[Bug]: audit log

[keanhuang]

Summary

aduit config no effect

Affected component

runtime/daemon

Severity

S0 - data loss / security risk

Current behavior

i config audit log，but the logfile not created
[security.audit]
enabled = true
log_path = "audit.log"
max_size_mb = 100
sign_events = false

Expected behavior

nomarl write log

Steps to reproduce

zeroclaw agent

Impact

always

Logs / stack traces

ZeroClaw version

ZeroClaw v0.1.7

Rust version

rust 1.88

Operating system

windows10

Regression?

No, first-time setup

Pre-flight checks

• I reproduced this on the latest main branch or latest release.
• I redacted secrets/tokens from logs.
• I removed personal identifiers and replaced identity-specific data with neutral placeholders.

[github-actions]

Thanks for opening this issue.

Before maintainers triage it, please confirm:

• Repro steps are complete and run on latest main
• Environment details are included (OS, Rust version, ZeroClaw version)
• Sensitive values are redacted

This helps us keep issue throughput high and response latency low.

[theonlyhennygod]

Implemented and opened PR: #2708

Root cause:

• audit.log was only created lazily on first write in AuditLogger::log().
• In sessions with no immediate event emission, users would not see an audit log file and interpreted this as a failure.

What changed:

• AuditLogger::new now initializes/touches the log file when audit logging is enabled.
• Parent directories are created for nested audit log paths.
• log() also ensures file initialization before append for robustness.
• Added regression tests for init-time file creation and nested directories.

Validation:

• cargo fmt --all -- --check
• cargo test -p zeroclaw security::audit::tests:: -- --nocapture

This guarantees visible audit log initialization when enabled and prevents path-related initialization failures.

[theonlyhennygod]

Verified on dev commit 52b9e6a2210df08dbccf08ff81907d6d93cf9254 (March 5, 2026).

This issue is already fixed in current dev:

• AuditLogger::new initializes/touches the log file when audit logging is enabled.
• Parent directory creation for nested audit log paths is handled before file open.
• log() also ensures file initialization before append.
• Historical fix commit is present in dev history: 69c1e02e (fix(audit): initialize log file when audit logging is enabled).

Validation re-run on latest dev:

• cargo test -p zeroclaw security::audit::tests:: -- --nocapture
• Result: pass (10/10 tests in lib target and 10/10 in bin target).

Closing as completed because behavior is fixed on dev.