feat(audit): add correlation ids to command and network events

[Frankie-Xu]

Linked Issue

Closes #1693

Summary

Adds optional correlation IDs so audit consumers can group related lifecycle events without relying on timestamps, PIDs, hashes, or targets:

• CommandPolicyAuditEvent.invocation_id — UUID v7 minted once per tool-sandbox shim request; shared across admission/completion (and deny) events for that invocation
• NetworkAuditEvent.interaction_id — UUID v7 minted once per proxy network interaction; threaded through CONNECT / endpoint-policy / auth / response events via EventContext
• NetworkAuditEvent.invocation_id — reserved for parent command linkage; left None when attribution is not reliable (no PID/process-tree guessing)

All fields are additive (Option, serde default + skip_serializing_if). Merkle hash algorithms, domain separators, chain construction, and attestation predicates are unchanged. New fields participate in leaf hashes only when present; historical records without them still verify.

Agent Disclosure

This PR was generated by an AI agent (Cursor) on behalf of Frankie-Xu.

Consulted:

• AGENTS.md, CLAUDE.md, GOVERNANCE.md (audit log requires maintainer agreement)
• CONTRIBUTING.md, .github/pull_request_template.md
• Issue Add correlation IDs to command and network audit event #1693 disclosure comment
• Related audit work: PR fix(proxy): skip network audit buffer when --no-audit is set #1682 (same crate / network audit path; baseline is current origin/main)
• crates/nono/src/{audit.rs,undo/types.rs}, crates/nono-proxy/src/audit.rs + request handlers, crates/nono-cli tool-sandbox linux/macos audit emitters

Compliance: no unwrap/expect in production paths; no Merkle algorithm changes; additive-only schema; network→command invocation_id never guessed.

Test Plan

• Unit: old JSON without correlation fields deserializes; round-trip with IDs; shared interaction_id across multiple proxy log calls; verify_audit_log accepts mixed with/without IDs
• cargo test -p nono --lib
• cargo test -p nono-proxy --lib
• cargo check -p nono-cli --tests
• make ci (clippy, fmt, tests, audit, lint-aliases, lint-docs)

Checklist

• An issue exists and is linked above
• All commits are signed-off, using DCO
• All new code follows the project's coding standards (CLAUDE.md) and is covered by tests
• Public-facing changes are paired with documentation updates (N/A — additive optional audit fields; consumers remain compatible without docs change)

Agent Compliance Check (Required for AI/Automated PRs)

• I am not prohibited from contributing under this policy
• An issue already exists
• I disclosed that I am an agent in the issue discussion
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code (no reused/adapted third-party code)
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required (not applicable; no new CLI error surface)
• I validated and canonicalized all relevant paths (not applicable; no new path I/O)
• This PR matches the approved or disclosed issue scope

Made with Cursor

[Frankie-Xu]

Hi maintainers 👋

This PR is from a fork, so the full CI workflows (CI, Release PR Checks, SPIRE) are waiting for manual approval (action_required). The lightweight checks (title lint, auto-label, review summary) and nogent review may already be running.

Could someone please approve the workflow run when convenient? Local make ci passed on macOS before opening the PR.

Thanks!

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+451
Lines removed	-82
Total changed	533
Classification	Large (> 300 lines)

Affected crates

• crates/nono (core library) — careful review required. This is the security-critical sandbox primitive. A bug here bypasses OS-level isolation for every downstream user.
• crates/nono-proxy — downstream consumers depend on this crate. API or behaviour changes will affect external callers; treat any breaking change with extra scrutiny.
• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

No blocking issues; 0 suggestions.

Findings: none flagged in scope.

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}

[Frankie-Xu]

Putting this in draft to honor the 1–2 open PR limit. I'll bring it back only after earlier PRs land. No action needed from reviewers now.