IncidentContext groups bounded ContextItem evidence for one incident.
PlaybookDocument declares versioned, typed actions with risk levels and bounded parameter definitions.
PolicyDocument maps playbook actions to approval requirements; unknown actions and missing rules fail closed.
ActionProposal links a playbook action to a diagnosis and evidence by SHA-256 digest, bounds parameters, expires, and carries execution_allowed=false.
ApprovalDecision records approved, rejected, or pending status plus approver, reason, and revision pins.
VerificationRequest, VerificationCheck, and VerificationRecord capture explicit passed, failed, unknown, or timed-out outcomes.
AuditEvent records inspectable transition detail; LifecycleResult returns the complete non-executing run.
Current orchestration
run_guarded_lifecycle coordinates ports — and never executes
Evidence collection, persistence, and report writing compose separately through their own ports and adapters, so applications choose exactly which capabilities to wire in.