docs(spec): align spec with v3.7.0 cycle-2 implementation discoveries

- Add audit.* config key group (audit.retention-days, audit.async,
  audit.queue-maxsize) — PR #1279 added async write-behind queue to
  AuditService; spec had no audit config keys documented
- Document UKO runtime services (UKOQueryInterface, UKOInferenceEngine,
  UKOGraphPersistence) — PR #1312 operationalized UKO runtime; spec
  described UKO conceptually but not the service API
- Add UKOIndexer.index_graph() inference and layer population note

No-action PRs this cycle:
- #1307 (PermissionsScreen): implementation matches spec exactly
- #1310 (estimation actor): spec already documents actor.default.estimation
- #1278 (CorrectionDryRunReport): internal refactor, spec not affected
- #1300/1301 (event enrichment): event payload details not in spec scope
- #1305/1263/1262 (CLI fixes): spec alignment fixes, no spec change needed

ISSUES CLOSED: none (minor clarifications only)

docs/specification.md

@@ -30546,6 +30546,14 @@ Keys are organized by their top-level group. Within each group, the full dot-pat
 | `sandbox.checkpoint.dir` | string | `<core.data-dir>/checkpoints` | `CLEVERAGENTS_CHECKPOINT_DIR` | Directory where plan execution checkpoints are stored. Each plan gets a subdirectory named by its ULID. |
 | `sandbox.checkpoint.max-per-plan` | integer | `50` | `CLEVERAGENTS_CHECKPOINT_MAX` | Maximum number of checkpoints retained per plan. When exceeded, the oldest checkpoints are pruned (keeping the first and most recent). |
 
+##### `audit.*` — Audit Logging
+
+| Key | Type | Default | Env Variable | Description |
+|-----|------|---------|-------------|-------------|
+| `audit.retention-days` | integer | `0` | `CLEVERAGENTS_AUDIT_RETENTION_DAYS` | Days to retain audit log entries before pruning. `0` means keep indefinitely (default for compliance). |
+| `audit.async` | boolean | `true` | `CLEVERAGENTS_AUDIT_ASYNC` | When `true` (default), audit entries are written asynchronously via a write-behind queue on a background daemon thread, so that `AuditService.record()` does not block the calling domain operation. Set to `false` to restore synchronous behaviour (useful for debugging or when strict ordering is required). |
+| `audit.queue-maxsize` | integer | `10000` | `CLEVERAGENTS_AUDIT_QUEUE_MAXSIZE` | Maximum number of pending audit entries in the write-behind queue. When the queue is full, `record()` blocks until space is available, providing back-pressure. Increase for very high-throughput workloads. Only effective when `audit.async` is `true`. |
+
 ##### `index.*` — Code Intelligence and Indexing
 
 | Key | Type | Default | Env Variable | Description |
@@ -45315,6 +45323,18 @@ Retrieves context from parent and ancestor plan decisions. This is how child pla
 
 The ACMS-specific extension points (analyzers, backends, UKO vocabularies, strategies, and pipeline components) are documented in the **Extensibility** section below. See **Extensibility > ACMS Extensions** for the full details.
 
+#### UKO Runtime Services
+
+The UKO runtime is operationalized through three service classes:
+
+- **`UKOQueryInterface`** — Typed interface for ACMS context strategies to query UKO classification data. Provides `classify_resource(uri)` returning a `ClassificationResult` with `layer` (0–3), `primary_type`, `source_resource_id`, and `relationships`. Strategies use this to discover which ontology layer a resource belongs to and what relationships it has.
+
+- **`UKOInferenceEngine`** — Semantic analysis service that infers implicit relationships from UKO triples produced by domain analyzers. Infers three relationship types: `uko:implicitSiblingOf` (co-occurrence), `uko:implicitContains` (URI prefix containment), and `uko:implicitDependsOn` (URI reference in object values). Inferred triples are stored with confidence `0.7` to distinguish them from deterministic extractions.
+
+- **`UKOGraphPersistence`** — Serializes and restores UKO graph state via JSON or in-memory backends. Used for graph persistence across sessions and for test isolation.
+
+The `UKOIndexer.index_graph()` method runs inference via `UKOInferenceEngine` and populates `uko:layer` triples for all four ontology layers during indexing.
+
 #### Real-time Index Synchronization
 
 The system maintains index freshness through immediate, proactive updates. The `UKOIndexer` produces UKO triples from resources using pluggable analyzers, and simultaneously indexes into text and vector backends: