and export

[yummybomb]

Summary

• add a task-oriented audit log guide for CLI, SDK, and HTTP search and export workflows
• add a complete kernel audit-logs CLI command reference and navigation entry
• document search pagination, export cursors, time-window semantics, filters, chunk limits, checksums, retries, and partial-file behavior
• correct SDK exclude_method examples and replace the fabricated page token with an opaque response token

Rollout

Keep this PR in draft until:

• a published CLI release contains kernel audit-logs download
• kernel/kernel#2821 publishes the generated export API reference

Testing

• mint broken-links
• rendered /info/audit-logs and /reference/cli/audit-logs with the local Mintlify preview
• go test ./cmd -run AuditLogs in the CLI repository
• compiled the Go SDK examples against the current generated SDK

[cursor]

Risk assessment: Very Low.

Evidence from the diff: this PR adds info/audit-logs.mdx and a single docs.json navigation entry. It doesn’t modify runtime code, prompts/model instructions, auth or permissions logic, infrastructure, schemas, or shared production systems. The change is documentation-only with limited blast radius.

I also found no CODEOWNERS file in the repo snapshot and the PR metadata showed no existing approvals, so approval is allowed under the risk policy.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Kernel	🟢 Ready	View Preview	Jun 23, 2026, 3:04 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cursor]

Risk assessment: Very Low.

Evidence from the diff: the PR adds info/audit-logs.mdx and a single docs.json navigation entry. It doesn’t modify runtime code, prompt/model instruction files, auth or permissions logic, infrastructure, schemas, or shared production systems. The blast radius is limited to documentation rendering/navigation.

I found no CODEOWNERS file in the repo snapshot. The PR is already approved according to GitHub review state, so I’m not adding a duplicate approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low.

Evidence from the current diff: this PR adds info/audit-logs.mdx and one docs.json navigation entry. The latest update only adds/clarifies audit log documentation text, including the 30-day range note, filter wording, and curl --include examples. It doesn’t modify runtime code, prompt/model instruction files, auth or permissions logic, infrastructure, schemas, or shared production systems.

I found no CODEOWNERS file in the repo snapshot. The PR is already approved according to GitHub review state, so I’m not adding a duplicate approval. The post-approval update doesn’t increase risk, so no approval dismissal is needed.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low.

Evidence from the current diff: this PR changes four documentation-site files only. It adds audit-log search/export guides and CLI reference content, plus two navigation/card entries in docs.json and reference/cli.mdx. It doesn't modify runtime code, model instruction files, authentication or permissions enforcement, infrastructure, schemas, or production services. The blast radius is limited to rendered documentation and navigation.

The latest post-approval update expands the documentation and examples but doesn't increase operational or security risk. No CODEOWNERS file is present in the repository, and GitHub already reports the PR as approved, so I haven't added a duplicate approval or dismissed the existing approval.

  

_{Sent by Cursor Automation: Assign PR reviewers}