platformforge 0.1.0__py3-none-any.whl

platformforge/data/knowledge/sources.yaml

@@ -0,0 +1,516 @@
+# Source registry — Platform Forge knowledge base.
+# Every version-dependent claim must cite one of these entries (by `id`).
+# Freshness status is computed by `platformforge/knowledge` (see KNOWLEDGE.md):
+#   current | fresh | stale | deprecated | superseded | conflicted | unresolved
+# `retrieved_at` is UTC date of last human/agent verification against the source.
+
+schema: platformforge/source-registry/v1
+sources:
+  - id: cncf-maturity-model
+    product: CNCF Platform Engineering Maturity Model
+    source: https://tag-app-delivery.cncf.io/whitepapers/platform-eng-maturity-model/
+    source_authority: official
+    repo: https://github.com/cncf/tag-app-delivery/tree/main/platforms-maturity-model/v1
+    version: "1.0"
+    released: 2023-11-20
+    retrieved_at: 2026-10-06
+    scope: platform-maturity
+    confidence: high
+    notes: 5 aspects (investment, adoption, interfaces, operations, measurement) x
+      4 levels (provisional, operational, scalable, optimizing). Platform Forge
+      implements its own assessment inspired by this model, not a literal copy.
+
+  - id: dora-platforms
+    product: DORA platform engineering capabilities
+    source: https://dora.dev/capabilities/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: platform-engineering
+    confidence: high
+
+  - id: kubernetes-docs
+    product: Kubernetes
+    source: https://kubernetes.io/docs/
+    source_authority: official
+    releases_tracked: ["1.34", "1.33", "1.32", "1.31"]
+    retrieved_at: 2026-10-06
+    scope: kubernetes
+    confidence: high
+    notes: Rule catalog entries MUST declare applicable versions; deprecated-API
+      rules key off the deprecation guide.
+
+  - id: gateway-api
+    product: Kubernetes Gateway API
+    source: https://gateway-api.sigs.k8s.io/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: kubernetes-networking
+    confidence: high
+
+  - id: cncf-landscape
+    product: CNCF Landscape
+    source: https://landscape.cncf.io/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: ecosystem-map
+    confidence: high
+
+  - id: backstage-docs
+    product: Backstage
+    source: https://backstage.io/docs/overview/what-is-backstage
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: developer-portal
+    confidence: high
+    notes: Backstage is adapter/projection, never the canonical store.
+
+  - id: crossplane-docs
+    product: Crossplane
+    source: https://docs.crossplane.io/
+    source_authority: official
+    releases_tracked: ["2.x", "1.x"]
+    retrieved_at: 2026-10-06
+    scope: control-plane
+    confidence: high
+    notes: v2 changed XR/claim model vs v1 (namespaced XRs, no default claim) —
+      rules must be version-gated.
+
+  - id: terraform-docs
+    product: Terraform
+    source: https://developer.hashicorp.com/terraform/docs
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: iac
+    confidence: high
+
+  - id: opentofu-docs
+    product: OpenTofu
+    source: https://opentofu.org/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: iac
+    confidence: high
+    notes: Track divergence from Terraform (state encryption, removed blocks,
+      provider-driven functions in 1.9+).
+
+  - id: pulumi-docs
+    product: Pulumi
+    source: https://www.pulumi.com/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: iac
+    confidence: medium
+
+  - id: aws-docs
+    product: Amazon Web Services
+    source: https://docs.aws.amazon.com/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws
+    confidence: high
+
+  - id: aws-iam-docs
+    product: AWS Identity and Access Management
+    source: https://docs.aws.amazon.com/IAM/latest/UserGuide/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws-iam
+    confidence: high
+
+  - id: aws-vpc-docs
+    product: Amazon Virtual Private Cloud
+    source: https://docs.aws.amazon.com/vpc/latest/userguide/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws-networking
+    confidence: high
+
+  - id: aws-s3-docs
+    product: Amazon S3
+    source: https://docs.aws.amazon.com/AmazonS3/latest/userguide/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws-storage
+    confidence: high
+
+  - id: aws-eks-docs
+    product: Amazon Elastic Kubernetes Service
+    source: https://docs.aws.amazon.com/eks/latest/userguide/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws-kubernetes
+    confidence: high
+
+  - id: aws-organizations-docs
+    product: AWS Organizations
+    source: https://docs.aws.amazon.com/organizations/latest/userguide/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-aws-governance
+    confidence: high
+
+  - id: azure-docs
+    product: Microsoft Azure
+    source: https://learn.microsoft.com/azure/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-azure
+    confidence: high
+
+  - id: gcp-docs
+    product: Google Cloud
+    source: https://cloud.google.com/docs
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cloud-gcp
+    confidence: high
+
+  - id: argocd-docs
+    product: Argo CD
+    source: https://argo-cd.readthedocs.io/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: gitops
+    confidence: high
+
+  - id: argo-rollouts-docs
+    product: Argo Rollouts
+    source: https://argoproj.github.io/argo-rollouts/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: progressive-delivery
+    confidence: high
+
+  - id: flux-docs
+    product: Flux
+    source: https://fluxcd.io/flux/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: gitops
+    confidence: high
+
+  - id: helm-docs
+    product: Helm
+    source: https://helm.sh/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: packaging
+    confidence: high
+
+  - id: kustomize-docs
+    product: Kustomize
+    source: https://kubectl.docs.kubernetes.io/guides/introduction/kustomize/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: packaging
+    confidence: high
+
+  - id: opentelemetry-docs
+    product: OpenTelemetry
+    source: https://opentelemetry.io/docs/
+    source_authority: official
+    semconv: https://opentelemetry.io/docs/specs/semconv/
+    retrieved_at: 2026-10-06
+    scope: observability
+    confidence: high
+
+  - id: prometheus-docs
+    product: Prometheus
+    source: https://prometheus.io/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: observability
+    confidence: high
+
+  - id: grafana-docs
+    product: Grafana
+    source: https://grafana.com/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: observability
+    confidence: high
+
+  - id: cilium-docs
+    product: Cilium / Hubble
+    source: https://docs.cilium.io/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: kubernetes-networking
+    confidence: high
+
+  - id: istio-docs
+    product: Istio
+    source: https://istio.io/latest/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: service-mesh
+    confidence: high
+
+  - id: linkerd-docs
+    product: Linkerd
+    source: https://linkerd.io/2/overview/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: service-mesh
+    confidence: high
+
+  - id: keda-docs
+    product: KEDA
+    source: https://keda.sh/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: autoscaling
+    confidence: high
+
+  - id: karpenter-docs
+    product: Karpenter
+    source: https://karpenter.sh/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: autoscaling
+    confidence: high
+    notes: v1 API (stable 2024-08) replaced v1beta1 NodePool — version-gate rules.
+
+  - id: kyverno-docs
+    product: Kyverno
+    source: https://kyverno.io/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: policy-as-code
+    confidence: high
+    notes: Modern Kyverno adds CEL-based policy types (ValidatingPolicy etc.) —
+      rules must distinguish legacy ClusterPolicy from CEL types.
+
+  - id: opa-docs
+    product: OPA / Gatekeeper
+    source: https://www.openpolicyagent.org/docs/ + https://open-policy-agent.github.io/gatekeeper/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: policy-as-code
+    confidence: high
+
+  - id: trivy-docs
+    product: Trivy
+    source: https://trivy.dev/latest/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: security-scanning
+    confidence: high
+
+  - id: checkov-docs
+    product: Checkov
+    source: https://www.checkov.io/1.Welcome/Quick%20Start.html
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: iac-security
+    confidence: high
+
+  - id: sigstore-docs
+    product: Sigstore / Cosign
+    source: https://docs.sigstore.dev/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: supply-chain
+    confidence: high
+
+  - id: slsa-spec
+    product: SLSA
+    source: https://slsa.dev/spec/v1.2/
+    source_authority: official
+    version: "1.2"
+    retrieved_at: 2026-10-06
+    scope: supply-chain
+    confidence: high
+    notes: v1.2 adds Source Track beside Build Track. Source L1 versioned, L2
+      history+provenance, L3 continuous controls, L4 two-party review. Never claim
+      a level without evidence.
+
+  - id: in-toto-spec
+    product: in-toto
+    source: https://in-toto.io/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: supply-chain
+    confidence: high
+
+  - id: spdx-spec
+    product: SPDX
+    source: https://spdx.github.io/spdx-spec/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: sbom
+    confidence: high
+
+  - id: cyclonedx-spec
+    product: CycloneDX
+    source: https://cyclonedx.org/specification/overview/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: sbom
+    confidence: high
+
+  - id: finops-framework
+    product: FinOps Framework
+    source: https://www.finops.org/framework/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: finops
+    confidence: high
+
+  - id: focus-spec
+    product: FOCUS (FinOps Open Cost and Usage Specification)
+    source: https://focus.finops.org/focus-specification/
+    source_authority: official
+    version: "1.4"
+    releases_tracked: ["1.4", "1.2"]
+    retrieved_at: 2026-10-06
+    scope: finops-billing
+    confidence: high
+    notes: v1.2 (2025-05-29) added SaaS/virtual-currency columns; v1.4 is the
+      latest listed release. Normalizer targets the declared version column set.
+
+  - id: opencost-docs
+    product: OpenCost
+    source: https://opencost.io/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: k8s-cost
+    confidence: high
+
+  - id: kubecost-docs
+    product: Kubecost
+    source: https://www.ibm.com/docs/en/kubecost (was kubecost.io)
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: k8s-cost
+    confidence: medium
+    notes: Kubecost docs moved under IBM after the Apptio/IBM acquisition; verify
+      URLs before citing in user-facing output.
+
+  - id: github-actions-docs
+    product: GitHub Actions
+    source: https://docs.github.com/en/actions
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cicd
+    confidence: high
+
+  - id: github-security-docs
+    product: GitHub code security
+    source: https://docs.github.com/en/code-security
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cicd-security
+    confidence: high
+
+  - id: github-securitylab
+    product: GitHub Security Lab
+    source: https://securitylab.github.com/
+    source_authority: vendor-research
+    retrieved_at: 2026-10-06
+    scope: cicd-security
+    confidence: medium
+    notes: Research write-ups (pwn requests, workflow injection) — cite as
+      secondary evidence next to github-actions-docs, never alone for a
+      normative claim.
+
+  - id: gitlab-ci-docs
+    product: GitLab CI
+    source: https://docs.gitlab.com/ee/ci/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cicd
+    confidence: high
+
+  - id: jenkins-docs
+    product: Jenkins
+    source: https://www.jenkins.io/doc/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cicd
+    confidence: medium
+
+  - id: tekton-docs
+    product: Tekton
+    source: https://tekton.dev/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: cicd
+    confidence: high
+
+  - id: vault-docs
+    product: HashiCorp Vault
+    source: https://developer.hashicorp.com/vault/docs
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: secrets
+    confidence: high
+    notes: Vault is BUSL-licensed since 1.1.x line; OpenBao is the fork — track
+      both when advising.
+
+  - id: eso-docs
+    product: External Secrets Operator
+    source: https://external-secrets.io/latest/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: secrets
+    confidence: high
+
+  - id: cert-manager-docs
+    product: cert-manager
+    source: https://cert-manager.io/docs/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: certificates
+    confidence: high
+
+  - id: spark-forge-aws
+    product: spark-forge-aws (sibling Forge)
+    source: https://github.com/EdgarSocrates98/spark-forge-aws
+    source_authority: first-party-sibling
+    retrieved_at: 2026-10-06
+    scope: forge-conventions
+    confidence: high
+    license: MIT
+
+  - id: api-forge
+    product: api-forge (sibling Forge)
+    source: https://github.com/EdgarSocrates98/api-forge
+    source_authority: first-party-sibling
+    retrieved_at: 2026-10-06
+    scope: forge-conventions
+    confidence: high
+    license: MIT
+
+  - id: google-sre-book
+    product: Google SRE Book / Workbook
+    source: https://sre.google/sre-book/table-of-contents/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: sre
+    confidence: high
+    notes: SLO/error-budget/burn-rate rules (PF-SLO-*, PF-SRE-*) cite chapters.
+
+  - id: nvd
+    product: NIST National Vulnerability Database
+    source: https://nvd.nist.gov/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: vulnerabilities
+    confidence: high
+
+  - id: osv
+    product: OSV.dev vulnerability database
+    source: https://osv.dev/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: vulnerabilities
+    confidence: high
+
+  - id: spdx-licenses
+    product: SPDX License List
+    source: https://spdx.dev/licenses/
+    source_authority: official
+    retrieved_at: 2026-10-06
+    scope: licenses
+    confidence: high

platformforge/data/knowledge/terraform/lifecycle.yaml

@@ -0,0 +1,18 @@
+schema: platformforge/knowledge/v1
+id: terraform-lifecycle
+domain: terraform
+applies_to: {}
+sources: [terraform-docs]
+claims:
+  - id: tf-lifecycle-prevent-destroy
+    statement: "prevent_destroy only guards the destroy inside plan/apply;
+      removing the block or the resource from config still destroys it."
+    versions: {}
+  - id: tf-create-before-destroy
+    statement: "create_before_destroy inverts replace order — required for
+      resources that must exist continuously, but doubles transient
+      capacity and can violate unique constraints."
+    versions: {}
+used_by:
+  rules: [PF-IAC-010, PF-IAC-011]
+  analyzers: [plan, iac]

platformforge/data/knowledge/terraform/plan-semantics.yaml

@@ -0,0 +1,26 @@
+schema: platformforge/knowledge/v1
+id: terraform-plan-semantics
+domain: terraform
+applies_to: {}
+sources: [terraform-docs]
+claims:
+  - id: tf-plan-actions
+    statement: "Plan actions are no-op, create, read, update, delete,
+      delete_then_create and create_then_delete (replace). A replace means
+      the resource is destroyed — irreversible for stateful resources
+      unless deposed/prevented."
+    versions: {}
+  - id: tf-plan-is-declared
+    statement: "A plan file is declared intent, not observed state — it
+      proves what apply would do, not what the cloud looks like. Drift
+      between state and real infrastructure is invisible without a
+      refresh or an observed dump."
+    versions: {}
+  - id: tf-module-pin
+    statement: "A module source without a version/ref constraint resolves
+      to whatever the registry or branch serves at init — builds are not
+      reproducible and upgrades are silent."
+    versions: {}
+used_by:
+  rules: [PF-IAC-010, PF-IAC-011, PF-IAC-020]
+  analyzers: [plan, state, iac]

platformforge/data/lab/chaos-pod-kill/chaos.yaml

@@ -0,0 +1,3 @@
+fault: pod_kill
+target: workload/prod/api
+facts: facts.json

platformforge/data/lab/chaos-pod-kill/facts.json

@@ -0,0 +1,13 @@
+{"facts": [
+ {"fact_id": "PF-TST-1", "kind": "k8s.workload", "source": "fixture",
+  "location": "deploy.yaml", "tier": 3, "observed": true,
+  "attrs": {"graph": {"nodes": [{"kind": "workload", "label": "prod/api",
+                                 "attrs": {"env": "staging"}}],
+                       "edges": []}}},
+ {"fact_id": "PF-TST-2", "kind": "k8s.service", "source": "fixture",
+  "location": "svc.yaml", "tier": 3, "observed": true,
+  "attrs": {"graph": {"nodes": [{"kind": "k8s_service", "label": "prod/api-svc"}],
+                       "edges": [{"src_kind": "k8s_service", "src": "prod/api-svc",
+                                   "dst_kind": "workload", "dst": "prod/api",
+                                   "kind": "routes_to"}]}}}
+]}

platformforge/data/lab/fleets/acme/capacity.yaml

@@ -0,0 +1,35 @@
+members:
+  - member_id: "cluster:prod-1"
+    dimensions:
+      - {name: cpu, used: 8.6, capacity: 10.0, source: observed}
+      - {name: memory, used: 9.1, capacity: 10.0, source: observed}
+      - {name: pods, used: 42, capacity: 110, source: observed}
+  - member_id: "cluster:prod-2"
+    dimensions:
+      - {name: cpu, used: 4.2, capacity: 10.0, source: observed}
+      - {name: memory, used: 5.0, capacity: 10.0, source: observed}
+  - member_id: "cluster:gpu-1"
+    dimensions:
+      - {name: gpu, used: 7, capacity: 8, source: observed}
+      - {name: cpu, used: 6.0, capacity: 16.0, source: observed}
+  - member_id: "cluster:legacy-1"
+    dimensions:
+      - {name: cpu, used: null, capacity: null, source: unavailable}
+      - {name: memory, used: 7.0, capacity: 8.0, source: observed}
+k8s_resources:
+  - {id: "workload:ml-inference", resources: {limits: {cpu: 8, memory: 32Gi, "nvidia.com/gpu": 2}}, labels: {"nvidia.com/gpu.product": "A100"}}
+  - {id: "workload:ml-batch", resources: {limits: {"nvidia.com/gpu": 1}}}
+  - {id: "workload:checkout-web", resources: {limits: {cpu: 2}}}
+gpu_pools:
+  - {pool_id: "gpu-1:a100", model: "A100", count: 8, allocated: 7, utilization: 88, memory_gb: 320}
+ai_costs:
+  ml-inference: 9800
+endpoints:
+  - {id: "ep:ml-inference-v2", traffic_rps: 0.04, cost_monthly: 9800, latency_p95_ms: 180}
+observations:
+  - {member_id: "cluster:prod-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:prod-2", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:staging-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:dev-1", status: observed, coverage: 0.9, freshness: fresh}
+  - {member_id: "cluster:gpu-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:legacy-1", status: permission-limited, coverage: 0.3, freshness: stale}

platformforge/data/lab/fleets/acme/costs.yaml

@@ -0,0 +1,25 @@
+allocations:
+  - {team: payments, service: checkout, environment: prod, amount: 4200, allocation_confidence: direct}
+  - {team: payments, service: payments, environment: prod, amount: 3800, allocation_confidence: direct}
+  - {team: discovery, service: search, environment: prod, amount: 2600, allocation_confidence: tag-based}
+  - {team: ai-platform, service: ml-inference, environment: prod, amount: 9800, allocation_confidence: usage-based}
+  - {team: data, service: batch-etl, environment: prod, amount: 1400, allocation_confidence: estimated}
+  - {amount: 1750, unallocated: true}
+workloads:
+  - {id: "workload:checkout-web", cpu_util: 55, memory_util: 61, requests: {cpu: 2, memory: 4Gi}}
+  - {id: "workload:ml-inference", cpu_util: 8, memory_util: 12, slo_headroom: 0.9, requests: {cpu: 8, memory: 32Gi, gpu: 2}, cost_monthly: 9800}
+  - {id: "workload:legacy-batch", cpu_util: 91, memory_util: 94, slo_headroom: -0.1, requests: {cpu: 2, memory: 4Gi}}
+  - {id: "workload:thin-api", cpu_util: 4}
+resources:
+  - {id: "vm:jump-01", requests_30d: 0, cpu_util: 1, attached: true, cost_monthly: 180}
+  - {id: "vol:orphan-77", orphaned: true, attached: false, cpu_util: 0, cost_monthly: 90}
+  - {id: "db:reporting-ro", requests_30d: 4, cpu_util: 45, attached: true, cost_monthly: 1200}
+points:
+  - {ts: "2025-11-01", amount: 18000}
+  - {ts: "2025-11-02", amount: 18200}
+  - {ts: "2025-11-03", amount: 18400}
+  - {ts: "2025-11-04", amount: 18500}
+  - {ts: "2025-11-05", amount: 18700}
+  - {ts: "2025-11-06", amount: 18800}
+  - {ts: "2025-11-07", amount: 19000}
+  - {ts: "2025-11-08", amount: 28000}

platformforge/data/lab/fleets/acme/events.yaml

@@ -0,0 +1,41 @@
+operation:
+  - {ts: "2025-11-01T10:00:00Z", action: kubernetes.rollout_restart, service: batch-etl, state: converged, converge_seconds: 90}
+  - {ts: "2025-11-03T10:00:00Z", action: kubernetes.rollout_restart, service: batch-etl, state: converged, converge_seconds: 95}
+  - {ts: "2025-11-07T10:00:00Z", action: kubernetes.rollout_restart, service: batch-etl, state: failed, converge_seconds: 120}
+  - {ts: "2025-11-10T10:00:00Z", action: kubernetes.rollout_restart, service: batch-etl, state: converged, converge_seconds: 88}
+  - {ts: "2025-11-12T10:00:00Z", action: kubernetes.scale, service: checkout, state: converged}
+  - {ts: "2025-11-14T10:00:00Z", action: git.open_pr, service: payments, state: converged}
+rollback:
+  - {ts: "2025-11-07T11:00:00Z", service: batch-etl, strategy: direct-inverse, outcome: rolled-back}
+  - {ts: "2025-10-28T11:00:00Z", service: batch-etl, strategy: direct-inverse, outcome: rolled-back}
+incident:
+  - {ts: "2025-11-07T10:30:00Z", incident_id: inc-101, service: batch-etl, signature: "batch-etl:latency", opened_at: "2025-11-07T10:30:00Z", resolved_at: "2025-11-07T12:10:00Z"}
+  - {ts: "2025-10-28T10:30:00Z", incident_id: inc-102, service: batch-etl, signature: "batch-etl:latency", opened_at: "2025-10-28T10:30:00Z", resolved_at: "2025-10-28T11:00:00Z"}
+  - {ts: "2025-10-14T09:00:00Z", incident_id: inc-103, service: batch-etl, signature: "batch-etl:latency", opened_at: "2025-10-14T09:00:00Z", resolved_at: "2025-10-14T09:40:00Z"}
+deployment:
+  - {ts: "2025-11-07T10:00:00Z", service: batch-etl, incident_linked: true}
+  - {ts: "2025-10-28T10:00:00Z", service: batch-etl, incident_linked: true}
+  - {ts: "2025-10-14T08:30:00Z", service: batch-etl, incident_linked: true}
+  - {ts: "2025-11-01T09:00:00Z", service: checkout}
+  - {ts: "2025-11-05T09:00:00Z", service: checkout}
+remediation:
+  - {ref: rem-1, finding: "k8s.no-limits", remediation: "add-resource-limits", category: config, ts: "2025-10-02T00:00:00Z"}
+  - {ref: rem-2, finding: "k8s.no-limits", remediation: "add-resource-limits", category: config, ts: "2025-10-20T00:00:00Z"}
+  - {ref: rem-3, finding: "k8s.no-limits", remediation: "add-resource-limits", category: config, ts: "2025-11-08T00:00:00Z"}
+policy_decision:
+  - {policy: require-owner, decision: deny, subject: orphan-api, ts: "2025-11-01T00:00:00Z"}
+  - {policy: require-owner, decision: deny, subject: legacy-batch, ts: "2025-11-02T00:00:00Z"}
+  - {policy: require-owner, decision: deny, subject: unknown-svc, ts: "2025-11-03T00:00:00Z"}
+  - {policy: require-owner, decision: deny, subject: tmp-svc, ts: "2025-11-04T00:00:00Z"}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-x, team: data, ts: "2025-11-05T00:00:00Z"}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-y, team: data, ts: "2025-11-06T00:00:00Z"}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-z, team: data, ts: "2025-11-07T00:00:00Z"}
+golden_path_request:
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-01T09:00:00Z", ready_at: "2025-11-01T09:20:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-02T09:00:00Z", ready_at: "2025-11-02T09:18:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-03T09:00:00Z", ready_at: "2025-11-03T09:22:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-04T09:00:00Z", ready_at: "2025-11-04T09:19:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-05T09:00:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-06T09:00:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-07T09:00:00Z"}
+  - {path: batch-job, status: provisioned, requested_at: "2025-11-08T09:00:00Z", ready_at: "2025-11-08T11:30:00Z", approval_wait_s: 7200}