docs: correct the default tool set, audit flag, and audit-log claims

[SHSharkar]

Summary

Fixes four factual inaccuracies in the docs merged last, all found by a full re-audit against
the real source rather than a re-read of the same files.

Motivation

The previous documentation pass created README, CHANGELOG, SECURITY, AGENTS.md, and CLAUDE.md,
but a follow-up audit dispatched fresh agents to check every claim against the actual code
again, and four of them didn't hold up: a wrong default tool count, a missing strict-role
condition, a flag that doesn't exist, and an audit-log claim that left out a real detail.

Changes

• CHANGELOG.md: the default tool set is object, read, and health, three groups, not two.
  Added rds_superuser to the strict-role check, matching
  crates/ownpg-core/src/connect/role.rs. Replaced the nonexistent --audit flag with the
  real one, --no-audit.
• SECURITY.md: disclosed that a short statement, 200 characters or fewer once normalized, is
  kept in the clear alongside its hash, not only hashed. Repointed the audit-log-path reference
  from README.md, which never states it, to ownpg man, which does.
• AGENTS.md and CLAUDE.md: dropped "New" from one sentence, a word this project's own
  blueprint bans outside a changelog. Both files stay byte-identical.

Type of Change

• New feature (feat)
• Bug fix (fix)
• Refactoring (refactor)
• Documentation (docs)
• Performance (perf)
• Tests (test)
• Build/CI (build/ci)
• Chore (chore)
• Breaking change (append ! to type)

Testing

Test type:

• Manual testing performed

Steps to verify:

1. Every claim above checked directly against crates/ownpg-core/src/connect/role.rs,
   crates/ownpg/src/cli.rs, crates/ownpg-core/src/tools/read.rs, and
   crates/ownpg-core/src/audit.rs.
2. diff AGENTS.md CLAUDE.md: identical.
3. rg for an em dash, a markdown table, and emoji across all four files: zero hits.

Checklist

• Code follows project conventions
• Self-review completed
• Tests added/updated
• Documentation updated (if applicable)
• No new warnings or errors
• Build passes locally
• PR title follows Conventional Commits

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Correct tool, role, audit flag, and audit-log documentation

📝 Documentation 🕐 Less than 10 minutes

AI Description

• Corrects default tool groups and strict-role behavior to match runtime implementation.
• Replaces nonexistent audit flag and documents cleartext retention for short normalized statements.
• Aligns agent guides with repository wording rules while preserving identical content.

Diagram

graph TD
  Source["Rust source"] --> Audit["Claim audit"] --> Changelog["Changelog"]
  Rules["House rules"] --> Audit
  Audit --> Security["Security policy"]
  Audit --> Guides["Agent guides"]

Loading

High-Level Assessment

The source-audited documentation correction is the appropriate approach. Generating all affected prose directly from code was considered but would not suit contextual security disclosures or contributor guidance and would be disproportionate for these targeted fixes.

Files changed (4) +6 / -6

Documentation (4) +6 / -6

AGENTS.mdAlign architecture guidance with repository wording rules +1/-1

Align architecture guidance with repository wording rules

• Removes the prohibited word “New” from the core-logic placement guidance while preserving its architectural meaning. The content remains synchronized with CLAUDE.md.

AGENTS.md

CHANGELOG.mdCorrect tool, strict-role, and audit option claims +3/-3

Correct tool, strict-role, and audit option claims

• Adds the object group to the default tools, documents rejection of rds_superuser members in strict mode, and replaces the nonexistent '--audit' option with '--no-audit'.

CHANGELOG.md

CLAUDE.mdSynchronize corrected architecture guidance +1/-1

Synchronize corrected architecture guidance

• Applies the same wording correction as AGENTS.md so both agent instruction files remain identical.

CLAUDE.md

SECURITY.mdClarify audit-log statement retention and path documentation +1/-1

Clarify audit-log statement retention and path documentation

• Discloses that normalized statements of at most 200 characters are retained in cleartext alongside their hashes. Directs readers to 'ownpg man', rather than README.md, for the audit-log path and environment reference.

SECURITY.md