@openauditmodel/cli 0.4.1 → 0.4.2

package/examples/profiles/api-and-integration-management/valid/webhook-disable.json

@@ -0,0 +1,63 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0006-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-14T21:03:12.664Z",
+  "event": {
+    "name": "webhook.disable",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Webhook subscription disabled while the destination is unreachable."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3390",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "webhook",
+    "id": "webhook-2207",
+    "name": "order-events-partner-feed",
+    "classification": "internal",
+    "ownerId": "team-commerce",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "outbound-integration-policy",
+    "policyVersion": "3"
+  },
+  "request": {
+    "requestId": "request-b31e770",
+    "correlationId": "integration-outage-response-55"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "integration-change-workflow"
+  },
+  "reason": {
+    "code": "destination-unavailable",
+    "text": "Deliveries failed continuously for six hours, so the subscription was paused.",
+    "reference": "incident-5520"
+  },
+  "controlCategories": ["outbound-data-flow", "incident-response"],
+  "metadata": {
+    "integration": {
+      "type": "outbound-webhook",
+      "provider": "partner-logistics-platform",
+      "webhookId": "webhook-2207",
+      "endpointClass": "partner-network",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/api-and-integration-management/valid/webhook-test.json

@@ -0,0 +1,59 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0007-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-15T07:44:02.118Z",
+  "event": {
+    "name": "webhook.test",
+    "category": "configuration",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "low",
+    "summary": "Administrator sent a test callback to verify the destination."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3390",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "webhook",
+    "id": "webhook-2207",
+    "name": "order-events-partner-feed",
+    "classification": "internal",
+    "ownerId": "team-commerce",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "outbound-integration-policy",
+    "policyVersion": "3"
+  },
+  "request": {
+    "requestId": "request-b31e881",
+    "correlationId": "integration-outage-response-55"
+  },
+  "reason": {
+    "code": "connectivity-verification",
+    "text": "Checked the destination before re-enabling the subscription.",
+    "reference": "incident-5520"
+  },
+  "controlCategories": ["outbound-data-flow"],
+  "metadata": {
+    "integration": {
+      "type": "outbound-webhook",
+      "provider": "partner-logistics-platform",
+      "webhookId": "webhook-2207",
+      "endpointClass": "partner-network",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/api-and-integration-management/valid/webhook-update.json

@@ -0,0 +1,76 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2c40-0005-7a2b-9c3d-4e5f60718293",
+  "time": "2026-04-13T10:27:56.311Z",
+  "event": {
+    "name": "webhook.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Webhook retry policy and event selection changed."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-5120",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "webhook",
+    "id": "webhook-2207",
+    "name": "order-events-partner-feed",
+    "classification": "internal",
+    "ownerId": "team-commerce",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "integration-service",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "outbound-integration-policy",
+    "policyVersion": "3"
+  },
+  "request": {
+    "requestId": "request-b31e551",
+    "correlationId": "integration-tuning-908"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "integration-change-workflow"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["retryPolicy", "eventSelection"],
+    "before": {
+      "retryPolicy": "fixed-interval",
+      "eventSelection": ["order-created"]
+    },
+    "after": {
+      "retryPolicy": "exponential-backoff",
+      "eventSelection": ["order-created", "order-cancelled"]
+    },
+    "ticketId": "change-10488"
+  },
+  "reason": {
+    "code": "reliability-tuning",
+    "text": "Partner endpoint throttled bursts, so retries were spread out.",
+    "reference": "change-10488"
+  },
+  "controlCategories": ["outbound-data-flow", "change-approval"],
+  "metadata": {
+    "integration": {
+      "type": "outbound-webhook",
+      "provider": "partner-logistics-platform",
+      "webhookId": "webhook-2207",
+      "endpointClass": "partner-network",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/README.md

@@ -0,0 +1,127 @@
+# Backup and recovery profile fixtures
+
+**Status: Informative.** These fixtures illustrate and regression-test the
+[backup-and-recovery profile](../../../profiles/backup-and-recovery/). The rules themselves are in
+[profile.json](../../../profiles/backup-and-recovery/profile.json).
+
+```bash
+auditmodel check-profile examples/profiles/backup-and-recovery/valid --profile backup-and-recovery
+```
+
+Every fixture here — valid, invalid and not-applicable alike — is a **core-conforming** event. The
+ones under `invalid/` fail the profile, not the core schema. That separation is the point: a profile
+adds requirements to events the core already accepts.
+
+## The guarantee these fixtures carry
+
+Each file under `valid/` must satisfy all three commands, and a test enforces it:
+
+```bash
+auditmodel validate      examples/profiles/backup-and-recovery/valid
+auditmodel lint-privacy  examples/profiles/backup-and-recovery/valid
+auditmodel check-profile examples/profiles/backup-and-recovery/valid --profile backup-and-recovery
+```
+
+A profile that accepted an event the core rejects would break the core invariant. A profile that
+accepted an event carrying a storage credential would be worse than no profile — and backup metadata
+is where storage credentials go to hide.
+
+## Valid fixtures
+
+| File                          | Event                  | Demonstrates                                                        |
+| ----------------------------- | ---------------------- | ------------------------------------------------------------------- |
+| `backup-create.json`          | `backup.create`        | A scheduled run, authorized by the schedule rather than by a person |
+| `backup-complete.json`        | `backup.complete`      | A successful run recording the recovery point it produced           |
+| `backup-complete-failed.json` | `backup.complete`      | A failed run: no recovery point is required, an error is            |
+| `backup-verify.json`          | `backup.verify`        | A restore rehearsal recording its verdict and its evidence          |
+| `backup-delete.json`          | `backup.delete`        | Early disposal with a justification and a declared approval         |
+| `backup-expire.json`          | `backup.expire`        | Retention-driven disposal naming the class that drove it            |
+| `snapshot-create.json`        | `snapshot.create`      | A pre-change safeguard snapshot                                     |
+| `snapshot-delete.json`        | `snapshot.delete`      | Owner disposal of a superseded snapshot, no approval required       |
+| `restore-start.json`          | `restore.start`        | A production restore: source, recovery point, reason and approval   |
+| `restore-complete.json`       | `restore.complete`     | The completion of the same operation, tied by `restoreId`           |
+| `recovery-start.json`         | `recovery.start`       | A declared disaster recovery                                        |
+| `recovery-failover.json`      | `recovery.failover`    | Service moved to a named secondary scope                            |
+| `recovery-failback.json`      | `recovery.failback`    | Service returned to the primary scope, closing the same recovery    |
+| `recovery-complete.json`      | `recovery.complete`    | The recovery closed, tied to every stage by `recoveryId`            |
+| `policy-update.json`          | `backup.policy.update` | Protection reduced, recorded as a `change` with before and after    |
+
+Three of these produce a **warning**, and every one of them is intentional. `backup-create.json` and
+`backup-complete.json` warn under `BACKUP-CORE-002` for a missing `/reason`: a nightly scheduled run
+has no business justification beyond the schedule itself, and the profile recommends rather than
+requires one there. `snapshot-delete.json` warns under `BACKUP-DELETE-001` for a missing `/approval`,
+which is precisely the case that rule's rationale describes — an owner removing a superseded copy of
+their own service's data. A warning never fails conformance.
+
+`backup-complete-failed.json` is the fixture that proves `BACKUP-SET-002` is conditional. It carries
+no `/metadata/backup/recoveryPoint`, because a run that failed produced none, and it conforms. Flip
+its `event.outcome` to `success` and the same event violates `BACKUP-SET-002` — a test does exactly
+that.
+
+`backup-delete.json`, `restore-start.json`, `recovery-failover.json` and `recovery-failback.json` all
+declare `/metadata/backup/approvalRequired: true` and carry an approval. The other two directions of
+the same rule are covered as well: `snapshot-delete.json` declares `approvalRequired: false` and
+carries no approval, and `snapshot-create.json` declares nothing at all. All three cases conform,
+which is how the conditional approval rule is meant to behave — the rule still matches the event, and
+only its condition fails to hold.
+
+## Invalid fixtures
+
+Each removes exactly one profile-required value from a valid fixture, so it fails for one documented
+reason. A test asserts both the rule and the pointer, and that **exactly one** error is produced.
+
+| File                                             | From                     | Violates              | At                                    |
+| ------------------------------------------------ | ------------------------ | --------------------- | ------------------------------------- |
+| `backup-create-missing-authorization.json`       | `backup-create.json`     | `BACKUP-CORE-001`     | `/authorization`                      |
+| `backup-complete-missing-backup-id.json`         | `backup-complete.json`   | `BACKUP-SET-001`      | `/metadata/backup/backupId`           |
+| `backup-complete-missing-recovery-point.json`    | `backup-complete.json`   | `BACKUP-SET-002`      | `/metadata/backup/recoveryPoint`      |
+| `backup-verify-missing-verification-status.json` | `backup-verify.json`     | `BACKUP-VERIFY-001`   | `/metadata/backup/verificationStatus` |
+| `backup-delete-missing-reason.json`              | `backup-delete.json`     | `BACKUP-DELETE-001`   | `/reason`                             |
+| `backup-expire-missing-retention-class.json`     | `backup-expire.json`     | `BACKUP-EXPIRE-001`   | `/metadata/backup/retentionClass`     |
+| `snapshot-create-missing-snapshot-id.json`       | `snapshot-create.json`   | `BACKUP-SNAPSHOT-001` | `/metadata/backup/snapshotId`         |
+| `restore-start-missing-source-id.json`           | `restore-start.json`     | `BACKUP-RESTORE-001`  | `/metadata/backup/sourceId`           |
+| `restore-start-missing-approval.json`            | `restore-start.json`     | `BACKUP-APPROVAL-001` | `/approval`                           |
+| `recovery-failover-missing-recovery-id.json`     | `recovery-failover.json` | `BACKUP-RECOVERY-001` | `/metadata/backup/recoveryId`         |
+| `recovery-failover-missing-target-scope.json`    | `recovery-failover.json` | `BACKUP-FAILOVER-001` | `/metadata/backup/targetScope`        |
+| `policy-update-missing-change.json`              | `policy-update.json`     | `BACKUP-POLICY-001`   | `/change`                             |
+
+There is one invalid fixture for every enforceable rule, and a test fails if a rule with severity
+`error` acquires no negative fixture. A second test holds the positive direction: every event name a
+rule selects is illustrated by a valid fixture, so adding an event to a selector without showing what
+a conforming one looks like fails the suite.
+
+Some of these also produce a **warning**, and that is expected: removing `/reason` warns under
+`BACKUP-CORE-002` as well as failing `BACKUP-DELETE-001`, and removing `/approval` warns under
+`BACKUP-RESTORE-001` as well as failing `BACKUP-APPROVAL-001`. Warnings are not errors, and the
+"exactly one reason" test counts errors.
+
+## Not-applicable fixtures
+
+| File                             | Event                       | Why it is out of scope                                  |
+| -------------------------------- | --------------------------- | ------------------------------------------------------- |
+| `backup-chunk-write.json`        | `backup.chunk.write`        | One of thousands of data-plane writes per run           |
+| `restore-progress.json`          | `restore.progress`          | A percentage-complete heartbeat of an audited operation |
+| `storage-replica-heartbeat.json` | `storage.replica.heartbeat` | Continuous replication telemetry                        |
+
+Each is a perfectly good audit event that this profile deliberately does not govern, and
+`check-profile` reports it as not applicable with exit code 3.
+
+They exist to hold the exclusion in place. Every rule outside the `backup.policy.` family selects
+**exact event names**, so these three match nothing. If a future edit widened a selector to a bare
+`backup.`, `restore.` or `storage.` prefix, these fixtures would start conforming instead of being
+skipped and the test would fail — which is the point, because that edit would silently impose an
+authorization decision and a justification on every chunk write in every backup run.
+
+Note that `backup-chunk-write.json` carries `/metadata/backup/backupId` even though nothing requires
+it. An ungoverned event is not a worse event; the profile simply adds nothing to it.
+
+## Vendor neutrality
+
+No fixture names a real product, company, cloud, filesystem, jurisdiction or regulation. Backup types,
+retention classes, verification verdicts, policy names and scope names are illustrative strings, not
+any organization's scheme. Identifiers are opaque and lower-case (`backup-2026-0314-0200`,
+`region-south-secondary`), never customer names, account numbers or endpoints.
+
+No fixture contains a credential, token, pre-signed URL, storage connection string, encryption key or
+personal identifier, and no fixture uses `/integrity/batchId` — which identifies an integrity sealing
+batch and never a backup set. Tests assert both.

package/examples/profiles/backup-and-recovery/invalid/backup-complete-missing-backup-id.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0002-7c4d-8b1e-2f3a40516202",
+  "time": "2026-03-14T02:41:37.880Z",
+  "event": {
+    "name": "backup.complete",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Nightly full backup of the orders database completed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-schedule-tier-1",
+    "policyVersion": "6"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupType": "full",
+      "recoveryPoint": "2026-03-14T02:00:00Z",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north",
+      "sizeBytes": 48213770,
+      "encryptedAtRest": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/backup-complete-missing-recovery-point.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0002-7c4d-8b1e-2f3a40516202",
+  "time": "2026-03-14T02:41:37.880Z",
+  "event": {
+    "name": "backup.complete",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Nightly full backup of the orders database completed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-schedule-tier-1",
+    "policyVersion": "6"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north",
+      "sizeBytes": 48213770,
+      "encryptedAtRest": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/backup-create-missing-authorization.json

@@ -0,0 +1,50 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0001-7c4d-8b1e-2f3a40516201",
+  "time": "2026-03-14T02:00:04.120Z",
+  "event": {
+    "name": "backup.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Scheduled nightly backup run created for the orders database."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-scheduler",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "businessUnitId": "unit-payments"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north",
+      "scheduleId": "schedule-nightly-orders"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/backup-delete-missing-reason.json

@@ -0,0 +1,78 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0005-7c4d-8b1e-2f3a40516205",
+  "time": "2026-03-16T09:14:30.220Z",
+  "event": {
+    "name": "backup.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Unrestorable backup copy removed ahead of its retention date."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["backup-operator"]
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-disposal-2026-0316"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-administration",
+    "policyVersion": "3",
+    "permissions": ["backup-delete"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-backup-disposal",
+    "requestId": "request-8842",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180"
+      },
+      {
+        "type": "user",
+        "id": "user-2044"
+      }
+    ],
+    "approvedAt": "2026-03-16T09:12:00Z"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0301-0200",
+      "backupType": "incremental",
+      "retentionClass": "operational-35-day",
+      "approvalRequired": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/invalid/backup-expire-missing-retention-class.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0006-7c4d-8b1e-2f3a40516206",
+  "time": "2026-04-18T01:05:09.660Z",
+  "event": {
+    "name": "backup.expire",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Backup copy disposed of after its retention period elapsed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-retention-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "retention-sweep-2026-0418"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-retention",
+    "policyVersion": "6"
+  },
+  "reason": {
+    "code": "retention-elapsed",
+    "text": "Copy reached the end of its operational retention window."
+  },
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "recoveryPoint": "2026-03-14T02:00:00Z"
+    }
+  }
+}