@intentius/terragucci 0.4.34 → 0.4.36

package/dist/audit.schema.json

@@ -8,25 +8,27 @@
   "properties": {
     "schema": { "const": "terragucci.audit/v1" },
     "id": { "type": "string", "description": "sha256: over where the entry came from; the same records give the same id." },
-    "kind": { "enum": ["approval-requested", "approval", "approval-revoked", "override-requested", "override", "override-revoked", "apply", "refused", "migration", "unlock", "state-export", "ephemeral-apply", "ephemeral-destroy"] },
+    "kind": { "enum": ["approval-requested", "approval", "approval-revoked", "override-requested", "override", "override-revoked", "apply", "refused", "migration", "unlock", "state-export", "ephemeral-apply", "ephemeral-destroy", "unrecorded-write"] },
     "project": { "type": "string", "description": "<host>/<path> of the repo." },
     "at": { "type": "string", "description": "When it happened, ISO 8601." },
-    "who": { "type": ["string", "null"], "description": "The approver, the overrider, whoever removed the line, or for an apply the approver it applied under. Null when nobody did." },
-    "what": { "type": "string", "description": "The gate (wave-<k>, or a migration's name) or, for an override or a state export, the root." },
+    "who": { "type": ["string", "null"], "description": "The approver, the overrider, whoever removed the line, for an apply the approver it applied under, or for an unrecorded write the writer a log of the state bucket names. Null when nobody did, or no log names one." },
+    "what": { "type": "string", "description": "The gate (wave-<k>, or a migration's name) or, for an override, a state export or an unrecorded write, the root." },
     "digest": { "type": ["string", "null"], "description": "The wave's set digest, or the digest an override binds. Null when a root failed to plan." },
     "result": { "type": "string" },
     "evidence": {
       "type": "object",
       "required": ["source"],
       "properties": {
-        "source": { "enum": ["ledger", "report"] },
+        "source": { "enum": ["ledger", "report", "state"] },
         "branch": { "type": "string" },
         "path": { "type": "string" },
         "commit": { "type": "string" },
         "bucket": { "type": "string" },
         "key": { "type": "string" },
         "url": { "type": "string" },
-        "job_url": { "type": "string" }
+        "job_url": { "type": "string" },
+        "location": { "type": "string", "description": "An unrecorded write: the state's location." },
+        "version_id": { "type": "string", "description": "An unrecorded write: the version the store lists." }
       }
     },
     "detail": { "type": "object", "description": "What else the source says, by kind." }

package/dist/estate.schema.json

@@ -268,6 +268,20 @@
               "report": { "type": "string", "description": "The wave's report.html, when the page can link it." }
             }
           }
+        },
+        "unrecorded": {
+          "type": "array",
+          "description": "The versions the state's store lists that no wave or migration recorded, from the audit trail's unrecorded-write entries, newest first. Absent when there are none.",
+          "items": {
+            "type": "object",
+            "required": ["version_id", "written_at", "who"],
+            "properties": {
+              "version_id": { "type": "string" },
+              "written_at": { "type": "string" },
+              "who": { "type": ["string", "null"], "description": "The writer a log of the state bucket names, else null." },
+              "deleted": { "type": "boolean", "description": "An S3 delete marker." }
+            }
+          }
         }
       }
     },

package/dist/estates.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/terragucci/schemas/estates/v1/estates.schema.json",
+  "title": "terragucci.estates/v1",
+  "description": "estates.json at the top of a reports prefix: each estate whose roster a tf-apply wave or an estate migration wrote, with its resource count. Within v1 fields are only added, and an existing field never changes meaning.",
+  "type": "object",
+  "required": ["schema", "estates"],
+  "properties": {
+    "schema": { "const": "terragucci.estates/v1" },
+    "estates": {
+      "type": "array",
+      "description": "By estate name.",
+      "items": {
+        "type": "object",
+        "required": ["estate", "count", "at", "project", "root", "roster"],
+        "properties": {
+          "estate": { "type": "string", "description": "The estate a choudoufu root's live block names, or a stock root's path." },
+          "count": { "type": "integer", "description": "How many resources the roster holds." },
+          "at": { "type": "string", "description": "When the roster was read: the wave's end, or the migration's write." },
+          "project": { "type": "string" },
+          "root": { "type": "string" },
+          "roster": { "type": "string", "description": "The roster's key, relative to estates.json: estates/<estate>/roster.json." }
+        }
+      }
+    }
+  }
+}

package/dist/report-index.schema.json

@@ -39,7 +39,7 @@
         "groups": { "type": "integer" },
         "totals": { "$ref": "#/$defs/totals" },
         "refused": { "type": "integer", "description": "Roots that refused to plan." },
-        "failed": { "type": "integer", "description": "Roots that failed to plan or apply. Absent on rows written before it was kept." },
+        "failed": { "type": "integer", "description": "Roots that failed to plan or apply; on a tf-apply wave whose apply failed, every root of the wave. Absent on rows written before it was kept." },
         "changed": { "type": "integer", "description": "Roots with at least one change; on a tf-drift row, the roots that drifted." },
         "approval": { "enum": ["waiting", "approved", "not-required"], "description": "A tf-apply wave's gate." },
         "waiting_since": { "type": "string", "description": "When a waiting wave began waiting for an approval of its digest." },

package/dist/report.schema.json

@@ -177,6 +177,10 @@
               "rules": { "type": "array", "items": { "type": "string" }, "description": "The ids of the rules that denied, sorted (minor 10)." },
               "warnings": { "type": "array", "items": { "type": "string" } },
               "error": { "type": "string" },
+              "held_by": { "type": "array", "items": { "type": "string" }, "description": "With hold in policy.outcomes at base: the ids of the hold rules that matched, sorted; its wave waits for an approval (minor 40)." },
+              "holds": { "type": "array", "items": { "type": "string" }, "description": "The messages of those hold rules (minor 40)." },
+              "allowed_by": { "type": "array", "items": { "type": "string" }, "description": "With allow_unattended in policy.outcomes at base: the ids of the allow_unattended rules that matched, sorted (minor 40)." },
+              "overriders": { "type": "array", "items": { "type": "string" }, "description": "With scoped policy.override entries at base: who may override this root's denial by its rules, names then roles with their holders (minor 40)." },
               "override": {
                 "description": "The policy override that stands for this root's plan and rules (minor 10).",
                 "type": "object",
@@ -357,6 +361,32 @@
               }
             }
           },
+          "policy_gate": {
+            "type": "object",
+            "description": "What the policy's hold and allow_unattended rules did to the wave's gate: held, or unattended when every root that changes something is allowed and none holds; the rules' ids and, on a tf-apply wave, the commit the policy was read at (minor 40).",
+            "required": ["outcome", "rules"],
+            "properties": {
+              "outcome": { "enum": ["held", "unattended"] },
+              "rules": { "type": "array", "items": { "type": "string" } },
+              "commit": { "type": "string" }
+            }
+          },
+          "approval_rules": {
+            "type": "array",
+            "description": "The approval_rules entries at base the wave's roots take: what each asks for and, on a tf-apply wave, the approvers of its digest it counted and whether it is met (minor 40).",
+            "items": {
+              "type": "object",
+              "required": ["roots", "count", "approvers", "met"],
+              "properties": {
+                "roots": { "type": "array", "items": { "type": "string" } },
+                "count": { "type": "integer", "minimum": 1 },
+                "roles": { "type": "array", "items": { "type": "string" } },
+                "not_author": { "type": "boolean" },
+                "approvers": { "type": "array", "items": { "type": "string" } },
+                "met": { "type": "boolean" }
+              }
+            }
+          },
           "held_by_steps": {
             "type": "array",
             "items": { "type": "string" },
@@ -376,7 +406,32 @@
               "over": { "type": "boolean" }
             }
           },
-          "state": { "enum": ["planned", "waiting", "applying", "applied", "refused", "failed"], "description": "Where the wave stands (minor 21): a tf-plan wave is planned; a tf-apply wave waiting, applying, applied, refused or failed." },
+          "state": { "enum": ["planned", "waiting", "applying", "applied", "refused", "failed", "blocked"], "description": "Where the wave stands (minor 21): a tf-plan wave is planned; a tf-apply wave waiting, applying, applied, refused or failed, or blocked when none of its roots ran because an upstream of each did not apply (minor 41)." },
+          "outcomes": {
+            "type": "array",
+            "description": "A tf-apply wave's outcome of each root once it ended (minor 41): applied, unchanged, failed (with the first line of its plan's or apply's error), waiting, refused, decided (its share or group job applies it), not-applied (another root of the wave failed to plan) or blocked (with blocked_by).",
+            "items": {
+              "type": "object",
+              "required": ["root", "outcome"],
+              "additionalProperties": false,
+              "properties": {
+                "root": { "type": "string" },
+                "outcome": { "enum": ["applied", "unchanged", "failed", "waiting", "refused", "decided", "not-applied", "blocked"] },
+                "error": { "type": "string" },
+                "blocked_by": { "type": "string" }
+              }
+            }
+          },
+          "blocked": {
+            "type": "array",
+            "description": "A tf-apply wave's roots that did not run because an upstream did not apply in this run; blocked_by names the root whose failure held it, past any root blocked in between (minor 41).",
+            "items": {
+              "type": "object",
+              "required": ["root", "blocked_by"],
+              "additionalProperties": false,
+              "properties": { "root": { "type": "string" }, "blocked_by": { "type": "string" } }
+            }
+          },
           "reads": { "type": "array", "items": { "type": "integer" }, "description": "The waves whose roots' state its roots read (minor 21)." },
           "replans_after": { "type": "array", "items": { "type": "integer" }, "description": "A tf-plan wave whose plans read outputs known only once these waves apply: it plans again after they apply, and when that plan changes something its gate holds it for an approval of that plan under gate always or on-destructive, but not under gate never; its review digest is null (minor 21)." },
           "preview": {

package/dist/run.schema.json

@@ -66,7 +66,7 @@
           "number": { "type": "integer" },
           "roots": { "type": "array", "items": { "type": "string" } },
           "reads": { "type": "array", "items": { "type": "integer" }, "description": "The waves whose roots' state its roots read." },
-          "state": { "enum": ["not-started", "planned", "waiting", "applying", "applied", "refused", "failed"] },
+          "state": { "enum": ["not-started", "planned", "waiting", "applying", "applied", "refused", "failed", "blocked"] },
           "gate": { "type": "string", "description": "Its gate on the ledger, wave-<n>." },
           "policy": { "type": "string", "description": "The gate policy it ran under: always, on-destructive or never." },
           "approval": { "enum": ["not-requested", "waiting", "approved", "not-required"] },

package/dist/state-versions.schema.json

@@ -29,6 +29,7 @@
               "properties": {
                 "version_id": { "type": "string" },
                 "commit": { "type": "string" },
+                "started": { "type": "string", "description": "When the wave that recorded the version started. terragucci audit counts a version its store says was written between this and finished as the wave's." },
                 "finished": { "type": "string", "description": "When the wave that recorded the version finished." },
                 "wave": { "type": "integer" },
                 "path": { "type": "string", "description": "The wave's run directory, relative to the project's index.json." }