dbbe35b3fc
Implements the v0.9 roadmap item from the approved design spec. Operators accept a specific FIM/package/listener/SUID drift item with a mandatory reason; the ack suppresses that one alert only while the live state still matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on further change; identity kinds (listener/suid) retire on TTL or revoke. - reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt store), fingerprint builders, and the filter_alerts chokepoint. - CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json. - Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity. - RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP docs, and reconcile unit/CLI/integration tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
18 lines
722 B
Python
18 lines
722 B
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Stable JSON schema identifiers for operator-facing contracts.
|
|
|
|
These are lightweight schema IDs, not a full JSON Schema implementation. Tests
|
|
pin the minimum v1 fields and types so downstream automation can rely on them
|
|
while newer releases remain free to add fields.
|
|
"""
|
|
|
|
ALERT_V1 = "enodia.alert.v1"
|
|
ALERT_SNAPSHOT_V1 = "enodia.alert.snapshot.v1"
|
|
INCIDENT_V1 = "enodia.incident.v1"
|
|
INCIDENT_VIEW_V1 = "enodia.incident.view.v1"
|
|
INCIDENT_BUNDLE_V1 = "enodia.incident.bundle.v1"
|
|
STATUS_V1 = "enodia.status.v1"
|
|
INTEGRITY_V1 = "enodia.integrity.v1"
|
|
RESPONSE_PLAN_V1 = "enodia.response.plan.v1"
|
|
RESPONSE_AUDIT_V1 = "enodia.response.audit.v1"
|
|
RECONCILE_V1 = "enodia.reconcile.v1"
|