@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/incident-management/valid/rca-approve.json

@@ -0,0 +1,86 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c1a-000a-7a2b-9c3d-4e5f60718310",
+  "time": "2026-03-17T09:30:18.240Z",
+  "event": {
+    "name": "incident.rca.approve",
+    "category": "workflow",
+    "type": "approve",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Root cause analysis approved by the service owner and the problem manager."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["service-owner"],
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "root-cause-analysis",
+    "id": "rca-2026-0418",
+    "name": "checkout-connection-pool-exhaustion",
+    "classification": "internal",
+    "tenantId": "tenant-7"
+  },
+  "relatedResources": [
+    {
+      "type": "incident",
+      "id": "incident-2026-0418"
+    }
+  ],
+  "application": {
+    "name": "incident-service",
+    "environment": "production",
+    "version": "5.2.0"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "root-cause-review",
+    "permissions": ["incident.rca.approve"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-root-cause-review",
+    "requestId": "approval-request-9974",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180",
+        "roles": ["service-owner"]
+      },
+      {
+        "type": "user",
+        "id": "user-2245",
+        "roles": ["problem-manager"]
+      }
+    ],
+    "approvedAt": "2026-03-17T09:30:00Z"
+  },
+  "request": {
+    "requestId": "request-4731",
+    "correlationId": "correlation-incident-2026-0418"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "records/root-cause-analysis/rca-2026-0418"
+    },
+    {
+      "type": "approval",
+      "reference": "workflow-root-cause-review/approval-request-9974"
+    }
+  ],
+  "controlCategories": ["incident-traceability", "change-approval"],
+  "metadata": {
+    "incident": {
+      "status": "approved",
+      "rca": {
+        "method": "five-whys",
+        "completedAt": "2026-03-16T10:00:00Z"
+      }
+    }
+  }
+}

package/examples/profiles/incident-management/valid/rca-create.json

@@ -0,0 +1,73 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c1a-0009-7a2b-9c3d-4e5f60718309",
+  "time": "2026-03-16T10:05:41.660Z",
+  "event": {
+    "name": "incident.rca.create",
+    "category": "workflow",
+    "type": "create",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Root cause analysis recorded for the checkout latency incident."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5140",
+    "roles": ["platform-engineer"],
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "root-cause-analysis",
+    "id": "rca-2026-0418",
+    "name": "checkout-connection-pool-exhaustion",
+    "classification": "internal",
+    "tenantId": "tenant-7"
+  },
+  "relatedResources": [
+    {
+      "type": "incident",
+      "id": "incident-2026-0418"
+    },
+    {
+      "type": "service",
+      "id": "service-checkout"
+    }
+  ],
+  "application": {
+    "name": "incident-service",
+    "environment": "production",
+    "version": "5.2.0"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "incident-handling",
+    "permissions": ["incident.rca.create"]
+  },
+  "request": {
+    "requestId": "request-4702",
+    "correlationId": "correlation-incident-2026-0418"
+  },
+  "reason": {
+    "code": "major-incident-followup",
+    "text": "A root cause analysis is produced for every incident declared major."
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "records/root-cause-analysis/rca-2026-0418",
+      "contentType": "application/pdf",
+      "createdAt": "2026-03-16T10:00:00Z"
+    }
+  ],
+  "controlCategories": ["incident-traceability"],
+  "metadata": {
+    "incident": {
+      "status": "draft",
+      "rca": {
+        "method": "five-whys",
+        "completedAt": "2026-03-16T10:00:00Z",
+        "contributingFactorCount": 3
+      }
+    }
+  }
+}

package/examples/profiles/incident-management/valid/sla-breach.json

@@ -0,0 +1,50 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c1a-000d-7a2b-9c3d-4e5f60718313",
+  "time": "2026-03-14T13:02:10.000Z",
+  "event": {
+    "name": "incident.sla.breach",
+    "category": "workflow",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "The restoration commitment for this incident was missed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-incident-sla-monitor"
+  },
+  "resource": {
+    "type": "incident",
+    "id": "incident-2026-0418",
+    "name": "checkout-latency-degradation",
+    "classification": "internal",
+    "tenantId": "tenant-7"
+  },
+  "relatedResources": [
+    {
+      "type": "service",
+      "id": "service-checkout"
+    }
+  ],
+  "application": {
+    "name": "incident-service",
+    "environment": "production",
+    "version": "5.2.0",
+    "component": "commitment-monitor"
+  },
+  "request": {
+    "correlationId": "correlation-incident-2026-0418"
+  },
+  "controlCategories": ["incident-traceability"],
+  "metadata": {
+    "incident": {
+      "status": "major",
+      "priority": "p1",
+      "sla": {
+        "target": "restore-within-four-hours",
+        "breachedAt": "2026-03-14T13:02:10Z",
+        "elapsedMinutes": 241
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/README.md

@@ -0,0 +1,123 @@
+# Message broker management profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[message-broker-management profile](../../../profiles/message-broker-management/). The rules
+themselves are in [profile.json](../../../profiles/message-broker-management/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/message-broker-management/valid --profile message-broker-management
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/message-broker-management/valid
+auditmodel lint-privacy  examples/profiles/message-broker-management/valid
+auditmodel check-profile examples/profiles/message-broker-management/valid --profile message-broker-management
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile that
+accepted an event carrying a credential — or a message payload — would be worse than no profile.
+
+## Valid fixtures
+
+| File                          | Event                          | Demonstrates                                                    |
+| ----------------------------- | ------------------------------ | --------------------------------------------------------------- |
+| `topic-create.json`           | `broker.topic.create`          | A non-destructive create, classified at the moment it is made   |
+| `topic-retention-reduce.json` | `broker.topic.update`          | A configuration change that discards data, recorded as a change |
+| `topic-delete.json`           | `broker.topic.delete`          | A destructive delete under a declared approval requirement      |
+| `topic-delete-denied.json`    | `broker.topic.delete`          | The same operation refused by policy, with a classified failure |
+| `queue-purge.json`            | `broker.queue.purge`           | A work-queue purge, with a count rather than the messages       |
+| `acl-grant.json`              | `broker.acl.grant`             | Broker access control naming its subject and permission         |
+| `quota-update.json`           | `broker.quota.update`          | A quota change naming the dimension it limits                   |
+| `configuration-update.json`   | `broker.configuration.update`  | A cluster-scoped change made by a reconciliation service        |
+| `consumer-group-delete.json`  | `broker.consumer-group.delete` | Consumer-group administration, selected by exact name           |
+| `cluster-upgrade.json`        | `broker.cluster.upgrade`       | A cluster operation where no containing resource exists         |
+| `offset-reset.json`           | `broker.offset.reset`          | Both consumer positions, recorded as opaque strings             |
+| `message-replay.json`         | `broker.message.replay`        | A replay recording scope and count, never message content       |
+
+Four of these produce a `BROKER-CORE-002` or `BROKER-RISK-002` **warning**. That is intentional and
+worth reading:
+
+- `cluster-upgrade.json` and `configuration-update.json` warn on `/resource/parentId`, because a
+  cluster has no containing resource. The profile recommends the field rather than requiring it for
+  exactly this reason.
+- `configuration-update.json` also warns on `/authentication`, because it was produced by a
+  reconciliation service with no interactive session — the case the rule is written to tolerate.
+- `consumer-group-delete.json` and `topic-delete-denied.json` warn on `/approval`, because a
+  destructive operation without a second signature should raise a question rather than fail a build.
+
+A warning never fails conformance.
+
+Three brokers appear across the fixtures — a log-structured event platform, a work-queue broker with
+virtual hosts, and a cluster administered by tooling rather than a person — so the requirements are
+exercised against more than one deployment shape.
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                          | Violates               | At                                       |
+| --------------------------------------------- | ---------------------- | ---------------------------------------- |
+| `topic-create-missing-authorization.json`     | `BROKER-CORE-001`      | `/authorization`                         |
+| `topic-create-missing-cluster.json`           | `BROKER-CORE-001`      | `/metadata/broker/clusterId`             |
+| `queue-purge-missing-destructive-flag.json`   | `BROKER-RISK-001`      | `/metadata/broker/operation/destructive` |
+| `queue-purge-missing-reason.json`             | `BROKER-RISK-002`      | `/reason`                                |
+| `topic-delete-missing-approval.json`          | `BROKER-RISK-003`      | `/approval`                              |
+| `topic-delete-denied-missing-error-type.json` | `BROKER-FAIL-001`      | `/event/error/type`                      |
+| `topic-create-missing-classification.json`    | `BROKER-LIFECYCLE-001` | `/resource/classification`               |
+| `configuration-update-missing-change.json`    | `BROKER-CHANGE-001`    | `/change`                                |
+| `acl-grant-missing-principal.json`            | `BROKER-ACL-001`       | `/subject`                               |
+| `quota-update-missing-dimension.json`         | `BROKER-QUOTA-001`     | `/metadata/broker/quota/dimension`       |
+| `offset-reset-missing-target.json`            | `BROKER-OFFSET-001`    | `/metadata/broker/offset/target`         |
+| `message-replay-missing-scope.json`           | `BROKER-REPLAY-001`    | `/metadata/broker/replay/scope`          |
+
+`queue-purge-missing-destructive-flag.json` is the subtle one. Removing the flag does not merely fail
+`BROKER-RISK-001`: it also silences `BROKER-RISK-002`, because a condition whose path is absent does
+not hold. That is precisely why the flag is required unconditionally, and the fixture records the
+behaviour.
+
+## Not-applicable fixtures
+
+| File                            | Event                             | Why it is not governed              |
+| ------------------------------- | --------------------------------- | ----------------------------------- |
+| `message-publish.json`          | `broker.message.publish`          | Ordinary data plane                 |
+| `message-consume.json`          | `broker.message.consume`          | Ordinary data plane                 |
+| `consumer-group-rebalance.json` | `broker.consumer-group.rebalance` | Emitted by the broker, not a person |
+
+All three are perfectly good audit events that this profile deliberately does not govern.
+`check-profile` reports them as not applicable and exits with code `3`.
+
+They exist to hold the exclusions in place. If a future edit widened a selector to a bare `broker.`,
+`broker.message.` or `broker.consumer-group.` prefix, these fixtures would start conforming instead
+of being skipped, and the test would fail — which is the point, because that edit would impose an
+authorization decision, a justification and a destructiveness declaration on every message a broker
+carries.
+
+**Not applicable is not conformance.** It means the profile said nothing about the event.
+
+## Vendor neutrality
+
+No **event name**, cluster identifier, topic name, queue name, quota dimension, reset strategy or
+replay scope in these fixtures names a real product, company, customer, jurisdiction or regulation.
+They are illustrative lower-case tokens, not any organization's published vocabulary.
+
+Two fixture values **do** name real broker implementations: `/metadata/broker/system` carries `kafka`
+or `rabbitmq`. That is deliberate and is the one place the profile permits it — the field exists to
+record which broker an operation was performed against, it is optional metadata rather than a
+required vocabulary, and a producer running any other broker records its own token there. No rule
+enumerates broker systems, and no requirement depends on the value.
+
+## Payloads
+
+No fixture contains a message. The purge records a count, the replay records a scope and a count, and
+the offset reset records two positions. That is deliberate: this is the domain where payload capture
+is easiest and most damaging, and a fixture set that leaked one would teach the wrong lesson far more
+effectively than the specification text could correct it.

package/examples/profiles/message-broker-management/invalid/acl-grant-missing-principal.json

@@ -0,0 +1,78 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0039-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T13:02:19.330Z",
+  "event": {
+    "name": "broker.acl.grant",
+    "category": "data-infrastructure",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Write access to the orders topic granted to the fulfilment service account."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-4188",
+    "roles": ["streaming-administrator"]
+  },
+  "resource": {
+    "type": "topic",
+    "id": "topic-orders-events",
+    "name": "orders-events",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal",
+    "ownerId": "team-orders-platform"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-access-control",
+    "permissions": ["acl.write"]
+  },
+  "request": {
+    "requestId": "request-6f0b94",
+    "correlationId": "correlation-broker-access-3305"
+  },
+  "change": {
+    "type": "create",
+    "changedFields": ["acl.write"],
+    "after": {
+      "principalId": "service-account-fulfilment-worker",
+      "permission": "write",
+      "effect": "allow"
+    },
+    "ticketId": "change-8261"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "Fulfilment worker now publishes order state transitions.",
+    "reference": "change-8261"
+  },
+  "controlCategories": ["privileged-access", "access-provisioning"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": false
+      },
+      "acl": {
+        "permission": "write",
+        "effect": "allow",
+        "resourcePattern": "literal"
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/configuration-update-missing-change.json

@@ -0,0 +1,58 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0038-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T15:09:52.470Z",
+  "event": {
+    "name": "broker.configuration.update",
+    "category": "data-infrastructure",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Cluster default retention lowered and automatic topic creation disabled."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-account-platform-reconciler"
+  },
+  "resource": {
+    "type": "cluster",
+    "id": "cluster-streaming-production",
+    "name": "streaming-production",
+    "classification": "internal",
+    "ownerId": "team-streaming-platform"
+  },
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["cluster.configure"]
+  },
+  "request": {
+    "requestId": "request-6f0bb5",
+    "correlationId": "correlation-broker-baseline-1904"
+  },
+  "reason": {
+    "code": "baseline-enforcement",
+    "text": "Cluster reconciled to the approved platform baseline."
+  },
+  "controlCategories": ["configuration-baseline", "privileged-access"],
+  "tags": ["production", "control-plane"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "operation": {
+        "destructive": false
+      },
+      "configuration": {
+        "scope": "cluster-wide"
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/message-replay-missing-scope.json

@@ -0,0 +1,76 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0042-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T17:31:14.900Z",
+  "event": {
+    "name": "broker.message.replay",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Dead-letter messages redelivered to the fulfilment queue after the consumer defect was fixed."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["messaging-operator"]
+  },
+  "resource": {
+    "type": "queue",
+    "id": "queue-fulfilment-dead-letter",
+    "name": "fulfilment-dead-letter",
+    "parentId": "vhost-order-processing",
+    "classification": "internal",
+    "ownerId": "team-fulfilment"
+  },
+  "relatedResources": [
+    {
+      "type": "queue",
+      "id": "queue-fulfilment-orders",
+      "parentId": "vhost-order-processing",
+      "classification": "internal"
+    },
+    { "type": "cluster", "id": "cluster-messaging-production" }
+  ],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "broker-administration",
+    "permissions": ["queue.replay"]
+  },
+  "request": {
+    "requestId": "request-6f0bd9",
+    "correlationId": "correlation-incident-2026-0431"
+  },
+  "reason": {
+    "code": "incident-recovery",
+    "text": "Messages redelivered after the consumer deserialization defect was corrected.",
+    "reference": "incident-2026-0431"
+  },
+  "controlCategories": ["privileged-access", "incident-traceability"],
+  "tags": ["production", "incident-response"],
+  "metadata": {
+    "broker": {
+      "system": "rabbitmq",
+      "clusterId": "cluster-messaging-production",
+      "operation": {
+        "destructive": false
+      },
+      "replay": {
+        "messageCount": 1842,
+        "targetResourceId": "queue-fulfilment-orders"
+      }
+    }
+  }
+}

package/examples/profiles/message-broker-management/invalid/offset-reset-missing-target.json

@@ -0,0 +1,96 @@
+{
+  "specVersion": "0.1",
+  "id": "018f1c40-0041-7a2b-9c3d-4e5f60718293",
+  "time": "2026-03-17T16:44:26.180Z",
+  "observedTime": "2026-03-17T16:44:27.014Z",
+  "sequence": 4,
+  "event": {
+    "name": "broker.offset.reset",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Consumer group positions rewound so that blocked settlement messages could be reprocessed."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6612",
+    "roles": ["streaming-operator"]
+  },
+  "resource": {
+    "type": "consumer-group",
+    "id": "consumer-group-payments-settlement",
+    "name": "payments-settlement",
+    "parentId": "cluster-streaming-production",
+    "classification": "internal",
+    "ownerId": "team-payments-platform"
+  },
+  "relatedResources": [
+    {
+      "type": "topic",
+      "id": "topic-payments-settlement-completed",
+      "parentId": "cluster-streaming-production",
+      "classification": "confidential"
+    },
+    { "type": "cluster", "id": "cluster-streaming-production" }
+  ],
+  "application": {
+    "name": "broker-control-service",
+    "environment": "production",
+    "version": "3.4.1",
+    "region": "region-1"
+  },
+  "authentication": {
+    "method": "oidc",
+    "provider": "corporate-idp",
+    "mfa": true
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "streaming-privileged-operation",
+    "permissions": ["consumer-group.offset.reset"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-incident-change",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvers": [{ "type": "user", "id": "user-1180", "roles": ["incident-commander"] }],
+    "approvedAt": "2026-03-17T16:39:12Z"
+  },
+  "request": {
+    "requestId": "request-6f0bc7",
+    "correlationId": "correlation-incident-2026-0431"
+  },
+  "change": {
+    "type": "execute",
+    "changedFields": ["offset"],
+    "before": { "offset": "918273645" },
+    "after": { "offset": "918200000" },
+    "ticketId": "change-8123",
+    "incidentId": "incident-2026-0431"
+  },
+  "reason": {
+    "code": "incident-recovery",
+    "text": "Reprocessing required after an unprocessable message blocked the settlement consumers.",
+    "reference": "incident-2026-0431"
+  },
+  "controlCategories": ["privileged-access", "change-approval", "incident-traceability"],
+  "tags": ["production", "incident-response"],
+  "metadata": {
+    "broker": {
+      "system": "kafka",
+      "clusterId": "cluster-streaming-production",
+      "approvalRequired": true,
+      "operation": {
+        "destructive": true
+      },
+      "offset": {
+        "previous": "918273645",
+        "strategy": "to-offset",
+        "partition": 7
+      }
+    }
+  }
+}