Add audited response apply rehearsal

This commit is contained in:
Luna 2026-07-09 05:56:25 -07:00
parent 51d52b5229
commit 0b010df514
No known key found for this signature in database
11 changed files with 198 additions and 28 deletions

View file

@ -132,7 +132,8 @@ CLI-generated plans may also include `artifacts` with saved plan/audit paths.
## `enodia.response.audit.v1`
JSONL record appended when the CLI persists a response plan.
JSONL record appended when the CLI persists a response plan or rehearses a
saved plan with `respond apply --dry-run`.
Required fields:
@ -140,7 +141,7 @@ Required fields:
|---|---|---|
| `schema` | string | `enodia.response.audit.v1`. |
| `time` | string | ISO-8601 audit time. |
| `event` | string | Currently `response_plan_generated`. |
| `event` | string | `response_plan_generated` or `response_apply_rehearsed`. |
| `actor` | string | Caller identity supplied by the CLI/workflow. |
| `plan_id` | string | Persisted plan id. |
| `incident_id` | string | Source incident id. |
@ -149,6 +150,8 @@ Required fields:
| `action_count` | integer | Number of proposed actions. |
| `plan_path` | string | Persisted plan artifact path. |
Apply rehearsal records also include `executed: false` and a short `reason`.
## `enodia.reconcile.v1`
Acknowledged-drift store written by `baseline accept/revoke/list`