chore(mxc): address rebase follow-ups

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-ocsf/src/tracing_layers/event_bridge.rs

@@ -48,7 +48,9 @@ pub fn emit_ocsf_event(event: OcsfEvent) {
 
 /// Store an `OcsfEvent` in the thread-local bridge so OCSF layers
 /// (`OcsfJsonlLayer` / `OcsfShorthandLayer`) can `clone_current_event()` it
-/// during tracing dispatch. Pair with [`clear_current_event`] after the emit.
+/// during tracing dispatch.
+///
+/// Pair with [`clear_current_event`] after the emit.
 ///
 /// Exposed so callers that need to attach extra tracing fields to the *same*
 /// event (e.g. the gateway's per-sandbox `sandbox_id` routing field — see
@@ -67,7 +69,9 @@ pub fn clear_current_event() {
     });
 }
 
-/// Emit an `OcsfEvent` that is BOTH picked up by the structured OCSF layers
+/// Emit an `OcsfEvent` through the structured and routed output paths.
+///
+/// The event is picked up by the structured OCSF layers
 /// (via the thread-local bridge → `OcsfJsonlLayer` writes full JSON) AND
 /// routed by the gateway's `TracingLogBus` (via the `sandbox_id` + `message`
 /// tracing fields → per-sandbox stream / stdout shorthand).

crates/openshell-server/src/tracing_setup.rs

@@ -79,16 +79,17 @@ pub fn install(
         }))
         .init();
 
-    match jsonl_dir {
-        Some(dir) => tracing::info!(
+    if let Some(dir) = jsonl_dir {
+        tracing::info!(
             target: "openshell_server",
             ocsf_jsonl_dir = %dir.display(),
             "OCSF JSONL audit log enabled (openshell-ocsf.<date>.log, daily rotation, keep 3)"
-        ),
-        None => tracing::debug!(
+        );
+    } else {
+        tracing::debug!(
             target: "openshell_server",
             "OCSF JSONL audit log disabled"
-        ),
+        );
     }
 
     (
@@ -114,14 +115,12 @@ fn build_ocsf_jsonl_layer() -> (
     Option<OcsfJsonlLayer<tracing_appender::rolling::RollingFileAppender>>,
     Option<std::path::PathBuf>,
 ) {
-    let disabled = std::env::var("OPENSHELL_OCSF_JSON")
-        .map(|v| {
-            matches!(
-                v.trim().to_ascii_lowercase().as_str(),
-                "0" | "false" | "off" | "no"
-            )
-        })
-        .unwrap_or(false);
+    let disabled = std::env::var("OPENSHELL_OCSF_JSON").is_ok_and(|v| {
+        matches!(
+            v.trim().to_ascii_lowercase().as_str(),
+            "0" | "false" | "off" | "no"
+        )
+    });
     if disabled {
         return (None, None);
     }

docs/observability/logging.mdx

@@ -97,8 +97,6 @@ CLASS:ACTIVITY [SEVERITY] ACTION DETAILS [CONTEXT]
 - Config: description of what changed
 - Finding: quoted title with the stable finding type, optional confidence, and source-specific context attributes when available
 
-MXC ETW process-launch events record the executable name but omit command-line arguments from both OCSF JSON and shorthand. Arguments can legitimately contain credentials, signed URLs, or PII.
-
 **Context** in brackets provides structured fields such as policy provenance, source-specific attributes, and denial reasons.
 
 ### Examples