@intentius/terragucci 0.4.43 → 0.4.45

package/dist/audit.schema.json

@@ -8,7 +8,7 @@
   "properties": {
     "schema": { "const": "terragucci.audit/v1" },
     "id": { "type": "string", "description": "sha256: over where the entry came from; the same records give the same id." },
-    "kind": { "enum": ["approval-requested", "approval", "approval-revoked", "override-requested", "override", "override-revoked", "apply", "refused", "migration", "unlock", "state-export", "ephemeral-apply", "ephemeral-destroy", "unrecorded-write"] },
+    "kind": { "enum": ["approval-requested", "approval", "approval-revoked", "override-requested", "override", "override-revoked", "apply", "refused", "migration", "unlock", "state-export", "ephemeral-apply", "ephemeral-destroy", "unrecorded-write", "agent-run"] },
     "project": { "type": "string", "description": "<host>/<path> of the repo." },
     "at": { "type": "string", "description": "When it happened, ISO 8601." },
     "who": { "type": ["string", "null"], "description": "The approver, the overrider, whoever removed the line, for an apply the approver it applied under, or for an unrecorded write the writer a log of the state bucket names. Null when nobody did, or no log names one." },

package/dist/report.schema.json

@@ -29,7 +29,17 @@
         "pull_request_url": { "type": "string", "description": "The pull or merge request's page (minor 4)." },
         "report_url": { "type": "string", "description": "Where this report.html is served, when reports.url names the bucket's address (minor 4)." },
         "trace_id": { "type": "string", "description": "The run's trace id, when the stage sent a trace (minor 4)." },
-        "trace_url": { "type": "string", "description": "The trace in a viewer, from telemetry.trace_url (minor 4)." }
+        "trace_url": { "type": "string", "description": "The trace in a viewer, from telemetry.trace_url (minor 4)." },
+        "actor": {
+          "type": "object",
+          "description": "Who proposed the change, when policy is set (minor 46). The forge app or bot identity decides kind; trailer and oidcSubject are supporting signals.",
+          "required": ["kind", "principal", "signals"],
+          "properties": {
+            "kind": { "enum": ["person", "agent"] },
+            "principal": { "type": "string" },
+            "signals": { "type": "object", "properties": { "forgeIdentity": { "type": "string" }, "trailer": { "type": "string" }, "oidcSubject": { "type": "string" } } }
+          }
+        }
       }
     },
     "change_set": { "type": "string" },
@@ -138,6 +148,7 @@
                 "index": { "type": ["string", "integer"] },
                 "attributes": {
                   "type": "array",
+                  "description": "On a tf-apply wave, a root that applied: an attribute the plan marked unknown carries the value the state holds after the apply, as after with no unknown, stated once; a sensitive one stays sensitive with no value (minor 47).",
                   "items": {
                     "type": "object",
                     "required": ["path"],
@@ -186,6 +197,7 @@
               "result": { "enum": ["passed", "denied", "error"] },
               "denials": { "type": "array", "items": { "type": "string" } },
               "rules": { "type": "array", "items": { "type": "string" }, "description": "The ids of the rules that denied, sorted (minor 10)." },
+              "hard_mandatory": { "type": "array", "items": { "type": "string" }, "description": "The ids of the rules among rules that are hard-mandatory (minor 46): no override can pass them." },
               "warnings": { "type": "array", "items": { "type": "string" } },
               "error": { "type": "string" },
               "held_by": { "type": "array", "items": { "type": "string" }, "description": "With hold in policy.outcomes at base: the ids of the hold rules that matched, sorted; its wave waits for an approval (minor 40)." },
@@ -382,7 +394,8 @@
               "reason": { "enum": ["approval", "review", "override", "policy"] },
               "approved": { "type": "string" },
               "by": { "type": "string" },
-              "roots": { "type": "array", "items": { "type": "string" } }
+              "roots": { "type": "array", "items": { "type": "string" } },
+              "hard_mandatory": { "type": "array", "items": { "type": "string" }, "description": "With reason policy (minor 46): the hard-mandatory rules among those that denied, which no override can pass." }
             }
           },
           "review": {
@@ -582,6 +595,7 @@
         "roots": { "type": "array", "items": { "type": "string" }, "description": "The roots the change reaches plus the roots they read, followed upstream, sorted." },
         "max": { "type": "integer", "description": "waves.compose_max." },
         "wave": { "type": "integer", "description": "The wave whose run composes them. Absent when the change applies in waves." },
+        "estate": { "const": true, "description": "Every root is a choudoufu estate, composed as one run (minor 48): no state is pulled, split or written back, and each estate's records are written as its resources apply." },
         "fallback": {
           "type": "object",
           "required": ["kind", "reason"],