@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/document-management/valid/legal-hold-apply.json

@@ -0,0 +1,64 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0010-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T10:22:00.100Z",
+  "event": {
+    "name": "document.legal-hold.apply",
+    "category": "data-modification",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Legal hold applied, suspending normal retention for this document."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f10",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1
+  },
+  "reason": {
+    "code": "hold-instruction",
+    "text": "Hold instruction received from the legal team.",
+    "reference": "matter-2026-114"
+  },
+  "metadata": {
+    "legalHold": {
+      "active": true,
+      "matterReference": "matter-2026-114"
+    }
+  }
+}

package/examples/profiles/document-management/valid/permission-grant.json

@@ -0,0 +1,58 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0007-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T17:22:07.100Z",
+  "event": {
+    "name": "document.permission.grant",
+    "category": "data-access",
+    "type": "update",
+    "outcome": "success",
+    "summary": "Editor permission granted on the contract document."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f7",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "reason": {
+    "code": "role-change",
+    "text": "Reviewer promoted to contract editor."
+  },
+  "metadata": {
+    "permission": {
+      "id": "document.edit",
+      "scope": "document-90311",
+      "granteeId": "user-6203"
+    }
+  }
+}

package/examples/profiles/document-management/valid/retention-update.json

@@ -0,0 +1,72 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0009-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T19:22:09.100Z",
+  "event": {
+    "name": "document.retention.update",
+    "category": "data-modification",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Retention class raised after the document was classified as a contract record."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f9",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1
+  },
+  "reason": {
+    "code": "records-classification",
+    "text": "Reclassified as a contract record."
+  },
+  "change": {
+    "changedFields": ["retentionClass"],
+    "before": {
+      "retentionClass": "standard"
+    },
+    "after": {
+      "retentionClass": "contract-record"
+    }
+  },
+  "metadata": {
+    "retention": {
+      "class": "contract-record",
+      "until": "2033-03-14T00:00:00Z"
+    }
+  }
+}

package/examples/profiles/document-management/valid/share-external.json

@@ -0,0 +1,69 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0005-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T15:22:05.100Z",
+  "event": {
+    "name": "document.share.create",
+    "category": "data-access",
+    "type": "share",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Confidential document shared with an external recipient."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f5",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "reason": {
+    "code": "customer-request",
+    "text": "Supplier requested the countersigned agreement.",
+    "reference": "support-case-3391"
+  },
+  "privacy": {
+    "containsPersonalData": true,
+    "dataCategories": ["identifier", "contact"],
+    "processing": "mask",
+    "minimized": true,
+    "purpose": "access-transparency"
+  },
+  "controlCategories": ["external-data-sharing"],
+  "metadata": {
+    "share": {
+      "recipientType": "external",
+      "permission": "view",
+      "expiresAt": "2026-03-21T11:47:52Z",
+      "watermarkApplied": true
+    }
+  }
+}

package/examples/profiles/document-management/valid/share-internal.json

@@ -0,0 +1,54 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0004-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T14:22:04.100Z",
+  "event": {
+    "name": "document.share.create",
+    "category": "data-access",
+    "type": "share",
+    "outcome": "success",
+    "summary": "Contract shared with an internal reviewer group."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f4",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "metadata": {
+    "share": {
+      "recipientType": "internal",
+      "permission": "view",
+      "expiresAt": "2026-04-14T00:00:00Z"
+    }
+  }
+}

package/examples/profiles/document-management/valid/share-revoke.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0006-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T16:22:06.100Z",
+  "event": {
+    "name": "document.share.revoke",
+    "category": "data-access",
+    "type": "update",
+    "outcome": "success",
+    "summary": "External share withdrawn after the agreement was countersigned."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f6",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "reason": {
+    "code": "access-no-longer-required",
+    "text": "Agreement countersigned and filed."
+  },
+  "metadata": {
+    "share": {
+      "recipientType": "external"
+    }
+  }
+}

package/examples/profiles/document-management/valid/version-rollback.json

@@ -0,0 +1,59 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1b80-0008-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T18:22:08.100Z",
+  "event": {
+    "name": "document.version.rollback",
+    "category": "data-modification",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Contract rolled back to the last approved revision."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "document",
+    "id": "document-90311",
+    "name": "quarterly-supplier-agreement",
+    "parentId": "workspace-14",
+    "classification": "confidential",
+    "ownerId": "user-4004",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "document-service",
+    "environment": "production",
+    "version": "2.11.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "workspaceId": "workspace-14"
+  },
+  "request": {
+    "requestId": "request-a91c4f8",
+    "correlationId": "document-lifecycle-7712",
+    "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+    "spanId": "00f067aa0ba902b7",
+    "protocol": "https"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "document-governance",
+    "policyVersion": "12"
+  },
+  "reason": {
+    "code": "incorrect-content",
+    "text": "Unapproved clause introduced in the previous revision.",
+    "reference": "records-task-8830"
+  },
+  "metadata": {
+    "version": {
+      "id": "v11",
+      "previousId": "v12"
+    }
+  }
+}

package/examples/profiles/financial-transaction-management/README.md

@@ -0,0 +1,123 @@
+# Financial transaction management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[financial-transaction-management profile](../../../profiles/financial-transaction-management/). The
+rules themselves are in
+[profile.json](../../../profiles/financial-transaction-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/financial-transaction-management/valid --profile financial-transaction-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/financial-transaction-management/valid
+auditmodel lint-privacy  examples/profiles/financial-transaction-management/valid
+auditmodel check-profile examples/profiles/financial-transaction-management/valid --profile financial-transaction-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile over money
+that accepted an event carrying an account number or a scheme credential would be worse than no
+profile at all.
+
+## Valid fixtures
+
+| File                             | Event                             | Demonstrates                                                        |
+| -------------------------------- | --------------------------------- | ------------------------------------------------------------------- |
+| `payment-capture.json`           | `financial.payment.capture`       | The movement requirements alone: reference, amount, currency, state |
+| `payment-reject.json`            | `financial.payment.reject`        | A refusal: `outcome: failure`, an error descriptor and a reason     |
+| `transfer-execute.json`          | `financial.transfer.execute`      | A two-sided movement naming its counterparty account                |
+| `withdrawal-execute.json`        | `financial.withdrawal.execute`    | Conditional approval: `approvalRequired` declared, decision carried |
+| `deposit-manual-correction.json` | `financial.deposit.record`        | A manual intervention: `manual` declared, change and reason carried |
+| `refund-create.json`             | `financial.refund.create`         | A refund justified against the payment it returns                   |
+| `reversal-execute.json`          | `financial.reversal.execute`      | An unwind naming the transaction it acts against                    |
+| `chargeback-open.json`           | `financial.chargeback.open`       | A dispute raised by an external counterparty                        |
+| `payout-execute.json`            | `financial.payout.execute`        | An automated payout, legitimately with no approval and no reason    |
+| `settlement-execute.json`        | `financial.settlement.execute`    | A scheduled net settlement linking both sides                       |
+| `reconciliation-adjust.json`     | `financial.reconciliation.adjust` | A break corrected in the books, with the transition recorded        |
+| `limit-update.json`              | `financial.limit.update`          | A preventive control raised, with its before and after state        |
+
+Three of these produce **warnings** rather than errors, and that is intentional:
+
+- `payout-execute.json` and `settlement-execute.json` omit `/reason`. A scheduled payout or settlement
+  has no per-event business justification beyond the schedule, and `FIN-CORE-002` recommends rather
+  than requires one.
+- `chargeback-open.json` omits `/approval`. A chargeback is raised by a counterparty, not approved
+  internally, so `FIN-REVERSAL-001` recommends approval rather than requiring it.
+
+A warning never fails conformance. All twelve fixtures are reported as conforming.
+
+Vendor spread is deliberate: the producing applications are a payment service, a ledger service, a
+brokerage ledger, a marketplace payments service, a marketplace payout service, a treasury settlement
+runner, a treasury reconciliation tool and a treasury controls console. The same rules apply to all of
+them.
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                         | Violates           | At                                          |
+| -------------------------------------------- | ------------------ | ------------------------------------------- |
+| `payment-capture-missing-authorization.json` | `FIN-CORE-001`     | `/authorization`                            |
+| `payment-capture-missing-amount.json`        | `FIN-TXN-001`      | `/metadata/financial/amount`                |
+| `withdrawal-missing-correlation.json`        | `FIN-TXN-001`      | `/request/correlationId`                    |
+| `payout-missing-direction.json`              | `FIN-TXN-002`      | `/metadata/financial/direction`             |
+| `transfer-missing-related-resources.json`    | `FIN-LINK-001`     | `/relatedResources`                         |
+| `refund-missing-reason.json`                 | `FIN-REASON-001`   | `/reason`                                   |
+| `reversal-missing-original-transaction.json` | `FIN-REVERSAL-001` | `/metadata/financial/originalTransactionId` |
+| `withdrawal-missing-approval-status.json`    | `FIN-APPROVAL-001` | `/approval/status`                          |
+| `manual-deposit-missing-change.json`         | `FIN-MANUAL-001`   | `/change`                                   |
+| `reconciliation-missing-identifier.json`     | `FIN-RECON-001`    | `/metadata/financial/reconciliationId`      |
+| `reconciliation-adjust-missing-change.json`  | `FIN-RECON-002`    | `/change`                                   |
+| `limit-update-missing-limit-type.json`       | `FIN-LIMIT-001`    | `/metadata/financial/limitType`             |
+
+Every enforceable rule has at least one negative fixture. Two of them are worth reading closely:
+
+- `withdrawal-missing-approval-status.json` keeps the `/approval` object and removes only its
+  `status`. That is the failure the rule is really about: a record naming an approval workflow without
+  saying whether anyone approved anything.
+- `manual-deposit-missing-change.json` is a `financial.deposit.record` event, which no rule requires a
+  `/change` on. It fails only because the producer declared `manual: true`, which is what makes
+  `FIN-MANUAL-001` apply.
+
+## Not-applicable fixtures
+
+| File                   | Event                       | Why it is ungoverned                                                     |
+| ---------------------- | --------------------------- | ------------------------------------------------------------------------ |
+| `balance-view.json`    | `financial.balance.view`    | A read. No value moves, and it is emitted at page-view volume.           |
+| `quote-create.json`    | `financial.quote.create`    | A price is computed. Nothing is owed, paid or transferred.               |
+| `report-generate.json` | `financial.report.generate` | Routine reporting over movements that were already audited individually. |
+
+All three are perfectly good audit events that this profile deliberately does not govern.
+`check-profile` reports them as not applicable and exits with code 3.
+
+They exist to hold the exclusion in place. If a future edit widened a selector to a bare `financial.`
+prefix, these fixtures would start conforming instead of being skipped, and the test would fail —
+which is the point, because that edit would silently impose an authorization decision, an amount, a
+currency, a direction and a correlation identifier on every balance lookup in a retail application.
+
+## Vendor neutrality
+
+No fixture names a real product, company, bank, card scheme, jurisdiction or regulation. Policy names,
+workflow names, currency codes and control categories are illustrative strings, not any
+organization's scheme, and no rule in the profile depends on any of them.
+
+## What the fixtures never contain
+
+Account and instrument references are **opaque**: `account-ref-781`, `counterparty-ref-44`,
+`payment-ref-4412`, `txn-2026-0314-0091`. Not one fixture carries a full account number, a card
+number, an IBAN, a payment credential, a scheme API key, an authentication secret or a counterparty's
+personal data — because a real audit trail must not carry them either, and a fixture is the first
+thing an implementer copies.
+
+Balances appear only inside `change.before` and `change.after` where the operation changed them, and
+then only as the single value that moved. `auditmodel lint-privacy` reports zero findings across all
+twenty-seven fixtures, and a test enforces that.

package/examples/profiles/financial-transaction-management/invalid/limit-update-missing-limit-type.json

@@ -0,0 +1,101 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c90-0041-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-14T19:33:41.205Z",
+  "event": {
+    "name": "financial.limit.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Daily withdrawal ceiling raised for a client account after a documented review."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3391",
+    "tenantId": "tenant-44",
+    "roles": ["treasury-controls-admin"]
+  },
+  "subject": {
+    "type": "user",
+    "id": "user-7712",
+    "tenantId": "tenant-44"
+  },
+  "resource": {
+    "type": "transaction-limit",
+    "id": "limit-ref-55",
+    "name": "daily-withdrawal-ceiling",
+    "ownerId": "user-7712",
+    "tenantId": "tenant-44"
+  },
+  "relatedResources": [
+    {
+      "type": "account",
+      "id": "account-ref-2201"
+    }
+  ],
+  "application": {
+    "name": "treasury-controls",
+    "environment": "production",
+    "version": "9.1.4"
+  },
+  "organization": {
+    "tenantId": "tenant-44",
+    "businessUnitId": "treasury"
+  },
+  "request": {
+    "requestId": "request-7a09b18",
+    "correlationId": "limit-review-5521"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "provider": "corporate-idp",
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "transaction-limit-policy",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "limit-change-review",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-4477"
+      },
+      {
+        "type": "user",
+        "id": "user-4482"
+      }
+    ],
+    "approvedAt": "2026-03-14T19:30:22Z"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["dailyWithdrawalCeiling"],
+    "before": {
+      "dailyWithdrawalCeiling": 25000
+    },
+    "after": {
+      "dailyWithdrawalCeiling": 100000
+    }
+  },
+  "reason": {
+    "code": "documented-client-review",
+    "text": "Client onboarding review supported a higher ceiling for the account.",
+    "reference": "case-88203"
+  },
+  "controlCategories": ["preventive-control-change", "change-approval"],
+  "metadata": {
+    "financial": {
+      "currency": "USD",
+      "approvalRequired": true,
+      "manual": false
+    }
+  }
+}