feat(config): enable audit logging by default

[SantiagoDePolonia]

Summary

Makes audit logging the out-of-the-box behavior ("Use Good Defaults" - the demo experience should not require configuration):

Setting	Before	After
LOGGING_ENABLED	false	true
LOGGING_LOG_BODIES	already true in code (gated by enabled; docs wrongly said false)	unchanged, now effective
LOGGING_LOG_HEADERS	already true in code (gated by enabled; docs wrongly said false)	unchanged, now effective

A fresh gomodel or docker run enterpilot/gomodel now shows populated request logs / Interactions in the dashboard with zero -e flags.

LOG_FORMAT is left exactly as it was (auto-detect: text on TTY, JSON otherwise) - an earlier commit on this branch changed it and was reverted; a format-selection unit test asserting the auto-detect behavior remains.

Behavior change to be aware of

Audit entries (with bodies and headers) are now written by default to the configured storage (30-day retention default; sensitive headers auto-redacted). Operators who do not want body capture set LOGGING_ENABLED=false or LOGGING_LOG_BODIES=false. Explicit env/YAML values override defaults in both directions, including explicit false.

Changes

• config: Logging.Enabled default true (+ test).
• Docs aligned with reality: .env.template, config.example.yaml, configuration.mdx, CLAUDE.md (bodies/headers were documented as default-false while the code said true).
• run: new table-driven format-selection test (no behavior change).

Testing

Pre-commit suite (race tests, lint) green; smoke-run verified audit logging enabled log_bodies=true log_headers=true with no env set.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Audit logging is now enabled by default.
  • Request and response bodies and headers are logged by default.
  • Added configurable log output formatting, including JSON support and automatic format detection.

• Documentation

  • Updated configuration references and examples to reflect the new logging defaults and available format setting.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
gomodel	🟢 Ready	View Preview	Jul 19, 2026, 4:24 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[coderabbitai]

📝 Walkthrough

Walkthrough

Logging is now enabled by default in configuration and documentation. The environment template adds LOG_FORMAT, and logging tests cover JSON versus text handler selection across TTY and format inputs.

Changes

Logging defaults and format selection

Layer / File(s)	Summary
Enable logging by default config/config.go, config/config.example.yaml, config/config_test.go, .env.template, CLAUDE.md, docs/advanced/configuration.mdx	Default logging and request/response logging settings are documented or configured as enabled, with the default configuration test updated accordingly.
Document and test log format selection .env.template, run/logging_test.go	The environment template documents LOG_FORMAT with text as the default, and tests cover JSON and text handler selection for TTY and format combinations.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ENTERPILOT/GoModel#216: Both changes cover newLogHandler behavior and LOG_FORMAT handling across JSON and text output.

Poem

A bunny found the logs switched on,
With JSON hops and text at dawn.
Headers, bodies, trails all bright,
Tests guard each format right.
Hop, hop—logging takes flight!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling audit logging by default in config.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/observability-defaults

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Confidence Score: 5/5

Safe to merge with minimal risk.

The runtime behavior change is intentional, covered by focused tests, and documented in the changed configuration references.

No files require special attention.

T-Rex Logs

What T-Rex did

• Built the no-env-logging component and confirmed the build exited with code 0.
• Ran the runtime smoke test for no-env-logging and observed startup output indicating the service started and audit logging was enabled.
• Verified the runtime with a grep-based check and confirmed EXIT Code 0, and noted the process terminated with timeout code 124 after startup completed.
• Uploaded and organized artifacts for review, including the build log, smoke log, verify log, and the runtime script.

_{Ran code and verified through T-Rex}

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Env as Environment
participant Config as config.Load/buildDefaultConfig
participant Runtime as run.configureLogging
participant Logs as slog handler
participant Audit as Audit logging config

Config->>Config: build defaults
Config->>Audit: "Logging.Enabled=true<br/>LogBodies=true<br/>LogHeaders=true"
Env->>Config: "LOGGING_* overrides, if set"
Runtime->>Env: read LOG_FORMAT
alt "LOG_FORMAT=json"
    Runtime->>Logs: create JSON handler
else unset or any non-json value
    Runtime->>Logs: "create text handler<br/>color only when TTY"
end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Env as Environment
participant Config as config.Load/buildDefaultConfig
participant Runtime as run.configureLogging
participant Logs as slog handler
participant Audit as Audit logging config

Config->>Config: build defaults
Config->>Audit: "Logging.Enabled=true<br/>LogBodies=true<br/>LogHeaders=true"
Env->>Config: "LOGGING_* overrides, if set"
Runtime->>Env: read LOG_FORMAT
alt "LOG_FORMAT=json"
    Runtime->>Logs: create JSON handler
else unset or any non-json value
    Runtime->>Logs: "create text handler<br/>color only when TTY"
end

Loading

_{Reviews (1): Last reviewed commit: "revert: keep LOG_FORMAT auto-detection" | Re-trigger Greptile}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.env.template (1)

278-280: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Make full body capture an explicit opt-in.

LOGGING_LOG_BODIES=true persists prompts and responses that may contain PII, credentials, or customer data for the default 30-day retention period. The warning is informative but does not prevent collection; keep body logging disabled by default or require an explicit privacy/compliance opt-in.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.env.template around lines 278 - 280, Update the LOGGING_LOG_BODIES setting
in the environment template so full request/response body capture remains
disabled by default and requires explicit opt-in. Preserve the existing warning
and configuration key, but ensure the documented default does not enable
sensitive-body logging.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.env.template:
- Around line 278-280: Update the LOGGING_LOG_BODIES setting in the environment
template so full request/response body capture remains disabled by default and
requires explicit opt-in. Preserve the existing warning and configuration key,
but ensure the documented default does not enable sensitive-body logging.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e771a561-efc9-47fa-8f51-ccc7d15e2ed3

📥 Commits

Reviewing files that changed from the base of the PR and between d4ff71b and c7596f1.

📒 Files selected for processing (3)

• .env.template
• docs/advanced/configuration.mdx
• run/logging_test.go