@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/backup-and-recovery/invalid/backup-verify-missing-verification-status.json

@@ -0,0 +1,66 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0004-7c4d-8b1e-2f3a40516204",
+  "time": "2026-03-16T04:22:11.005Z",
+  "event": {
+    "name": "backup.verify",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Monthly restore rehearsal completed against an isolated environment."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-verifier",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "verification-run-2026-0316"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-verification",
+    "policyVersion": "2"
+  },
+  "reason": {
+    "code": "scheduled-verification",
+    "text": "Monthly rehearsal required by the recovery testing schedule.",
+    "reference": "records/restore-rehearsal/rehearsal-2026-0316"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "records/restore-rehearsal/rehearsal-2026-0316",
+      "contentType": "application/pdf",
+      "createdAt": "2026-03-16T04:22:00Z"
+    }
+  ],
+  "controlCategories": ["recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "recoveryPoint": "2026-03-14T02:00:00Z",
+      "retentionClass": "operational-35-day"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/policy-update-missing-change.json

@@ -0,0 +1,65 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000c-7c4d-8b1e-2f3a4051620c",
+  "time": "2026-04-10T14:06:41.020Z",
+  "event": {
+    "name": "backup.policy.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Backup frequency for the orders database reduced from hourly to daily."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["backup-operator"]
+  },
+  "resource": {
+    "type": "backup-policy",
+    "id": "backup-policy-orders",
+    "name": "orders-protection",
+    "classification": "internal",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "change-request-4610"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-administration",
+    "policyVersion": "3"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-change-advisory",
+    "requestId": "request-9411",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-10T14:02:00Z"
+  },
+  "reason": {
+    "code": "objective-renegotiated",
+    "text": "Backup frequency reduced after the recovery point objective was renegotiated with the service owner.",
+    "reference": "change-request-4610"
+  },
+  "controlCategories": ["data-protection", "change-approval"],
+  "metadata": {
+    "backup": {
+      "policyId": "backup-policy-orders",
+      "retentionClass": "operational-35-day",
+      "protectedScope": "database-orders"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/recovery-failover-missing-recovery-id.json

@@ -0,0 +1,71 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000b-7c4d-8b1e-2f3a4051620b",
+  "time": "2026-04-02T03:24:55.480Z",
+  "event": {
+    "name": "recovery.failover",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Payments platform failed over to the secondary region."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-failover-authorization",
+    "requestId": "request-9330",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-02T03:18:00Z"
+  },
+  "reason": {
+    "code": "regional-outage",
+    "text": "Traffic moved to the secondary region while primary storage is unavailable.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "targetScope": "region-south-secondary",
+      "recoveryPoint": "2026-04-02T03:05:00Z",
+      "approvalRequired": true,
+      "rehearsal": false
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/recovery-failover-missing-target-scope.json

@@ -0,0 +1,71 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000b-7c4d-8b1e-2f3a4051620b",
+  "time": "2026-04-02T03:24:55.480Z",
+  "event": {
+    "name": "recovery.failover",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Payments platform failed over to the secondary region."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-failover-authorization",
+    "requestId": "request-9330",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-02T03:18:00Z"
+  },
+  "reason": {
+    "code": "regional-outage",
+    "text": "Traffic moved to the secondary region while primary storage is unavailable.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "recoveryId": "recovery-2026-0402-0311",
+      "recoveryPoint": "2026-04-02T03:05:00Z",
+      "approvalRequired": true,
+      "rehearsal": false
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/restore-start-missing-approval.json

@@ -0,0 +1,66 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0008-7c4d-8b1e-2f3a40516208",
+  "time": "2026-03-19T08:50:02.770Z",
+  "event": {
+    "name": "restore.start",
+    "category": "data-infrastructure",
+    "type": "restore",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Point-in-time restore of the orders database started."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["database-operator"]
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "restore-run-2026-0319"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "restore-authorization",
+    "policyVersion": "2",
+    "permissions": ["restore-execute"]
+  },
+  "reason": {
+    "code": "data-corruption",
+    "text": "A faulty migration corrupted order records; service is being returned to the last verified recovery point.",
+    "reference": "incident-record-2211"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "restoreId": "restore-2026-0319-0850",
+      "sourceId": "backup-2026-0318-0200",
+      "recoveryPoint": "2026-03-18T02:00:00Z",
+      "targetScope": "cluster-north-primary",
+      "approvalRequired": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/restore-start-missing-source-id.json

@@ -0,0 +1,73 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0008-7c4d-8b1e-2f3a40516208",
+  "time": "2026-03-19T08:50:02.770Z",
+  "event": {
+    "name": "restore.start",
+    "category": "data-infrastructure",
+    "type": "restore",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Point-in-time restore of the orders database started."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["database-operator"]
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "restore-run-2026-0319"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "restore-authorization",
+    "policyVersion": "2",
+    "permissions": ["restore-execute"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-production-restore",
+    "requestId": "request-9014",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-03-19T08:40:00Z"
+  },
+  "reason": {
+    "code": "data-corruption",
+    "text": "A faulty migration corrupted order records; service is being returned to the last verified recovery point.",
+    "reference": "incident-record-2211"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "restoreId": "restore-2026-0319-0850",
+      "recoveryPoint": "2026-03-18T02:00:00Z",
+      "targetScope": "cluster-north-primary",
+      "approvalRequired": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/snapshot-create-missing-snapshot-id.json

@@ -0,0 +1,57 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0007-7c4d-8b1e-2f3a40516207",
+  "time": "2026-03-18T11:05:44.310Z",
+  "event": {
+    "name": "snapshot.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Volume snapshot taken immediately before a schema migration."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-2201",
+    "tenantId": "tenant-7",
+    "roles": ["database-operator"]
+  },
+  "resource": {
+    "type": "volume",
+    "id": "volume-4471",
+    "name": "orders-data-volume",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "change-request-4471"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "storage-administration",
+    "policyVersion": "4"
+  },
+  "reason": {
+    "code": "pre-change-safeguard",
+    "text": "Snapshot taken so the migration can be reversed without a full restore.",
+    "reference": "change-request-4471"
+  },
+  "metadata": {
+    "backup": {
+      "recoveryPoint": "2026-03-18T11:05:00Z",
+      "retentionClass": "short-lived-7-day",
+      "targetScope": "storage-pool-north"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/not-applicable/backup-chunk-write.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0010-7c4d-8b1e-2f3a40516210",
+  "time": "2026-03-14T02:12:41.330Z",
+  "event": {
+    "name": "backup.chunk.write",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "debug",
+    "summary": "A backup data chunk was written to the storage target."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "chunkIndex": 4172,
+      "chunkBytes": 4194304
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/not-applicable/restore-progress.json

@@ -0,0 +1,42 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0011-7c4d-8b1e-2f3a40516211",
+  "time": "2026-03-19T09:04:12.500Z",
+  "event": {
+    "name": "restore.progress",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "debug",
+    "summary": "Periodic progress report emitted while a restore is running."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-restore-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "request": {
+    "correlationId": "restore-run-2026-0319"
+  },
+  "metadata": {
+    "backup": {
+      "restoreId": "restore-2026-0319-0850",
+      "completedFraction": 0.62
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/not-applicable/storage-replica-heartbeat.json

@@ -0,0 +1,37 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0012-7c4d-8b1e-2f3a40516212",
+  "time": "2026-04-02T03:09:00.000Z",
+  "event": {
+    "name": "storage.replica.heartbeat",
+    "category": "data-infrastructure",
+    "type": "read",
+    "outcome": "success",
+    "severity": "debug",
+    "summary": "Replication lag reported by the standby replica."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-storage-replicator",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "volume",
+    "id": "volume-4471",
+    "name": "orders-data-volume",
+    "classification": "confidential",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "metadata": {
+    "replication": {
+      "lagSeconds": 3,
+      "replicaScope": "region-south-secondary"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/backup-complete-failed.json

@@ -0,0 +1,62 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0003-7c4d-8b1e-2f3a40516203",
+  "time": "2026-03-15T02:14:52.410Z",
+  "event": {
+    "name": "backup.complete",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "failure",
+    "severity": "high",
+    "summary": "Nightly backup run ended without producing a recovery point.",
+    "error": {
+      "code": "storage-target-unavailable",
+      "type": "dependency",
+      "message": "The backup target refused the write session for the whole run window.",
+      "retryable": true
+    }
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0315-0200"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-schedule-tier-1",
+    "policyVersion": "6"
+  },
+  "reason": {
+    "code": "scheduled-run",
+    "text": "Nightly protection run for the orders database."
+  },
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0315-0200",
+      "backupType": "full",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north"
+    }
+  }
+}