report

type ExceptionEntry ¶

type ExceptionEntry struct {
	PolicyID       string
	State          string
	Scope          string // resource_id, resource_pattern, or "policy"
	ApprovedBy     string
	ApprovedAt     string
	ExpiresAt      string
	Reason         string
	FirstSeenRunID string
	LastSeenRunID  string
}

ExceptionEntry is one row of the exceptions register. Fields mirror core.AppliedException — duplicated here so the report's data model is self-contained and not coupled to the manifest schema.

type ExceptionsView ¶

type ExceptionsView struct {
	Exceptions []ExceptionEntry
}

ExceptionsView is the centralized register of every waiver/NA in effect during the period, deduplicated across runs by policy_id + resource_id + resource_pattern. The order of runs is preserved so readers can trace which run first/last applied a given exception.

type Input ¶

type Input struct {
	Vault     core.Vault
	Framework string
	PeriodID  string
	View      View
}

Input is the parameter bundle for Build. Vault is read-only; Build never writes.

type IntegrityRow ¶

type IntegrityRow struct {
	RunPath           string
	RunID             string
	CompletedAt       time.Time
	SignatureValid    bool
	FilesVerified     int
	FilesTotal        int
	FirstMismatchPath string
	Error             string // populated when SignatureValid is false or a file is missing
}

IntegrityRow records the outcome of integrity verification for one run folder.

func (r *IntegrityRow) Status() string

type IntegrityView ¶

type IntegrityView struct {
	Runs []IntegrityRow
}

IntegrityView is the per-run signature + file-hash verification table. Rows are sorted by run path (which sorts by timestamp in ISO 8601 basic form) so the output is reproducible.

type LatestPolicy ¶

type LatestPolicy struct {
	PolicyID      string
	ControlID     string
	Status        string
	Severity      string
	Category      string
	LastEvaluated time.Time
	RunID         string
	// ExceptionID, when non-empty, points at the policy_id of the
	// exception that suppressed this result (waived/na). The free-CLI
	// design uses the policy_id as the exception's primary key — the
	// exceptions view is the place to look up details.
	ExceptionID string
}

LatestPolicy is one row of the latest-wins view.

type LatestView ¶

type LatestView struct {
	Policies []LatestPolicy
}

LatestView is the latest-wins per-policy roll-up for the period. One row per policy that appears in any run in the period folder; for policies that appear in multiple runs, the row reflects the latest run (by manifest.completed_at) that produced a result for that policy.

type ScopeSource ¶ added in v0.67.0

type ScopeSource struct {
	SourceID string
	State    string
}

ScopeSource is one declared source and how it fared.

type ScopeView ¶ added in v0.67.0

type ScopeView struct {
	// Declared reports whether the run carried an estate declaration.
	// False for runs written before scope existed, and for projects that
	// have not opted in.
	Declared bool
	// Status is the run-level verdict: complete, incomplete, or empty
	// when nothing was declared.
	Status string
	// DeclaredBy/DeclaredAt are the operator's audit trail.
	DeclaredBy string
	DeclaredAt string
	// RunID is the run this verdict came from — the latest in the period.
	RunID string

	// Sources is one row per declared source, sorted by ID.
	Sources []ScopeSource
	// Skipped is one row per unevaluated control, sorted by policy ID.
	Skipped []SkippedPolicy
}

ScopeView answers "what was this run supposed to cover, and did it?"

Two independent things live here because they answer the same auditor question from opposite ends. Sources is the estate the operator declared and how each declared entry actually fared — present only for projects that opted in by declaring one. Skipped is every control the run did not evaluate, with the reason, which is available for every project whether or not an estate was declared.

The second matters on its own: a skipped control leaves the compliance-score denominator entirely, so a run can go green while quietly evaluating nothing.

type SkippedPolicy ¶ added in v0.67.0

type SkippedPolicy struct {
	PolicyID string
	Status   string
	Reason   string
}

SkippedPolicy is one control the run did not evaluate.

type Snapshot ¶

type Snapshot struct {
	View      View
	Framework string
	PeriodID  string

	Latest     *LatestView     `json:",omitempty"`
	Exceptions *ExceptionsView `json:",omitempty"`
	Integrity  *IntegrityView  `json:",omitempty"`
	Scope      *ScopeView      `json:",omitempty"`
}

Snapshot is the top-level result of Build. Exactly one of the per-view sub-structs is populated based on the requested view; the other fields are zero-valued.

GeneratedAt is excluded from the formatted body — it lives on the header that the CLI command stamps separately so tests can assert byte-identical content across invocations.

func Build(ctx context.Context, in *Input) (*Snapshot, error)

type View ¶

type View string

View names the requested snapshot kind. Surfaced as the --view flag on the CLI.

const (
	ViewLatest     View = "latest"
	ViewExceptions View = "exceptions"
	ViewIntegrity  View = "integrity"
	ViewScope      View = "scope"
)