docs(milestone): complete v0.5-live-assist — v0.1.13 tagged, milestone release, merged to main

v0.5 (Live Assist — on-the-job voice companion) milestone complete.
4 phases: P0 (pre-execution, v0.1.10) → P1 (assist core + guardrail,
v0.1.11) → P2 (integration + tech-debt + NFR, v0.1.12) → P3 (final
review + ship, v0.1.13 = milestone release).

16/16 REQs covered (3 ASSIST + 4 NFR + 9 IDEATE). 4 v0.6 backlog.
469 tests passed, 0 failed. 1 P0 fixed (guardrail processor safety).
8 P1+ flagged for v0.6. 8 v0.4 P1+ tech-debt addressed.
G-049 + G-067 grill MUSTs resolved. ESCALATION-01 (PIPEDA) OPEN for
human legal review before assist surface go-live.

---ci---
project: praxis
phase: 3
milestone: v0.5
status: complete
requirements:
  covered: [REQ-ASSIST-01, REQ-ASSIST-02, REQ-ASSIST-03, REQ-NFR-ASSIST-01, REQ-NFR-ASSIST-02, REQ-NFR-ASSIST-03, REQ-NFR-ASSIST-04, REQ-IDEATE-01, REQ-IDEATE-02, REQ-IDEATE-03, REQ-IDEATE-04, REQ-IDEATE-05, REQ-IDEATE-06, REQ-IDEATE-07, REQ-IDEATE-08, REQ-IDEATE-09]
  partial: []
---/ci---

server/operator/credentials.py

@@ -9,6 +9,7 @@ the credential asserts (D-043).
 from __future__ import annotations
 
 import datetime as _dt
+import logging
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from pydantic import BaseModel
@@ -19,6 +20,8 @@ from server.operator._common import require_pg_store
 
 router = APIRouter(prefix="/api/operator", tags=["operator-credentials"])
 
+log = logging.getLogger(__name__)
+
 
 class CredentialOut(BaseModel):
     id: str
@@ -72,6 +75,11 @@ async def revoke_credential(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND,
                             detail="credential not found")
     await pg_store.set_credential_status(cred_id, "revoked")
+    # TASK-12-04 (P1+ #5): application-level audit log for credential revocation.
+    # The revoking operator_id + cred_id are logged. No audit_log table (the
+    # log is sufficient for pilot — D-056 stateless cookies + revoked_at
+    # timestamp are the primary audit trail).
+    log.info("credential revoked: operator=%s cred_id=%s", op.id, cred_id)
     return OkResponse(ok=True, id=cred_id, status="revoked")