#295 docs(cli): document log --jsonl and scan evidence 3-vs-10 cap

[Anonymous]

Originally created by: AshSgDe29071999

Summary

Documents two gaps in the machine-readable section of docs/CLI.md:

1. log --jsonl — added to the flags table, with a short schema note and an example.
2. Scan evidence caps — notes that discovery keeps up to 10 evidence entries per capability while the human risk map shows only the first 3, so scan and scan --json can legitimately differ.

Verified the 10/3 constants against src/doberman/discovery/scan.py (cap at 10) and the human map (evidence[:3]).

Test plan

• [x] Docs-only; no runtime change
• [x] Confirmed --jsonl exists on doberman log and is covered by unit tests

Fixes [#223]

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Merged, and every claim checks out against the code: the allowlist fields, newest-first ordering, empty-if-none, and the 3-vs-10 split (discovery caps evidence at 10 in scan.py's _surface_capabilities, the human risk map trims to 3). Documenting that difference is exactly what saves the next person from filing it as a bug.

If you want the bigger sibling: [#222] is the same file at the same level. docs/CLI.md documents only 10 of the CLI's 26 commands, and you have clearly already read the CLI source closely.