Two gaps in the baseline-reconciliation feature:
- The dashboard claimed to summarise acknowledged drift, but renderIntegrity()
never rendered it. Add a `recon` chip to the integrity summary and a
Reconciliation state-card (accepted/ok/stale counts plus stale items).
- A read-only GET /api/integrity could write the store: list() flushed a
TTL-lapsed ok->stale transition to disk, violating the read-only dashboard
invariant. Add list(persist=False) and use it from the web summary path so
staleness is evaluated in memory without touching the file.
Covered by a new test asserting integrity_report() never rewrites the store.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Implements the v0.9 roadmap item from the approved design spec. Operators
accept a specific FIM/package/listener/SUID drift item with a mandatory
reason; the ack suppresses that one alert only while the live state still
matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on
further change; identity kinds (listener/suid) retire on TTL or revoke.
- reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt
store), fingerprint builders, and the filter_alerts chokepoint.
- CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json.
- Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity.
- RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP
docs, and reconcile unit/CLI/integration tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
