@openauditmodel/cli 0.4.1 → 0.4.2

package/examples/integrity/invalid/reordered-chain/001.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556601",
+  "time": "2026-04-03T08:00:12.500Z",
+  "sequence": 1,
+  "event": {
+    "name": "privileged.access.grant",
+    "category": "privileged-operation",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator access granted for a change window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["access-approver"]
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-03T07:58:40Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "grantedRole": "platform-administrator",
+    "expiresAt": "2026-04-03T10:00:00Z"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/reordered-chain/002.json

@@ -0,0 +1,52 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556602",
+  "time": "2026-04-03T08:14:31.882Z",
+  "sequence": 3,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced under the approved change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes"],
+    "before": {
+      "sessionLifetimeMinutes": 720
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/reordered-chain/003.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556603",
+  "time": "2026-04-03T09:47:02.310Z",
+  "sequence": 2,
+  "event": {
+    "name": "privileged.access.revoke",
+    "category": "privileged-operation",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Time-bound platform administrator access revoked after the change window."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-access-expiry"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "reason": {
+    "code": "grant-expired",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "a7da7bab810f1386942e86d11b3277cbe56a5cc71f6bdc01da0eded57c829c00",
+    "previousHash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/invalid/tampered-event.json

@@ -0,0 +1,51 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-4c21-7b83-9e05-1d2f3a4b5c60",
+  "time": "2026-04-02T13:20:44.117Z",
+  "sequence": 1,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Audit retention period extended on the production configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-audit-retention",
+    "classification": "internal"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.1.0",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retentionDays"],
+    "before": {
+      "retentionDays": 365
+    },
+    "after": {
+      "retentionDays": 2555
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "03638029fc5fa4b1b043b762ab6c59b21ab8a60328a7a9956dcb8ccd9aac4e93"
+  }
+}

package/examples/integrity/invalid/tampered-signed-event.json

@@ -0,0 +1,46 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a45-9d31-7e42-8b17-2c3d4e5f6a71",
+  "time": "2026-04-05T16:42:08.900Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Database credential rotated ahead of schedule after a suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-db-primary",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "reason": {
+    "code": "suspected-exposure"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "bc9808880ddcc485638beec9b17c7996c4640c4627f9a78c9586f2065a8b8065",
+    "signature": {
+      "algorithm": "Ed25519",
+      "value": "BLfdwtWE2r1YaIwE3tQOSQ3UkEm2Az0MMLaK60uWU/VZb/kMyCSxZGrbTNJTl/9G6qUqQSGtaLDNobR3PH9xBg==",
+      "keyId": "example-fixture-key-2026"
+    }
+  }
+}

package/examples/integrity/invalid/unsupported-algorithm.json

@@ -0,0 +1,51 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-4c21-7b83-9e05-1d2f3a4b5c60",
+  "time": "2026-04-02T13:20:44.117Z",
+  "sequence": 1,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Audit retention period extended on the production configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-audit-retention",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.1.0",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retentionDays"],
+    "before": {
+      "retentionDays": 365
+    },
+    "after": {
+      "retentionDays": 2555
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "BLAKE3",
+    "hash": "03638029fc5fa4b1b043b762ab6c59b21ab8a60328a7a9956dcb8ccd9aac4e93"
+  }
+}

package/examples/integrity/invalid/unsupported-signature-algorithm.json

@@ -0,0 +1,46 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a45-9d31-7e42-8b17-2c3d4e5f6a71",
+  "time": "2026-04-05T16:42:08.900Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Database credential rotated ahead of schedule after a suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-db-primary",
+    "classification": "secret"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "reason": {
+    "code": "suspected-exposure"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "bc9808880ddcc485638beec9b17c7996c4640c4627f9a78c9586f2065a8b8065",
+    "signature": {
+      "algorithm": "ECDSA-P256-SHA256",
+      "value": "BLfdwtWE2r1YaIwE3tQOSQ3UkEm2Az0MMLaK60uWU/VZb/kMyCSxZGrbTNJTl/9G6qUqQSGtaLDNobR3PH9xBg==",
+      "keyId": "example-fixture-key-2026"
+    }
+  }
+}

package/examples/integrity/invalid/wrong-declared-hash.json

@@ -0,0 +1,51 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-4c21-7b83-9e05-1d2f3a4b5c60",
+  "time": "2026-04-02T13:20:44.117Z",
+  "sequence": 1,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Audit retention period extended on the production configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-audit-retention",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.1.0",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retentionDays"],
+    "before": {
+      "retentionDays": 365
+    },
+    "after": {
+      "retentionDays": 2555
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "5447ade98a9f6ff64bd26591055c29e49adae89160425a02531dd3b3df26dc11"
+  }
+}

package/examples/integrity/keys/ed25519-test-public.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAkb7Bleqo+EYvJ2QYmWKh38+AmntzJMwdzMTFaf5hqyI=
+-----END PUBLIC KEY-----

package/examples/integrity/valid/signed-event-ed25519.json

@@ -0,0 +1,46 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a45-9d31-7e42-8b17-2c3d4e5f6a71",
+  "time": "2026-04-05T16:42:08.900Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Database credential rotated ahead of schedule after a suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-db-primary",
+    "classification": "secret"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "reason": {
+    "code": "suspected-exposure"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "bc9808880ddcc485638beec9b17c7996c4640c4627f9a78c9586f2065a8b8065",
+    "signature": {
+      "algorithm": "Ed25519",
+      "value": "BLfdwtWE2r1YaIwE3tQOSQ3UkEm2Az0MMLaK60uWU/VZb/kMyCSxZGrbTNJTl/9G6qUqQSGtaLDNobR3PH9xBg==",
+      "keyId": "example-fixture-key-2026"
+    }
+  }
+}

package/examples/integrity/valid/single-event-sha256.json

@@ -0,0 +1,51 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-4c21-7b83-9e05-1d2f3a4b5c60",
+  "time": "2026-04-02T13:20:44.117Z",
+  "sequence": 1,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Audit retention period extended on the production configuration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-audit-retention",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "version": "9.1.0",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retentionDays"],
+    "before": {
+      "retentionDays": 365
+    },
+    "after": {
+      "retentionDays": 2555
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "03638029fc5fa4b1b043b762ab6c59b21ab8a60328a7a9956dcb8ccd9aac4e93"
+  }
+}

package/examples/integrity/valid/three-event-chain/001.json

@@ -0,0 +1,53 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556601",
+  "time": "2026-04-03T08:00:12.500Z",
+  "sequence": 1,
+  "event": {
+    "name": "privileged.access.grant",
+    "category": "privileged-operation",
+    "type": "grant",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Time-bound platform administrator access granted for a change window."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-1180",
+    "roles": ["access-approver"]
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "approval": {
+    "status": "approved",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-03T07:58:40Z"
+  },
+  "reason": {
+    "code": "scheduled-maintenance",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access", "change-approval"],
+  "metadata": {
+    "grantedRole": "platform-administrator",
+    "expiresAt": "2026-04-03T10:00:00Z"
+  },
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/valid/three-event-chain/002.json

@@ -0,0 +1,52 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556602",
+  "time": "2026-04-03T08:14:31.882Z",
+  "sequence": 2,
+  "event": {
+    "name": "configuration.setting.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Session lifetime reduced under the approved change window."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "admin-0091",
+    "roles": ["platform-administrator"]
+  },
+  "resource": {
+    "type": "configuration",
+    "id": "configuration-authentication-session",
+    "classification": "restricted"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "privileged-configuration-change"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["sessionLifetimeMinutes"],
+    "before": {
+      "sessionLifetimeMinutes": 720
+    },
+    "after": {
+      "sessionLifetimeMinutes": 60
+    },
+    "ticketId": "change-10241"
+  },
+  "controlCategories": ["configuration-integrity", "privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "previousHash": "3e9462f941036e9b676694cf80fcf17bb438ddff9fb4fb6f67220eca3399ba1b",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}

package/examples/integrity/valid/three-event-chain/003.json

@@ -0,0 +1,43 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a30-1111-7222-8333-444455556603",
+  "time": "2026-04-03T09:47:02.310Z",
+  "sequence": 3,
+  "event": {
+    "name": "privileged.access.revoke",
+    "category": "privileged-operation",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Time-bound platform administrator access revoked after the change window."
+  },
+  "actor": {
+    "type": "system",
+    "id": "system-access-expiry"
+  },
+  "resource": {
+    "type": "user",
+    "id": "admin-0091"
+  },
+  "application": {
+    "name": "platform-control-service",
+    "environment": "production",
+    "instance": "instance-7c1a"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "just-in-time-access"
+  },
+  "reason": {
+    "code": "grant-expired",
+    "reference": "change-10241"
+  },
+  "controlCategories": ["privileged-access"],
+  "integrity": {
+    "canonicalization": "RFC8785",
+    "hashAlgorithm": "SHA-256",
+    "hash": "a7da7bab810f1386942e86d11b3277cbe56a5cc71f6bdc01da0eded57c829c00",
+    "previousHash": "f7fbea247bdde9c24f07d81cb6ba82b60372f293b2d618066b065bac880dcbf1",
+    "chainId": "chain-platform-control-service-instance-7c1a"
+  }
+}