feat(P02): complete integration + tech-debt + NFR measurement phase — v0.1.12 tagged

Phase 2 (Integration + Tech-Debt + NFR Measurement) complete.
4 slices, 2 waves, 9 tasks. 4 REQs covered. 60 new tests (469 total).
8 v0.4 P1+ tech-debt findings addressed. Verify: APPROVE_WITH_NOTES.

NFR measurement (p95 latency + guardrail FP/FN), cohort aggregation
assist metrics (5 new metrics, no schema change), assist cost tracking
+ C-3 budget check, tech-debt wave (argon2id offload, cookie-secret
validation, credential enum, f-string SQL, cache persistence, zoneinfo,
audit log, 429 mock).

---ci---
project: praxis
phase: 2
milestone: v0.5
status: complete
requirements:
  covered: [REQ-NFR-ASSIST-01, REQ-IDEATE-04, REQ-IDEATE-06, REQ-IDEATE-07]
  partial: []
---/ci---

server/operator/credentials.py

@@ -9,6 +9,7 @@ the credential asserts (D-043).
 from __future__ import annotations
 
 import datetime as _dt
+import logging
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from pydantic import BaseModel
@@ -19,6 +20,8 @@ from server.operator._common import require_pg_store
 
 router = APIRouter(prefix="/api/operator", tags=["operator-credentials"])
 
+log = logging.getLogger(__name__)
+
 
 class CredentialOut(BaseModel):
     id: str
@@ -72,6 +75,11 @@ async def revoke_credential(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
                             detail="credential not found")
     await pg_store.set_credential_status(cred_id, "revoked")
+    # TASK-12-04 (P1+ #5): application-level audit log for credential revocation.
+    # The revoking operator_id + cred_id are logged. No audit_log table (the
+    # log is sufficient for pilot — D-056 stateless cookies + revoked_at
+    # timestamp are the primary audit trail).
+    log.info("credential revoked: operator=%s cred_id=%s", op.id, cred_id)
     return OkResponse(ok=True, id=cred_id, status="revoked")