Summary

The operations design spec (docs/design/operations.md) has no dedicated section for the observability/logging architecture. The logging system is comprehensive (7+1 sinks, structured JSON, rotation, redaction, correlation tracking, per-logger routing) but undocumented in the design spec. Observability is only mentioned in passing (audit logging in security sections, error taxonomy in coordination).

Scope

Add a new section to docs/design/operations.md covering:

1. Sink layout: The 8 default sinks (console + 7 files), their levels, formats, and logger name routing
2. Log file locations: /data/logs/ in Docker, logs/ locally, configurable via SYNTHORG_LOG_DIR
3. Rotation policy: RotatingFileHandler (10MB x 5 backups) vs WatchedFileHandler (external logrotate)
4. Sensitive field redaction: Automatic sanitization of passwords, tokens, API keys, credentials at all nesting depths
5. Correlation tracking: request_id, task_id, agent_id via async-safe contextvars, injected into every log event
6. Per-logger levels: Default levels per domain module, configurable overrides
7. Event taxonomy: 54 domain-specific event constant modules under observability/events/
8. Uvicorn integration: How Uvicorn access/error logging is routed through structlog
9. Docker logging: Container-level json-file driver rotation vs app-level file rotation
10. Runtime settings: root_log_level and enable_correlation runtime-editable settings

Acceptance Criteria

• New section in docs/design/operations.md with all 10 topics above
• References the code conventions in CLAUDE.md (get_logger, structured kwargs, event constants)
• Includes a table of all sinks with level, format, routing, and file path
• Cross-references the existing security audit logging discussion