Add audit-logs export commands for S3 export destinations

[yummybomb]

Summary

Adds a kernel audit-logs export command group for managing S3 audit log export destinations:

• create — creates a destination (paused by default) and prints the trust-policy onboarding steps with the Kernel role ARN and external ID
• list — paginated table with delivery status per destination (--limit/--offset, more-results hint from pagination headers); JSON output includes a next_offset cursor when another page is available
• get — full detail view including delivery status: status, last success with computed lag, last error and time, consecutive failures, next attempt
• update — partial update of region/bucket/prefix/role ARN/KMS key; --clear-kms-key sends an empty string to remove the key, omitted flags leave fields unchanged; 409 conflicts get a retry-against-fresh-state hint
• pause / resume — status transitions with notes on in-flight uploads and resume semantics
• delete — removes a destination
• test — runs the destination test and exits non-zero on failure, reporting the failing stage and error code

All calls go through the generated AuditLogExportDestinationService in kernel-go-sdk v0.87.0 (bumped from v0.85.0), following the existing cmd/audit_logs.go service-interface pattern. A thin adapter remains only to read and validate the X-Has-More/X-Next-Offset pagination headers via option.WithResponseInto, since the SDK pager does not surface them. --clear-kms-key sends {"kms_key_id":""} per the SDK contract (empty string clears; omit/null leaves unchanged), locked in by a wire-contract test. Create, list, get, update, pause, resume, and test support --output json.

Testing

• make test passes (unit tests cover output rendering, flag validation, partial-update/clear semantics, pagination headers and JSON cursors, 409 handling, and test-failure exit behavior)
• All flows (create, get, list, update incl. KMS set/clear, pause/resume, test, delete, and error paths) were exercised end-to-end against a live environment with the built binary

---

Note

Low Risk
CLI-only feature with mocked and httptest coverage; no changes to core auth or runtime paths beyond a dependency bump.

Overview
Adds kernel audit-logs export, a new subcommand group under audit-logs for managing continuous S3 audit log export destinations via kernel-go-sdk v0.87.0 (from v0.85.0).

Operators can create paused S3 destinations (with optional KMS), list with --limit/--offset and pagination from X-Has-More / X-Next-Offset, get delivery health, partially update bucket/role/KMS (including --clear-kms-key), pause / resume, delete, and test (non-zero exit on failure). Create prints IAM trust onboarding steps; list/get/update/pause/resume/test support --output json.

Implementation mirrors existing audit-logs CLI patterns (service interface + thin SDK adapter for list pagination). Broad unit tests cover rendering, validation, KMS wire contract, 409 hints, and pagination.

^{Reviewed by Cursor Bugbot for commit 0987661. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.85.0 ⏵ v0.87.0	+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fd522c5. Configure here.}

[sjmiller609]

reviewed — overall looks good. two low-priority follow-ups:

Nits

• cmd/audit_logs_export.go:444-450 — nit: truncate by runes or display width; byte slicing can split UTF-8 error messages.

Tests

• cmd/audit_logs_export_test.go:319-375 — consider exercising auditLogsExportClient.List through an httptest.Server; parser and fake tests do not verify SDK response-header capture.