Add event rule inspection commands

docs/COMMAND_REFERENCE.md

@@ -65,6 +65,57 @@ enodia-sentinel list-detectors
 
 Prints the poll detectors and whether each is enabled by config.
 
+### `rules`
+
+```bash
+enodia-sentinel rules list
+enodia-sentinel rules list --json
+enodia-sentinel rules show <sid>
+enodia-sentinel rules show <sid> --json
+enodia-sentinel rules test <event-json>
+enodia-sentinel rules test <event-json> --json
+```
+
+Inspects and tests event-driven detection rules without reading source code.
+`rules list` includes built-in exec/syscall rules plus configured exec rules
+from `exec_rules_file`. `rules show <sid>` prints the rule metadata and match
+conditions. `rules test <event-json>` loads an exec or syscall event JSON file,
+runs the matching rule engine, and prints any alerts that would fire. Use `-`
+instead of a path to read the event JSON from stdin.
+
+Exec event JSON shape:
+
+```json
+{
+  "pid": 42,
+  "ppid": 1,
+  "uid": 1000,
+  "parent_comm": "nginx",
+  "filename": "/bin/sh",
+  "argv": ["-c", "id"]
+}
+```
+
+Syscall event JSON shape:
+
+```json
+{
+  "pid": 42,
+  "ppid": 1,
+  "uid": 1000,
+  "comm": "payload",
+  "syscall": "mprotect",
+  "args": [0, 4096, 6, 0, 0, 0]
+}
+```
+
+Exit code:
+
+- `0`: list/show succeeded, or `rules test` matched at least one rule.
+- `1`: unknown sid for `show`, or no rule matched for `test`.
+- `2`: malformed sid, missing target, unreadable JSON, or unsupported event
+  shape.
+
 ### `rootcheck`
 
 ```bash

docs/ROADMAP.md

@@ -156,10 +156,10 @@ Exit criteria:
 Purpose: make detection coverage easier to audit, tune, and extend without
 turning Sentinel into a noisy rules dump.
 
-- Add `enodia-sentinel rules list` and `rules show <sid>` for built-in and
+- ✅ Add `enodia-sentinel rules list` and `rules show <sid>` for built-in and
   configured rules.
-- Add `enodia-sentinel rules test <event-json>` so operators can validate custom
-  event rules against captured or fixture events.
+- ✅ Add `enodia-sentinel rules test <event-json>` so operators can validate
+  custom event rules against captured or fixture events.
 - Generate rule documentation from source defaults: SID, signature, classtype,
   event type, match fields, expected false positives, and drill coverage.
 - Require a fixture or safe red-team drill for every built-in SID, including