docs(readme): update readme for v2 forensics

[jgmontoya]

---

Summary by CodeRabbit

• Documentation
  • Updated the audit log guide to reflect the current JSONL schema, while still supporting legacy uploads.
  • Clarified required fields, validation rules, grouping behavior, and how older rows are handled.
  • Expanded local setup and workflow commands for development and schema validation.
  • Added operational guidance for purging audit data, rebuilding projections, and validating logs.
  • Improved dashboard documentation with clearer details on per-group views, investigations, trace data, exports, and API access.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7d376bb1-2470-421d-b082-bb9b55a62663

📥 Commits

Reviewing files that changed from the base of the PR and between 483ba42 and c1d9cf3.

📒 Files selected for processing (1)

• README.md

---

Walkthrough

README.md is updated to document the v2 JSONL audit-log schema (with v1 legacy acceptance), Python 3.12/3.13 support, an expanded just command list, new operational management commands for purging/rebuilding/validating audit data, and an expanded dashboard feature and API description.

Changes

README v2 Schema and Operational Docs

Layer / File(s)	Summary
Local dev setup and upload contract README.md	Updates Python version range, replaces just command list with new validate-schema/purge-audit-data/check entries, and rewrites JSONL upload requirements for v2 row contract (required fields, kind object, v1 quarantine behavior, fixture versioning).
Operational commands and dashboard API README.md	Adds purge_audit_data, rebuild_audit_projections, and validate_audit_schema management command docs; expands dashboard feature list with per-group tabs, message trace, fork/convergence reporting, agent-state exports, and session-gated /api/v1/groups/<slug>/... JSON API.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: README documentation updated for v2 forensics/audit-log support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/update-readme

---

_{Comment @coderabbitai help to get the list of available commands.}

[stage-review]

Ready to review this PR? Stage has broken it down into 4 individual chapters for you:

	Title
1	Update project overview and schema references
2	Document audit log version requirements
3	Update development environment and CLI commands
4	Expand operational and dashboard documentation

_{Chapters generated by Stage for commit c1d9cf3 on Jun 29, 2026 4:08pm UTC.}