Module model 

Strongly-typed risk event envelope, per-type payloads, and the folded RiskState.

Every type here maps 1:1 to risk-event.schema.json / risk-index.schema.json. Keep field names aligned with the schemas — serde is the load path, and the on-disk line is the chained, hashed source of truth, so the JSON shape is a contract, not an implementation detail.

Structs

Agent

{ model, skill } when an agent appended the event; None for a direct operator action.

EventEnvelope

One line of events.jsonl: the immutable envelope plus its hash-chain fields. data is flattened so the on-disk shape is {seq, ts, actor, agent, type, prev_sha256, data} (the type/data pair is produced by EventData’s adjacent tagging).

ExternalLink

A tracker mirror created by sync-out, recorded by external-linked.

FindingRef

Binds a risk to immutable evidence by content hash. The fingerprint <control_id>:<finding_id> is the risk’s cross-run identity.

RiskState

The current state of a risk, produced by folding its events in seq order. Nothing here is stored on disk — it is always recomputed from the log. See crate::risks::fold::fold.

Enums

EventData

The per-type payload. Adjacently tagged so it serialises as {"type": "...", "data": { ... }}, matching risk-event.schema.json.

Severity

Risk severity. Ordered most- to least-severe in declaration order so callers can compare and sort.

Status

Lifecycle status. The legal transitions between these are enforced by crate::risks::fold::validate_transition; see docs/risks.md.

Type Aliases

RiskEvent

Back-compat alias: the envelope is the event. Callers may use either name; RiskEvent reads better at use sites that talk about “events”.