Documentation
¶
Overview ¶
Package response applies governed defensive response actions (issue #425): isolate a host, quarantine a file, stop a process. It adds no new trust model — every action goes through the SAME admission gate (internal/usecase/safety) as a DAST probe and an exploitation step, is approved by a human (never a model) with the approval sealed as evidence, is argv-only, is reversible, and is halted by the #418 kill switch. Apply is reachable only after admission plus a recorded human approval.
Index ¶
- Constants
- type ExecOutcome
- type ExecRequest
- type Executor
- type PlanStep
- type Record
- type Service
- func (s *Service) Apply(ctx context.Context, engagementID shared.ID, action rdom.Action, ...) (Record, error)
- func (s *Service) DryRun(action rdom.Action) ([]PlanStep, error)
- func (s *Service) HaltResponses(ctx context.Context, tenantID shared.ID, actor, reason string) (int, error)
- func (s *Service) Revert(ctx context.Context, actionID shared.ID, target engagement.Target, ...) (Record, error)
- type State
Constants ¶
const ( StatePending = rdom.StatePending StateApplied = rdom.StateApplied StateReverted = rdom.StateReverted StateCancelled = rdom.StateCancelled StateViolation = rdom.StateViolation )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ExecOutcome ¶
type ExecOutcome struct {
ObservedRadius offensivepolicy.Radius
AffectedCount int
AlreadyApplied bool
}
ExecOutcome reports what the host actually did. AlreadyApplied lets the executor signal idempotency (the host is already isolated / the file already quarantined), so a re-issue is a no-op. AffectedCount is how many distinct entities the action actually touched: an action declares a SINGLE target, so an effect touching more than one is a blast-radius violation the binary read_only/state_changing radius cannot express on its own.
type ExecRequest ¶
type ExecRequest struct {
Argv []string
Target shared.ID
Declared offensivepolicy.Radius
IsReversal bool
}
ExecRequest is an argv-only command to run against a target.
type Executor ¶
type Executor interface {
Execute(ctx context.Context, req ExecRequest) (ExecOutcome, error)
}
Executor runs an argv-only response command on the host, scoped to the target, and reports the OBSERVED blast radius so an effect exceeding the declared radius is caught. No shell, ever, including reversals.
type PlanStep ¶
type PlanStep struct {
Label string
Argv []string
BlastRadius offensivepolicy.Radius
}
PlanStep is one line of a dry run: the action or reversal that WOULD run, and its argv.
type Record ¶
Record and State are the domain types (domain/response); re-exported as aliases so callers of this usecase package need not import both.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service applies response actions under the shared governance.
func NewService ¶
func NewService(admit admitter, exec Executor, store ports.ResponseStore, audit ports.AuditLogger, clock ports.Clock) (*Service, error)
NewService validates dependencies.
func (*Service) Apply ¶
func (s *Service) Apply(ctx context.Context, engagementID shared.ID, action rdom.Action, target engagement.Target, approver string) (Record, error)
Apply executes a response action after: (1) it validates (fail-closed on missing reversal/argv/ radius/scope), (2) the approver is a HUMAN (a machine identity is refused — no model verdict can approve), (3) the admission gate admits it (scope guard + recorded human approval, sealed as evidence), and (4) the executed effect stays within the declared blast radius. Re-issuing an applied action is a no-op reporting the already-applied state.
func (*Service) DryRun ¶
DryRun enumerates exactly what an action would do — the action and its reversal — and executes NOTHING. Same contract as the offensive-policy dry run.
func (*Service) HaltResponses ¶
func (s *Service) HaltResponses(ctx context.Context, tenantID shared.ID, actor, reason string) (int, error)
HaltResponses cancels every pending (admitted-but-not-yet-applied) response action for the tenant, exactly as the kill switch halts offensive work. It is the ResponseHalter the #418 kill switch drives, so its signature matches that seam. A single operator action, audited with the operator + reason.
func (*Service) Revert ¶
func (s *Service) Revert(ctx context.Context, actionID shared.ID, target engagement.Target, approver string) (Record, error)
Revert applies an action's reversal. The reversal is itself ADMITTED (through the same gate) and AUDITED — a reversal is a first-class governed action, not an unchecked undo.
Source Files