secunit-core 0.7.1

Registry, evidence, hashing, and verification primitives for secunit.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156

//! Strongly-typed prepare / result / manifest payloads. Each maps 1:1
//! to its JSON Schema under `schemas/`.

use std::collections::BTreeMap;
use std::path::PathBuf;

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};

use crate::model::ResolvedSystem;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
pub enum ScopeLayout {
    BySystem,
    Flat,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum RunOutcome {
    Complete,
    Partial,
    Failed,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum SystemOutcome {
    Complete,
    Skipped,
    Failed,
}

// ---------- prepare context -------------------------------------------------

/// The skill `run prepare` resolved for this control, so the agent can
/// load it without knowing whether it ships in the binary or lives under
/// `skills/`. Resolution is local-first, then bundled.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SkillRef {
    pub name: String,
    /// `"local"` (a file under `skills/`) or `"bundled"` (shipped in the
    /// binary; load it with `secunit skills show <name>`).
    pub source: String,
    pub sha256: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PrepareContext {
    pub schema_version: u32,
    pub control_id: String,
    pub run_id: String,
    pub run_dir: PathBuf,
    pub started_at: DateTime<Utc>,
    /// The resolved runbook to follow for this run.
    pub skill: SkillRef,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub operator: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub note: Option<String>,
    pub scope_layout: ScopeLayout,
    pub resolved_scope: Vec<ResolvedSystem>,
    pub registry_git_sha: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub period_id: Option<String>,
}

// ---------- result (skill output) ------------------------------------------

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RunResult {
    pub schema_version: u32,
    pub control_id: String,
    pub run_id: String,
    pub status: RunOutcome,
    #[serde(default)]
    pub by_system: Vec<SystemResult>,
    #[serde(default)]
    pub draft_risks: Vec<serde_json::Value>,
    #[serde(default)]
    pub draft_issues: Vec<serde_json::Value>,
    #[serde(default)]
    pub external_links: Vec<serde_json::Value>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SystemResult {
    pub name: String,
    pub status: SystemOutcome,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub note: Option<String>,
}

// ---------- finalized manifest ---------------------------------------------

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AgentInfo {
    pub model: String,
    pub skill: String,
    pub skill_sha256: String,
    pub control_sha256: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PriorRun {
    pub run_id: String,
    pub manifest_sha256: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Artifact {
    pub path: String,
    pub sha256: String,
    pub bytes: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BySystemBlock {
    pub name: String,
    pub status: SystemOutcome,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub summary: Option<BTreeMap<String, serde_json::Value>>,
    pub artifacts: Vec<Artifact>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Manifest {
    pub schema_version: u32,
    pub control_id: String,
    pub run_id: String,
    pub started_at: DateTime<Utc>,
    pub completed_at: DateTime<Utc>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub operator: Option<String>,
    pub agent: AgentInfo,
    pub registry_git_sha: String,
    pub scope_layout: ScopeLayout,
    pub resolved_scope: Vec<ResolvedSystem>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub prior_run: Option<PriorRun>,
    pub artifacts: Vec<Artifact>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub by_system: Vec<BySystemBlock>,
    pub status: RunOutcome,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub failure_reason: Option<String>,
    #[serde(default)]
    pub draft_risks: Vec<serde_json::Value>,
    #[serde(default)]
    pub draft_issues: Vec<serde_json::Value>,
    #[serde(default)]
    pub external_links: Vec<serde_json::Value>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub period_id: Option<String>,
}