Add audited response apply rehearsal

docs/COMMAND_REFERENCE.md

@@ -319,6 +319,8 @@ Exit code:
 ```bash
 enodia-sentinel respond plan <incident-id>
 enodia-sentinel respond plan <incident-id> --json
+enodia-sentinel respond apply <plan-path-or-plan-id> --dry-run
+enodia-sentinel respond apply <plan-path-or-plan-id> --dry-run --json
 ```
 
 Builds a dry-run response plan from an incident's retained JSON snapshots. The
@@ -341,11 +343,17 @@ saved path. The JSON schema is `enodia.response.plan.v1` and marks
 `apply_supported: false` until an audited apply workflow exists. Dashboard/API
 plan previews remain read-only and do not create new artifacts.
 
+`respond apply` currently supports only `--dry-run`. It reloads a saved plan by
+path, filename, or `plan_id`, prints the exact reviewed actions, and appends a
+`response_apply_rehearsed` audit record with `executed: false`. Running
+`respond apply` without `--dry-run` exits with an error; Sentinel still does not
+execute containment commands.
+
 Exit code:
 
-- `0`: plan generated.
-- `1`: unknown incident id.
-- `2`: missing incident id.
+- `0`: plan generated, or apply rehearsal recorded.
+- `1`: unknown incident id or saved plan reference.
+- `2`: missing id/reference, or `respond apply` requested without `--dry-run`.
 
 ### `status`
 
@@ -498,11 +506,6 @@ does not require pip or a virtualenv.
 
 ## Future Command Contracts
 
-The roadmap reserves these command shapes:
-
-```bash
-enodia-sentinel respond apply <plan-id>
-```
-
 State-changing response commands should be introduced with stable JSON schemas,
-audit logs, and tests before they are documented as supported.
+audit logs, and tests before they are documented as supported. The current
+`respond apply <plan-ref> --dry-run` command is only an audited rehearsal path.

docs/OPERATIONS.md

@@ -109,6 +109,12 @@ When Sentinel fires:
    commands. CLI-generated plans are saved under
    `/var/log/enodia-sentinel/response-plans/` and indexed in
    `/var/log/enodia-sentinel/response-audit.log` for later review.
+   To rehearse a saved plan and record that review without executing anything:
+
+   ```bash
+   enodia-sentinel respond apply <plan-path-or-plan-id> --dry-run
+   ```
+
 5. If the alert involves a package-owned binary, review the package recovery
    actions in the response plan and run the restore sequence only after the
    owning package and package source are trusted:

docs/ROADMAP.md

@@ -71,8 +71,13 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
   identify the owning package, verify signed package-cache metadata, reinstall
   from trusted package media, re-run integrity checks, and re-anchor FIM only
   after operator review. Debian/RPM support remains future work.
-- Require explicit `--apply` for changes; default to read-only plans.
-- Extend response audit logs to any future state-changing `--apply` workflow.
+- ✅ Add an explicit apply boundary: `respond apply <plan-ref> --dry-run`
+  reloads a saved reviewed plan, prints the exact actions, and appends a
+  `response_apply_rehearsed` audit record without executing commands.
+- Require a future explicit execution flag for state changes; default to
+  read-only plans and audited apply rehearsals.
+- ✅ Extend response audit logs to the apply boundary with `executed: false`
+  records. Future state-changing execution must append the same audit trail.
 - ✅ Add baseline reconciliation: accept legitimate FIM/package/listener/SUID
   drift with a mandatory reason via `baseline accept/revoke/list`. Acks are
   fingerprint-bound (content kinds re-alert on further change), support an

docs/SCHEMAS.md

@@ -132,7 +132,8 @@ CLI-generated plans may also include `artifacts` with saved plan/audit paths.
 
 ## `enodia.response.audit.v1`
 
-JSONL record appended when the CLI persists a response plan.
+JSONL record appended when the CLI persists a response plan or rehearses a
+saved plan with `respond apply --dry-run`.
 
 Required fields:
 
@@ -140,7 +141,7 @@ Required fields:
 |---|---|---|
 | `schema` | string | `enodia.response.audit.v1`. |
 | `time` | string | ISO-8601 audit time. |
-| `event` | string | Currently `response_plan_generated`. |
+| `event` | string | `response_plan_generated` or `response_apply_rehearsed`. |
 | `actor` | string | Caller identity supplied by the CLI/workflow. |
 | `plan_id` | string | Persisted plan id. |
 | `incident_id` | string | Source incident id. |
@@ -149,6 +150,8 @@ Required fields:
 | `action_count` | integer | Number of proposed actions. |
 | `plan_path` | string | Persisted plan artifact path. |
 
+Apply rehearsal records also include `executed: false` and a short `reason`.
+
 ## `enodia.reconcile.v1`
 
 Acknowledged-drift store written by `baseline accept/revoke/list`

docs/SPECIFICATION.md

@@ -109,7 +109,9 @@ When a fresh alert survives cooldown, Sentinel writes:
 CLI-generated response plans are durable artifacts: `respond plan` writes the
 reviewed dry-run plan under `response-plans/` and appends a JSONL
 `response-audit.log` record. Dashboard/API previews remain read-only and do not
-create artifacts.
+create artifacts. `respond apply <plan-ref> --dry-run` reloads a saved plan and
+appends an apply-rehearsal audit record with `executed: false`; it does not run
+commands.
 
 Current IPS scope is explicit prevention workflow, not transparent inline
 enforcement. Sentinel can recommend evidence preservation, process