Add stable v1 schema IDs and docs

enodia_sentinel/cli.py

@@ -12,6 +12,7 @@ import signal
 import sys
 
 from . import __version__, detectors
+from . import schemas
 from .config import Config
 from .daemon import Sentinel
 from .system import SystemState, scan_suid_binaries
@@ -376,6 +377,7 @@ def _cmd_incident(cfg: Config, action: str, iid: str | None, as_json: bool) -> i
 
     if action == "export":
         bundle = {
+            "schema": schemas.INCIDENT_BUNDLE_V1,
             "incident": inc,
             "snapshots": [r for name in inc.get("snapshots", [])
                           if (r := _load_snapshot_report(cfg, name)) is not None],
@@ -386,7 +388,11 @@ def _cmd_incident(cfg: Config, action: str, iid: str | None, as_json: bool) -> i
     # action == "show"
     timeline = _incident_timeline(cfg, inc)
     if as_json:
-        print(json.dumps({"incident": inc, "timeline": timeline}, indent=2))
+        print(json.dumps({
+            "schema": schemas.INCIDENT_VIEW_V1,
+            "incident": inc,
+            "timeline": timeline,
+        }, indent=2))
         return 0
     print(f"Incident {inc['id']}  [{inc.get('severity', '?')}] on {inc.get('host', '?')}")
     print(f"  first seen: {inc.get('first_seen', '?')}")