Expand TUI and package recovery planning

docs/COMMAND_REFERENCE.md

@@ -324,11 +324,14 @@ enodia-sentinel respond plan <incident-id> --json
 Builds a dry-run response plan from an incident's retained JSON snapshots. The
 plan may include evidence preservation, process freeze/terminate candidates,
 outbound IP blocks, systemd unit disablement, suspicious-file quarantine,
-package-restore lookup, and follow-up verification checks. Recovery checks stay
-read-only too: plans can ask the operator to re-run `fim-check --packages`,
-verify package files with `pkgdb-verify`, re-run `rootcheck`, confirm
-persistence alerts are gone with `check --json`, and run `watchdog` from another
-host to prove the heartbeat/dashboard path is visible.
+package-restore planning, and follow-up verification checks. Package restore
+guidance stays explicit: identify the owner with `pacman -Qo`, verify signed
+package-cache metadata with `pkgdb-verify`, reinstall the owner from trusted
+package media, then re-run `fim-check --packages` and `fim-update` only after
+operator review. Recovery checks stay read-only too: plans can ask the operator
+to re-run `rootcheck`, confirm persistence alerts are gone with `check --json`,
+and run `watchdog` from another host to prove the heartbeat/dashboard path is
+visible.
 
 This command is intentionally read-only: it prints commands for operator review
 and never executes them. Each CLI-generated plan is also saved under
@@ -374,11 +377,14 @@ enodia-sentinel-tui
 
 Opens the stdlib curses terminal dashboard for SSH/tmux operators. It does not
 require the optional tray dependencies and reads the same local state as the CLI:
-daemon status, recent alert snapshots, incident index, and event-rule metadata.
+daemon status, recent alert snapshots, incident index and timelines, posture
+findings, integrity/watchdog state, event-rule metadata, event tail, and
+read-only response-plan previews.
 
 Keys:
 
-- `1` / `2` / `3` / `4`: status, alerts, incidents, rules.
+- `1` / `2` / `3` / `4`: status, alerts, incidents, timelines.
+- `5` / `6` / `7` / `8` / `9`: posture, integrity, rules, events, response plans.
 - `j` / `k` or arrows: scroll.
 - `r`: refresh.
 - `/`: filter the current view.
@@ -387,8 +393,9 @@ Keys:
 - `Ctrl-L`: redraw.
 - `q`: quit.
 
-Command mode supports `status`, `alerts`, `incidents`, `rules`, `help`,
-`refresh`, `filter <text>`, `clear`, and `quit`.
+Command mode supports `status`, `alerts`, `incidents`, `timeline`, `posture`,
+`integrity`, `rules`, `events`, `response`, `help`, `refresh`,
+`filter <text>`, `clear`, and `quit`.
 
 ### `web`
 

docs/OPERATIONS.md

@@ -78,8 +78,10 @@ summarizes FIM/package anchors plus heartbeat freshness under the Integrity tab
 for quick remote review.
 
 For SSH/tmux operators, `enodia-sentinel tui` provides a terminal dashboard over
-the same local state: status, recent alerts, incidents, and rules. Use `:` for
-command mode and `Tab` to complete TUI commands.
+the same local read-only management state: status, recent alerts, incidents,
+incident timelines, posture findings, integrity/watchdog state, event-rule
+metadata, event tail, and dry-run response-plan previews. Use `:` for command
+mode and `Tab` to complete TUI commands.
 
 On desktop hosts the optional tray applet (`enodia-sentinel-tray`, `[tray]`
 extra) wraps the same workflow: it drives the same `systemctl` units operators
@@ -107,11 +109,16 @@ When Sentinel fires:
    commands. CLI-generated plans are saved under
    `/var/log/enodia-sentinel/response-plans/` and indexed in
    `/var/log/enodia-sentinel/response-audit.log` for later review.
-5. If the alert involves a binary, run:
+5. If the alert involves a package-owned binary, review the package recovery
+   actions in the response plan and run the restore sequence only after the
+   owning package and package source are trusted:
 
    ```bash
-   enodia-sentinel fim-check --packages
+   pacman -Qo /path/to/file
    enodia-sentinel pkgdb-verify --sample 200
+   pacman -S --overwrite '*' <package>
+   enodia-sentinel fim-check --packages
+   enodia-sentinel fim-update
    ```
 
 6. If the alert involves hiding or tampering, run:

docs/ROADMAP.md

@@ -67,8 +67,10 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
 - ✅ Add dry-run first actions for evidence freeze, process freeze/terminate,
   outbound IP block, systemd stop/disable, suspicious-file quarantine,
   package-owner lookup, and follow-up verification.
-- Add package reinstall/restore planning after trusted-media and package-manager
-  semantics are designed for pacman, dpkg, and rpm.
+- ✅ Add package reinstall/restore planning for pacman-owned file findings:
+  identify the owning package, verify signed package-cache metadata, reinstall
+  from trusted package media, re-run integrity checks, and re-anchor FIM only
+  after operator review. Debian/RPM support remains future work.
 - Require explicit `--apply` for changes; default to read-only plans.
 - Extend response audit logs to any future state-changing `--apply` workflow.
 - ✅ Add baseline reconciliation: accept legitimate FIM/package/listener/SUID

docs/RUNBOOKS.md

@@ -162,12 +162,15 @@ transaction is the suspicious case.
 - Identify the owning package and reinstall from a trusted source:
 
   ```bash
+  enodia-sentinel respond plan <incident-id>
   pacman -Qo /path/to/binary
+  enodia-sentinel pkgdb-verify
   pacman -S --overwrite '*' <package>     # reinstall the verified file
   enodia-sentinel fim-check --packages    # confirm it now matches
+  enodia-sentinel fim-update              # re-anchor only after review
   ```
 
-- Then re-anchor: `enodia-sentinel fim-update` and re-run `pkgdb-check`.
+- Then re-run `pkgdb-check`.
 
 **False positives:** a mid-upgrade snapshot can momentarily disagree. Re-run after
 the transaction completes; a persistent mismatch is the real finding.

docs/SPECIFICATION.md

@@ -114,7 +114,8 @@ create artifacts.
 Current IPS scope is explicit prevention workflow, not transparent inline
 enforcement. Sentinel can recommend evidence preservation, process
 freeze/termination, outbound IP blocks, systemd unit disablement, suspicious-file
-quarantine, package-owner lookup, and follow-up verification. It does not
+quarantine, pacman package-owner lookup, signed-cache verification, trusted
+package reinstall, FIM re-anchoring, and follow-up verification. It does not
 execute those commands until a future audited `--apply` workflow is designed,
 tested, and documented.