SDL Authoring Layer¶

The raes package provides the author-facing SDL models, parser, validator, instantiation, and composition machinery.

Public API¶

RAES Scenario Description Language (SDL).

A backend-agnostic scenario specification language with revision-pinned syntax and translated-model ancestry in Open Cyber Range SDL plus RAES-native extensions. The normative derivation boundary is recorded in contracts/provenance/sdl-lineage-ledger-v1.json; this module does not claim drop-in compatibility.

raes.admit_instantiated_scenario(artifact)

Structurally and semantically admit a portable instantiated artifact.

Parameters:: artifact (InstantiatedScenario | Mapping[str, object])
Return type:: InstantiatedScenario

raes.canonical_instantiated_sdl_bytes(scenario)

Return RFC 8785 bytes for one admitted instantiated artifact.

Parameters:: scenario (InstantiatedScenario)
Return type:: bytes

raes.canonical_instantiated_sdl_digest(scenario)

Return the profile-labelled digest of an instantiated snapshot.

Parameters:: scenario (InstantiatedScenario)
Return type:: SDLCanonicalDigest

raes.canonical_sdl_bytes(scenario)

Return RFC 8785 bytes for one validated, post-expansion authoring scenario.

Parameters:: scenario (Scenario | ExpandedScenario)
Return type:: bytes

raes.canonical_sdl_digest(scenario)

Return the profile-labelled SHA-256 digest of canonical SDL semantic bytes.

Parameters:: scenario (Scenario | ExpandedScenario)
Return type:: SDLCanonicalDigest

class raes.ExpandedScenarioBindingTargetResolver

Bases: object

Production scenario-plane target resolver backed by one admitted family.

__init__(family)

Parameters:: family (ExpandedScenario)
Return type:: None

resolve(scenario_family_id, variation_point_id, supplied_target_id)

Parameters:

scenario_family_id (str)
variation_point_id (str)
supplied_target_id (str)

Return type:

ScenarioBindingResolution

raes.build_declaration_index(scenario, *, raise_on_collision=True)

Index every catalogued declaration and reject non-injective rendering.

Parameters:

scenario (ScenarioContent)
raise_on_collision (bool)

Return type:

DeclarationIndex

raes.instantiate_scenario(raw_scenario, parameters=None, profile=None)

Return a fully concrete scenario ready for compilation.

Instantiation applies parameter values and variable defaults, rejects unresolved placeholders, rebuilds the Pydantic model, and reruns semantic validation on the concrete result.

Parameters:

raw_scenario (Scenario | ExpandedScenario)
parameters (Mapping[str, str | int | float | bool | None | list[str | int | float | bool | None | list[JSONLike] | dict[str, JSONLike]] | dict[str, str | int | float | bool | None | list[JSONLike] | dict[str, JSONLike]]] | None)
profile (str | None)

Return type:

InstantiatedScenario

class raes.InstantiatedScenario

Bases: ScenarioContent

Scenario with all ${var} references resolved to concrete values.

Unlike the authoring-input contract, an instantiated scenario MUST NOT contain any unresolved ${name} substitution token in any string value, whether a whole-string placeholder ("${os}") or embedded ("host-${index}"). The invariant is enforced both by the model validator below and by the published instantiated-scenario-v1 JSON Schema, which forbids the token in every string field. The schema is If a resolved variable value itself introduces a literal ${name} sequence, the single-pass substitution step does not interpret it as a second substitution request; final model admission still treats the result as non-concrete and rejects the public instantiation.

model_config = {'extra': 'forbid', 'json_schema_extra': {'x-raes-authored-identity-profile': 'raes-sdl-semantic/v1', 'x-raes-document-phase': 'instantiated-scenario'}, 'populate_by_name': True, 'title': 'SDL Instantiated Scenario v1', 'validate_by_alias': True, 'validate_by_name': True}: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

instantiation_provenance: InstantiationProvenance

property explicitness: dict[str, ExplicitnessRecord]: Portable SEM-218 records keyed by SDL model path.

model_post_init(context, /)

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

class raes.InstantiatedScenarioSnapshot

Bases: SDLModel

Sealed canonical envelope for one portable instantiated artifact.

model_config = {'extra': 'forbid', 'frozen': True, 'json_schema_extra': {'x-raes-document-phase': 'canonical-instantiated-snapshot'}, 'populate_by_name': True, 'title': 'SDL Instantiated Scenario Snapshot v1', 'validate_by_alias': True, 'validate_by_name': True}: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

profile: Literal['raes-sdl-instantiated-snapshot/v1']

scenario: InstantiatedScenario

class raes.SDLCanonicalDigest

Bases: object

Profile-labelled digest of canonical SDL semantic bytes.

profile: str

algorithm: str

value: str

as_dict()

Return type:: dict[str, str]

__init__(profile, algorithm, value)

Parameters:

profile (str)
algorithm (str)
value (str)

Return type:

None

class raes.SDLFormatResult

Bases: object

Canonical source text plus advisories for each migrated construct.

content: str

diagnostics: tuple[SDLParseDiagnostic, ...]

__init__(content, diagnostics)

Parameters:

content (str)
diagnostics (tuple[SDLParseDiagnostic, ...])

Return type:

None

raes.format_sdl_source(content, *, path=None, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32))

Rewrite recognized migration syntax as strict sdl-yaml/v1 YAML.

Parameters:

content (str)
path (Path | None)
limits (SDLParserLimits)

Return type:

SDLFormatResult

raes.load_sdl_fragment(content, *, mapping_keys='structural', base_pointer='', source_format='sdl-yaml/v1', migration_policy=SDLMigrationPolicy.REJECT, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32), source_diagnostics=None)

Safely load an SDL YAML fragment with the canonical key preflight.

Parameters:

content (str)
mapping_keys (Literal['structural', 'literal'])
base_pointer (str)
source_format (str)
migration_policy (SDLMigrationPolicy | str)
limits (SDLParserLimits)
source_diagnostics (list[SDLParseDiagnostic] | None)

Return type:

object

raes.parse_sdl(content, path=None, *, skip_semantic_validation=False, source_format='sdl-yaml/v1', migration_policy=SDLMigrationPolicy.REJECT, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32))

Parse an SDL YAML string into a validated Scenario.

Handles SDL documents with name at the top level. Runs structural validation (Pydantic) and semantic validation (cross-references, cycles, etc.).

Parameters:

content (str) – Raw YAML string.
path (Path | None) – Optional file path for error messages.
skip_semantic_validation (bool) – If True, only run Pydantic structural validation (useful for partial scenarios during development).
source_format (str) – Versioned concrete-syntax profile identifier.
migration_policy (SDLMigrationPolicy | str) – Strict rejection or explicit acceptance of recognized legacy field/merge syntax with retained diagnostics.
limits (SDLParserLimits) – Source and alias-processing resource limits.

Returns:

Validated Scenario object.

Raises:

SDLParseError – If YAML parsing fails or the data isn’t a dict.
SDLValidationError – If semantic validation finds errors.

Return type:

Scenario

raes.parse_sdl_file(path, **kwargs)

Parse an SDL YAML file into a validated Scenario.

Convenience wrapper around parse_sdl() that reads from a file.

Parameters:

path (Path)
kwargs (Any)

Return type:

Scenario

raes.select_scenario_family(family, outcomes)

Construct and semantically admit the exact concrete scenario selected from family.

Parameters:

family (ExpandedScenario)
outcomes (Mapping[str, object])

Return type:

InstantiatedScenario

class raes.Scenario

Bases: ScenarioContent

Normalized SDL authoring object.

This model applies after sdl-yaml/v1 source-profile checks, structural key canonicalization, shorthand expansion, enum normalization, and typed construction, but before module expansion and instantiation. Its JSON Schema does not validate YAML presentation details.

model_config = {'extra': 'forbid', 'json_schema_extra': {'x-raes-document-phase': 'normalized-authoring-object', 'x-raes-source-profile': 'sdl-yaml/v1', 'x-raes-validates-raw-source': False}, 'populate_by_name': True, 'title': 'SDL Normalized Authoring Object v1', 'validate_by_alias': True, 'validate_by_name': True}: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

module: ModuleDescriptor | None

imports: list[ImportDecl]

realization: RealizationDesignation | None

variables: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], ~raes.variables.Variable]

variation_points: dict[str, Annotated[ParameterVariationPoint | GovernedReferenceVariationPoint | AlternativeVariationPoint | SubsetVariationPoint | OrderVariationPoint | LogicalTimingVariationPoint, FieldInfo(annotation=NoneType, required=True, discriminator='kind')]]

property module_variable_specs: dict[str, dict[str, object]]

property module_node_variable_refs: dict[str, dict[str, str | None]]

model_post_init(context, /)

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

exception raes.SDLError

Bases: Exception

Base exception for all SDL operations.

exception raes.SDLInstantiationError

Bases: SDLError

Scenario instantiation failed.

Raised when a parsed scenario cannot be converted into a fully concrete instantiated scenario because parameter binding, default application, or post-substitution validation failed.

__init__(errors, path=None)

Parameters:

errors (list[str])
path (Path | None)

Return type:

None

class raes.SDLMigrationPolicy

Bases: str, Enum

Treatment of recognized non-canonical SDL source spellings.

REJECT = 'reject'

ACCEPT = 'accept'

__new__(value)

class raes.SDLParserLimits

Bases: object

Operational work limits for one source and its composition graph.

max_input_bytes: int = 8388608

max_scalar_bytes: int = 1048576

max_depth: int = 128

max_nodes: int = 100000

max_aliases: int = 256

max_expanded_nodes: int = 250000

max_imports: int = 256

max_composed_nodes: int = 500000

max_composed_bytes: int = 33554432

max_composition_depth: int = 32

max_namespace_depth: int = 32

__init__(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32)

Parameters:

max_input_bytes (int)
max_scalar_bytes (int)
max_depth (int)
max_nodes (int)
max_aliases (int)
max_expanded_nodes (int)
max_imports (int)
max_composed_nodes (int)
max_composed_bytes (int)
max_composition_depth (int)
max_namespace_depth (int)

Return type:

None

class raes.SDLParseDiagnostic

Bases: object

Structured diagnostic produced before SDL model construction.

code: str

message: str

pointer: str

primary_range: SDLSourceRange

authored_keys: tuple[str, str] | None = None

related_range: SDLSourceRange | None = None

related_message: str | None = None

stage: str = 'parse'

severity: str = 'error'

source: str | None = None

as_dict()

Return type:: dict[str, Any]

__init__(code, message, pointer, primary_range, authored_keys=None, related_range=None, related_message=None, stage='parse', severity='error', source=None)

Parameters:

code (str)
message (str)
pointer (str)
primary_range (SDLSourceRange)
authored_keys (tuple[str, str] | None)
related_range (SDLSourceRange | None)
related_message (str | None)
stage (str)
severity (str)
source (str | None)

Return type:

None

exception raes.SDLParseError

Bases: SDLError

YAML parsing or structural validation failed.

path: The file that failed to parse (if applicable).

details: Detailed error message.

__init__(message, path=None, *, diagnostics=())

Parameters:

message (str)
path (Path | None)
diagnostics (Iterable[SDLParseDiagnostic])

Return type:

None

class raes.SDLSourcePosition

Bases: object

One-based source position.

line: int

column: int

as_dict()

Return type:: dict[str, int]

__init__(line, column)

Parameters:

line (int)
column (int)

Return type:

None

class raes.SDLSourceRange

Bases: object

Half-open source range for one authored token.

start: SDLSourcePosition

end: SDLSourcePosition

as_dict()

Return type:: dict[str, dict[str, int]]

__init__(start, end)

Parameters:

start (SDLSourcePosition)
end (SDLSourcePosition)

Return type:

None

exception raes.SDLValidationError

Bases: SDLError

Semantic validation failed.

Collects all errors found during a validation pass rather than failing on the first one.

errors: List of individual error descriptions.

path: The file that failed validation (if applicable).

__init__(errors, path=None)

Parameters:

errors (list[str])
path (Path | None)

Return type:

None

raes.validate_experiment_selection_against_family(spec, *, family)

Validate authoring policy intent against one trusted expanded family.

This gate intentionally does not compile coordinates or selected scenarios. It verifies only point resolution, domain membership, supported policy semantics, and the experiment/family identity join owned by issue #787.

Parameters:

spec (ExperimentSpecModel)
family (ExpandedScenario)

Return type:

ExperimentSpecModel

Parser¶

SDL parser — canonical YAML loading and typed normalization.

Provides parse_sdl() as the primary entry point. Handles: - Exact canonical structural fields by default - Explicitly requested migration of legacy field spellings - Shorthand expansion (source: "pkg" → {name: "pkg", version: "*"})

class raes.parser.SDLSourceDocument¶

Bases: object

Exact bounded bytes and decoded text for one SDL source document.

raw_bytes: bytes¶

text: str¶

__init__(raw_bytes, text)¶

Parameters:

raw_bytes (bytes)
text (str)

Return type:

None

raes.parser.read_sdl_source(path, *, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32))¶

Read one SDL source with the byte limit enforced before decoding.

Parameters:

path (Path)
limits (SDLParserLimits)

Return type:

SDLSourceDocument

raes.parser.load_sdl_fragment(content, *, mapping_keys='structural', base_pointer='', source_format='sdl-yaml/v1', migration_policy=SDLMigrationPolicy.REJECT, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32), source_diagnostics=None)¶

Safely load an SDL YAML fragment with the canonical key preflight.

Parameters:

content (str)
mapping_keys (Literal['structural', 'literal'])
base_pointer (str)
source_format (str)
migration_policy (SDLMigrationPolicy | str)
limits (SDLParserLimits)
source_diagnostics (list[SDLParseDiagnostic] | None)

Return type:

object

raes.parser.parse_sdl(content, path=None, *, skip_semantic_validation=False, source_format='sdl-yaml/v1', migration_policy=SDLMigrationPolicy.REJECT, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32))¶

Parse an SDL YAML string into a validated Scenario.

Handles SDL documents with name at the top level. Runs structural validation (Pydantic) and semantic validation (cross-references, cycles, etc.).

Parameters:

content (str) – Raw YAML string.
path (Path | None) – Optional file path for error messages.
skip_semantic_validation (bool) – If True, only run Pydantic structural validation (useful for partial scenarios during development).
source_format (str) – Versioned concrete-syntax profile identifier.
migration_policy (SDLMigrationPolicy | str) – Strict rejection or explicit acceptance of recognized legacy field/merge syntax with retained diagnostics.
limits (SDLParserLimits) – Source and alias-processing resource limits.

Returns:

Validated Scenario object.

Raises:

SDLParseError – If YAML parsing fails or the data isn’t a dict.
SDLValidationError – If semantic validation finds errors.

Return type:

Scenario

raes.parser.parse_sdl_file(path, **kwargs)¶

Parse an SDL YAML file into a validated Scenario.

Convenience wrapper around parse_sdl() that reads from a file.

Parameters:

path (Path)
kwargs (Any)

Return type:

Scenario

Scenario Model¶

Top-level Scenario model — the root of the SDL.

The Scenario combines specification sections covering who (entities, accounts, agents), what (nodes, features, vulnerabilities, content), when (scripts, stories, events), and declarative experiment semantics (objectives, conditions, relationships, workflows, variables). Per ADR-073 the SDL no longer carries the OCR scoring pipeline; graded scoring/reward live in the experiment/evaluator plane (ADR-055/064/069).

Delivery-level concerns (Docker, Terraform, cloud APIs) are outside the SDL.

class raes.scenario.ModuleDescriptor¶

Bases: SDLModel

Published module metadata for SDL composition.

id: str¶

version: str¶

parameters: list[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)]]¶

exports: dict[str, list[str]]¶

description: str¶

validate_descriptor()¶

Return type:: ModuleDescriptor

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.scenario.ImportDecl¶

Bases: SDLModel

A module import expanded before full semantic validation.

source: str¶

path: str¶

namespace: str¶

version: str¶

parameters: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], object]¶

digest: str¶

validate_source_fields()¶

Return type:: ImportDecl

property normalized_source: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.scenario.ScenarioContent¶

Bases: SDLModel

Executable SDL content shared by the closed document-phase types.

name: WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)]¶

version: str¶

description: str¶

nodes: dict[str, Node]¶

infrastructure: dict[str, InfraNode]¶

features: dict[str, Feature]¶

conditions: dict[str, Condition]¶

propositions: dict[str, Proposition]¶

assertions: dict[str, Assertion]¶

vulnerabilities: dict[str, Vulnerability]¶

entities: dict[str, Entity]¶

injects: dict[str, Inject]¶

events: dict[str, Event]¶

scripts: dict[str, Script]¶

stories: dict[str, Story]¶

content: dict[str, Content]¶

generated_artifacts: dict[str, GeneratedArtifact]¶

persistent_volumes: dict[str, PersistentVolume]¶

accounts: dict[str, Account]¶

identity_domains: dict[str, IdentityDomain]¶

identity_forests: dict[str, IdentityForest]¶

identity_facades: dict[str, IdentityFacade]¶

deployment_tenants: dict[str, DeploymentTenant]¶

deployment_cells: dict[str, DeploymentCell]¶

relationships: dict[str, Relationship]¶

forwarding_agents: list[RuntimeForwardingAgent]¶

agents: dict[str, Agent]¶

action_contracts: dict[str, ParticipantActionContract]¶

observation_boundaries: dict[str, ParticipantObservationBoundary]¶

outcome_interpretation_rules: dict[str, OutcomeInterpretationRule]¶

behavior_specifications: dict[str, ParticipantBehaviorSpecification]¶

evidence_requirements: dict[str, EvidenceRequirement]¶

time_domains: dict[str, TimeDomain]¶

clocks: dict[str, Clock]¶

time_domain_mappings: dict[str, TimeDomainMapping]¶

time_progression_policies: dict[str, TimeProgressionPolicy]¶

temporal_constraints: dict[str, TemporalConstraint]¶

objectives: dict[str, Objective]¶

workflows: dict[str, Workflow]¶

property advisories: list[str]¶: Non-fatal SDL advisories gathered during semantic validation.

property source_diagnostics: tuple[SDLParseDiagnostic, ...]¶: Non-fatal source migration diagnostics retained after parsing.

property semantic_validated: bool¶: Whether full semantic validation has already run on this scenario.

property explicitness: dict[str, ExplicitnessRecord]¶: SEM-218 explicitness records keyed by SDL model path.

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

model_post_init(context, /)¶

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

class raes.scenario.Scenario¶

Bases: ScenarioContent

Normalized SDL authoring object.

model_config = {'extra': 'forbid', 'json_schema_extra': {'x-raes-document-phase': 'normalized-authoring-object', 'x-raes-source-profile': 'sdl-yaml/v1', 'x-raes-validates-raw-source': False}, 'populate_by_name': True, 'title': 'SDL Normalized Authoring Object v1', 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

module: ModuleDescriptor | None¶

imports: list[ImportDecl]¶

realization: RealizationDesignation | None¶

variables: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], ~raes.variables.Variable]¶

variation_points: dict[str, Annotated[ParameterVariationPoint | GovernedReferenceVariationPoint | AlternativeVariationPoint | SubsetVariationPoint | OrderVariationPoint | LogicalTimingVariationPoint, FieldInfo(annotation=NoneType, required=True, discriminator='kind')]]¶

property module_variable_specs: dict[str, dict[str, object]]¶

property module_node_variable_refs: dict[str, dict[str, str | None]]¶

model_post_init(context, /)¶

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

class raes.scenario.ExpandedScenario¶

Bases: ScenarioContent

Internal authoring object after trusted import expansion.

model_config = {'extra': 'forbid', 'json_schema_extra': {'x-raes-document-phase': 'expanded-authoring-object'}, 'populate_by_name': True, 'title': 'SDL Expanded Authoring Object v1', 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

variables: dict[str, Variable]¶

variation_points: dict[str, Annotated[ParameterVariationPoint | GovernedReferenceVariationPoint | AlternativeVariationPoint | SubsetVariationPoint | OrderVariationPoint | LogicalTimingVariationPoint, FieldInfo(annotation=NoneType, required=True, discriminator='kind')]]¶

expansion_provenance: ExpansionProvenance¶

property module_variable_specs: dict[str, dict[str, object]]¶: Compatibility projection of imported allowed-value constraints.

property module_node_variable_refs: dict[str, dict[str, str | None]]¶: Compatibility projection retained until compiler migration completes.

property module_namespaces: dict[str, str]¶

model_post_init(context, /)¶

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

class raes.scenario.InstantiatedScenario¶

Bases: ScenarioContent

Scenario with all ${var} references resolved to concrete values.

model_config = {'extra': 'forbid', 'json_schema_extra': {'x-raes-authored-identity-profile': 'raes-sdl-semantic/v1', 'x-raes-document-phase': 'instantiated-scenario'}, 'populate_by_name': True, 'title': 'SDL Instantiated Scenario v1', 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

instantiation_provenance: InstantiationProvenance¶

property explicitness: dict[str, ExplicitnessRecord]¶: Portable SEM-218 records keyed by SDL model path.

model_post_init(context, /)¶

This function is meant to behave like a BaseModel method to initialise private attributes.

It takes context as an argument since that’s what pydantic-core passes when calling it.

Parameters:

self (BaseModel) – The BaseModel instance.
context (Any) – The context.

Return type:

None

Instantiation¶

Canonical scenario instantiation.

The SDL parser preserves ${var} placeholders structurally. This module owns the repo-level instantiation phase that turns a parsed Scenario into a fully concrete InstantiatedScenario before compilation/runtime planning.

raes.instantiate.admit_instantiated_scenario(artifact)¶

Structurally and semantically admit a portable instantiated artifact.

Parameters:: artifact (InstantiatedScenario | Mapping[str, object])
Return type:: InstantiatedScenario

raes.instantiate.instantiate_scenario(raw_scenario, parameters=None, profile=None)¶

Return a fully concrete scenario ready for compilation.

Instantiation applies parameter values and variable defaults, rejects unresolved placeholders, rebuilds the Pydantic model, and reruns semantic validation on the concrete result.

Parameters:

raw_scenario (Scenario | ExpandedScenario)
parameters (Mapping[str, str | int | float | bool | None | list[str | int | float | bool | None | list[JSONLike] | dict[str, JSONLike]] | dict[str, str | int | float | bool | None | list[JSONLike] | dict[str, JSONLike]]] | None)
profile (str | None)

Return type:

InstantiatedScenario

Validator¶

Semantic validation for SDL scenarios (package split of the former validator.py). Public API is unchanged: import SemanticValidator.

class raes.validator.SemanticValidator¶

Bases: _NodesInfraNetworkMixin, _RuntimeServicesMixin, _RuntimeIdentityDataMixin, _RuntimePlatformMixin, _RuntimeOrchestrationMixin, _RuntimeMailMixin, _DomainTopologyMixin, _EnterpriseIdentityMixin, _DeploymentTenancyMixin, _RelationshipsMixin, _RelationshipsProxyMixin, _MixedControlMixin, _ParticipantInjectDeliveriesMixin, _ParticipantToolAffordancesMixin, _ServiceMaterializationMixin, _ContentObjectivesMixin, _PropositionsMixin, _EvidenceRequirementsMixin, _WorkflowAnalysisMixin, _WorkflowVerifyMixin, _VariationMixin, _TimeModelMixin, _SectionsMixin, _ValidatorCore

Validates executable SDL content beyond structural Pydantic checks.

Call validate() to run all passes. Raises SDLValidationError with all collected errors if any pass fails.

Language Service¶

Language-service helpers for SDL authoring tools.

The functions in this module are deliberately editor-agnostic. They expose completion, reference lookup, formatting, diagnostics, and structured edits as plain JSON-like dictionaries so MCP tools, CLIs, and future LSP adapters can share one implementation.

raes.language_service.language_completions(sdl_content, *, cursor_path='', prefix='')¶

Return completion items for a JSON-pointer-like SDL location.

Parameters:

sdl_content (str)
cursor_path (str)
prefix (str)

Return type:

dict[str, Any]

raes.language_service.language_references(sdl_content, symbol)¶

Return definition and occurrence locations for an SDL symbol.

Parameters:

sdl_content (str)
symbol (str)

Return type:

dict[str, Any]

raes.language_service.language_format(sdl_content)¶

Migrate recognized legacy spellings and return canonical SDL YAML.

Parameters:: sdl_content (str)
Return type:: dict[str, Any]

raes.language_service.language_diagnostics(sdl_content, *, semantic_validation=True)¶

Parse SDL and return structured diagnostics instead of prose.

Parameters:

sdl_content (str)
semantic_validation (bool)

Return type:

dict[str, Any]

raes.language_service.apply_structured_edit(sdl_content, *, operation, pointer, value=None)¶

Apply a structured edit addressed by JSON pointer and revalidate.

Parameters:

sdl_content (str)
operation (str)
pointer (str)
value (Any)

Return type:

dict[str, Any]

Agent Guidance¶

Machine-readable RAES agent guidance profile.

raes.agent_guidance.agent_guidance(*, audience='all')¶

Return the AUT-811 guidance profile, optionally filtered by audience.

Parameters:: audience (str)
Return type:: dict[str, Any]

Composition¶

Module/import expansion for multi-file SDL scenarios.

raes.composition.expand_sdl_modules(data, *, path, source_format='sdl-yaml/v1', migration_policy=SDLMigrationPolicy.REJECT, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32), source_diagnostics=None, _traversal=None)¶

Expand trusted imports into executable content and portable evidence.

Parameters:

data (dict[str, Any])
path (Path)
source_format (str)
migration_policy (SDLMigrationPolicy | str)
limits (SDLParserLimits)
source_diagnostics (list[SDLParseDiagnostic] | None)
_traversal (CompositionTraversal | None)

Return type:

tuple[dict[str, Any], ExpansionProvenance]

Module Registry¶

Registry-aware SDL module resolution and publishing.

class raes.module_registry.RegistryTrustPolicy¶

Bases: SDLModel

require_signatures: bool¶

trusted_signers: dict[str, str]¶

allow_insecure_http: bool¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.module_registry.TrustPolicy¶

Bases: SDLModel

schema_version: str¶

allow_unsigned_local_sources: bool¶

registries: dict[str, RegistryTrustPolicy]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.module_registry.LockRecord¶

Bases: SDLModel

source: str¶

namespace: str¶

requested_version: str¶

resolved_source: str¶

module_id: str¶

module_version: str¶

manifest_digest: str¶

content_digest: str¶

export_hash: str¶

signer_id: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.module_registry.Lockfile¶

Bases: SDLModel

schema_version: str¶

imports: list[LockRecord]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.module_registry.ResolvedModule¶

Bases: object

ResolvedModule(import_decl: ‘ImportDecl’, module_descriptor: ‘ModuleDescriptor’, root_file: ‘Path’, source_document: ‘SDLSourceDocument’, resolved_source: ‘str’, manifest_digest: ‘str’ = ‘’, content_digest: ‘str’ = ‘’, export_hash: ‘str’ = ‘’, signer_id: ‘str’ = ‘’)

import_decl: ImportDecl¶

module_descriptor: ModuleDescriptor¶

root_file: Path¶

source_document: SDLSourceDocument¶

resolved_source: str¶

manifest_digest: str = ''¶

content_digest: str = ''¶

export_hash: str = ''¶

signer_id: str = ''¶

__init__(import_decl, module_descriptor, root_file, source_document, resolved_source, manifest_digest='', content_digest='', export_hash='', signer_id='')¶

Parameters:

import_decl (ImportDecl)
module_descriptor (ModuleDescriptor)
root_file (Path)
source_document (SDLSourceDocument)
resolved_source (str)
manifest_digest (str)
content_digest (str)
export_hash (str)
signer_id (str)

Return type:

None

raes.module_registry.load_trust_policy(base_dir)¶

Parameters:: base_dir (Path)
Return type:: TrustPolicy

raes.module_registry.load_lockfile(base_dir)¶

Parameters:: base_dir (Path)
Return type:: Lockfile | None

raes.module_registry.write_lockfile(base_dir, lockfile)¶

Parameters:

base_dir (Path)
lockfile (Lockfile)

Return type:

Path

raes.module_registry.resolve_import(import_decl, *, base_dir, lockfile=None, trust_policy=None, source_options=SDLSourceParseOptions(source_format='sdl-yaml/v1', migration_policy=<SDLMigrationPolicy.REJECT: 'reject'>, limits=SDLParserLimits(max_input_bytes=8388608, max_scalar_bytes=1048576, max_depth=128, max_nodes=100000, max_aliases=256, max_expanded_nodes=250000, max_imports=256, max_composed_nodes=500000, max_composed_bytes=33554432, max_composition_depth=32, max_namespace_depth=32)), source_diagnostics=None)¶

Parameters:

import_decl (ImportDecl)
base_dir (Path)
lockfile (Lockfile | None)
trust_policy (TrustPolicy | None)
source_options (SDLSourceParseOptions)
source_diagnostics (list[SDLParseDiagnostic] | None)

Return type:

ResolvedModule

raes.module_registry.resolve_lock_records(root_path, *, trust_policy=None)¶

Parameters:

root_path (Path)
trust_policy (TrustPolicy | None)

Return type:

Lockfile

raes.module_registry.publish_module_to_oci_layout(root_path, *, output_dir, signer_id='', private_key_path=None)¶

Parameters:

root_path (Path)
output_dir (Path)
signer_id (str)
private_key_path (Path | None)

Return type:

dict[str, Any]

SDL Models¶

Nodes¶

Node models — VMs and network switches.

Ports the OCR SDL Node/VM/Switch/Resources/Role structs with backend-agnostic Source references.

class raes.nodes.AssetValue¶

Bases: SDLModel

CIA triad asset valuation for scoring and risk assessment.

confidentiality: AssetValueLevel | str¶

integrity: AssetValueLevel | str¶

availability: AssetValueLevel | str¶

classmethod normalize_asset_value(v)¶

Parameters:: v (AssetValueLevel | str)
Return type:: AssetValueLevel | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.AssetValueLevel¶

Bases: str, Enum

CIA triad value level. Adapted from CybORG ConfidentialityValue.

NONE = 'none'¶

LOW = 'low'¶

MEDIUM = 'medium'¶

HIGH = 'high'¶

CRITICAL = 'critical'¶

__new__(value)¶

class raes.nodes.ContainerImageBuildProvenance¶

Bases: SDLModel

Observed build/provenance facts for a custom container image artifact.

base_image: str¶

base_image_digest: str¶

dockerfile_path: str¶

instructions: list[DockerfileInstruction]¶

layers: list[ImageLayer]¶

build_args: list[ImageBuildArg]¶

copied_sources: list[ImageCopiedSource]¶

config: ImageConfig | None¶

source_inputs: list[ImageSourceInput]¶

attestation: ImageAttestation | None¶

description: str¶

validate_unique_entries()¶

Return type:: ContainerImageBuildProvenance

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DockerfileInstruction¶

Bases: SDLModel

A structured record of one container build-recipe instruction.

The instruction is kept as a typed kind plus tokenized arguments rather than raw recipe text: raw Dockerfile/shell syntax can contain ${...} strings that collide with RAES variable substitution.

instruction: DockerfileInstructionKind | str¶

arguments: list[str]¶

description: str¶

classmethod normalize_instruction(v)¶

Parameters:: v (DockerfileInstructionKind | str)
Return type:: DockerfileInstructionKind | str

classmethod normalize_arguments(v)¶

Parameters:: v (Any)
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DockerfileInstructionKind¶

Bases: str, Enum

Observed kind of a structured container build-recipe instruction.

FROM = 'from'¶

ARG = 'arg'¶

ENV = 'env'¶

RUN = 'run'¶

COPY = 'copy'¶

ADD = 'add'¶

WORKDIR = 'workdir'¶

ENTRYPOINT = 'entrypoint'¶

CMD = 'cmd'¶

HEALTHCHECK = 'healthcheck'¶

LABEL = 'label'¶

EXPOSE = 'expose'¶

USER = 'user'¶

VOLUME = 'volume'¶

SHELL = 'shell'¶

STOPSIGNAL = 'stopsignal'¶

ONBUILD = 'onbuild'¶

MAINTAINER = 'maintainer'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.ImageAttestation¶

Bases: SDLModel

Observed build-attestation availability and verification result.

Attestation availability (status) and verification result (verification) are deliberately separate facts: a mutable local image tag with no registry-visible OCI/in-toto/SLSA attestation is not the same state as a failed verification (ADR-023 §5).

status: ImageAttestationStatus | str¶

verification: ImageVerificationStatus | str¶

attestation_type: ImageAttestationType | str¶

predicate_type: str¶

evidence_reference: str¶

description: str¶

classmethod normalize_status(v)¶

Parameters:: v (ImageAttestationStatus | str)
Return type:: ImageAttestationStatus | str

classmethod normalize_verification(v)¶

Parameters:: v (ImageVerificationStatus | str)
Return type:: ImageVerificationStatus | str

classmethod normalize_attestation_type(v)¶

Parameters:: v (ImageAttestationType | str)
Return type:: ImageAttestationType | str

validate_status_verification()¶

Return type:: ImageAttestation

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageAttestationStatus¶

Bases: str, Enum

Availability of a registry-visible build attestation for an image.

PRESENT = 'present'¶

ABSENT = 'absent'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.ImageAttestationType¶

Bases: str, Enum

Format of an observed image build attestation.

OCI = 'oci'¶

IN_TOTO = 'in_toto'¶

SLSA = 'slsa'¶

OTHER = 'other'¶

NONE = 'none'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.ImageBuildArg¶

Bases: SDLModel

An observed build argument with value-sensitivity classification.

name: str¶

value: str¶

value_classification: RuntimeEnvironmentValueClassification | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeEnvironmentValueClassification | str)
Return type:: RuntimeEnvironmentValueClassification | str

validate_redacted_value()¶

Return type:: ImageBuildArg

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageConfig¶

Bases: SDLModel

Observed image-default configuration baked into the image artifact.

These are image defaults, distinct from runtime-effective container facts recorded under Node.runtime.container.

entrypoint: list[str]¶

command: list[str]¶

working_directory: str¶

exposed_ports: list[str]¶

labels: dict[str, str]¶

default_environment: list[ImageEnvironmentDefault]¶

description: str¶

classmethod normalize_string_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_working_directory(v)¶

Parameters:: v (str)
Return type:: str

validate_unique_default_environment()¶

Return type:: ImageConfig

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageCopiedSource¶

Bases: SDLModel

A source path copied into the image and its in-image destination.

source_path: str¶

destination_path: str¶

from_stage: str¶

description: str¶

classmethod validate_source_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_destination_path(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageEnvironmentDefault¶

Bases: SDLModel

An image-default environment variable with sensitivity classification.

name: str¶

value: str¶

value_classification: RuntimeEnvironmentValueClassification | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeEnvironmentValueClassification | str)
Return type:: RuntimeEnvironmentValueClassification | str

validate_redacted_value()¶

Return type:: ImageEnvironmentDefault

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageLayer¶

Bases: SDLModel

An observed layer in the image layer chain.

Empty/metadata-only layers (e.g. ENV instructions) legitimately carry no digest; the layer is still recorded for build-history correlation.

digest: str¶

created_by: str¶

size: int | str | None¶

empty: bool | str | None¶

description: str¶

classmethod parse_size(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod parse_empty(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageSourceInput¶

Bases: SDLModel

A source-package input and its source-to-runtime destination mapping.

source_path uses the same source-path dialect as RuntimeFilesystemEntry.source_path so the build-time input and the realized runtime entry can be correlated.

identifier: str¶

source_path: str¶

destination_path: str¶

checksum: str¶

checksum_algorithm: str¶

description: str¶

classmethod validate_identifier(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_destination_path(v)¶

Parameters:: v (str)
Return type:: str

validate_checksum_pair()¶

Return type:: ImageSourceInput

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ImageVerificationStatus¶

Bases: str, Enum

Result of verifying an image’s build attestation.

VERIFIED = 'verified'¶

FAILED = 'failed'¶

UNVERIFIED = 'unverified'¶

NOT_APPLICABLE = 'not_applicable'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.Node¶

Bases: SDLModel

A scenario node — either a VM or a Switch.

The type field determines which variant is active. VM fields are only valid when type is VM; Switch nodes carry no extra data.

type: NodeType¶

description: str¶

source: Source | None¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

resources: Resources | None¶

os: OSFamily | str | None¶

os_version: str¶

features: dict[str, str]¶

conditions: dict[str, str]¶

injects: dict[str, str]¶

vulnerabilities: list[str]¶

roles: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], ~raes.nodes.Role]¶

services: list[ServicePort]¶

asset_value: AssetValue | None¶

endpoint_persona: EndpointPersona | str | None¶

runtime: RuntimeConfiguration | None¶

classmethod normalize_os(v)¶

classmethod normalize_endpoint_persona(v)¶

Parameters:: v (object)
Return type:: object

validate_type_constraints()¶

Switch nodes cannot carry VM-only fields.

Return type:: Node

validate_unique_service_ports()¶

Concrete VM service bindings must stay uniquely addressable.

Return type:: Node

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.NodeType¶

Bases: str, Enum

Whether a node is a virtual machine or network switch.

VM = 'vm'¶

SWITCH = 'switch'¶

__new__(value)¶

class raes.nodes.OSFamily¶

Bases: str, Enum

Operating system family. Vocabulary from OCSF Device.os.

WINDOWS = 'windows'¶

LINUX = 'linux'¶

MACOS = 'macos'¶

FREEBSD = 'freebsd'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.Resources¶

Bases: SDLModel

Compute resources for a VM node.

ram: int | str¶

cpu: int | str¶

classmethod parse_ram_value(v)¶

Parameters:: v (str | int)
Return type:: int | str

classmethod parse_cpu_value(v)¶

Parameters:: v (int | str)
Return type:: int | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.Role¶

Bases: SDLModel

A named role on a VM with optional entity assignments.

Shorthand: admin: "username" (just the username string). Longhand: admin: {username: "admin", entities: ["blue-team.bob"]}.

username: str¶

entities: list[str]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.Source¶

Bases: SDLModel

Provider-neutral artifact reference.

Shorthand: source: "package-name" (version defaults to "*"). Longhand: source: {name: "package-name", version: "1.2.3"}.

name: str¶

version: str¶

build: ContainerImageBuildProvenance | None¶

artifact_requirement: ArtifactRequirement | None¶

validate_exact_requirement_selector()¶

Return type:: Source

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeListenerAddressFamily¶

Bases: str, Enum

Address family observed for a runtime listener.

IPV4 = 'ipv4'¶

IPV6 = 'ipv6'¶

UNIX = 'unix'¶

UNSPECIFIED = 'unspecified'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeListenerProvenance¶

Bases: str, Enum

Source class for an observed runtime listener fact.

OSQUERY = 'osquery'¶

SS = 'ss'¶

NETSTAT = 'netstat'¶

LSOF = 'lsof'¶

NMAP = 'nmap'¶

DOCKER_INSPECT = 'docker_inspect'¶

KUBERNETES = 'kubernetes'¶

SYSTEMD = 'systemd'¶

OPERATOR = 'operator'¶

SCANNER = 'scanner'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeListenerProtocol¶

Bases: str, Enum

Transport or IPC family for an observed listener.

TCP = 'tcp'¶

UDP = 'udp'¶

SCTP = 'sctp'¶

UNIX = 'unix'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeListenerReadiness¶

Bases: SDLModel

Optional readiness/probe evidence for an observed listener.

probe: str¶

criteria: str¶

evidence_refs: list[str]¶

description: str¶

classmethod coerce_evidence_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeListenerScope¶

Bases: str, Enum

Reachability class of the bind endpoint in the node namespace.

WILDCARD = 'wildcard'¶

LOOPBACK_ONLY = 'loopback_only'¶

NETWORK_FACING = 'network_facing'¶

NODE_LOCAL = 'node_local'¶

LOCAL_SOCKET = 'local_socket'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePublishedPortRef¶

Bases: SDLModel

Typed reference to an observed host-published port binding.

RuntimePublishedPort currently has no stable id, so the tuple is the reference shape used by semantic validation.

container_port: int | str¶

protocol: str¶

host_ip: str¶

host_port: int | str | None¶

classmethod parse_container_port(v)¶

Parameters:: v (int | str)
Return type:: int | str

classmethod parse_host_port(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod validate_protocol(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_host_ip(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeServiceListener¶

Bases: SDLModel

Observed generic runtime listener attached to a node.

service_listener_id: str¶

service: str¶

address: str¶

port: int | str | None¶

protocol: RuntimeListenerProtocol | str¶

address_family: RuntimeListenerAddressFamily | str¶

scope: RuntimeListenerScope | str¶

bind_interface: str¶

socket_path: str¶

process_ref: str¶

process_name: str¶

published_port_refs: list[RuntimePublishedPortRef]¶

readiness: RuntimeListenerReadiness | None¶

provenance: RuntimeListenerProvenance | str¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_service_listener_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_port(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeListenerProtocol | str)
Return type:: RuntimeListenerProtocol | str

classmethod normalize_address_family(v)¶

Parameters:: v (RuntimeListenerAddressFamily | str)
Return type:: RuntimeListenerAddressFamily | str

classmethod normalize_scope(v)¶

Parameters:: v (RuntimeListenerScope | str)
Return type:: RuntimeListenerScope | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeListenerProvenance | str)
Return type:: RuntimeListenerProvenance | str

classmethod validate_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_socket_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_bind_interface(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_evidence_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

validate_listener_shape()¶

Return type:: RuntimeServiceListener

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RelationshipProxyUpstream¶

Bases: SDLModel

Typed proxy-upstream detail carried by a top-level relationship edge.

When a reverse proxy / gateway forwards a route to an upstream origin, the relationship’s target resolves to that origin and this block keeps the forwarding facts structurally validated rather than recorded as prose: route_ref (a route_id on the proxy’s application surface), the resolved upstream node/service, whether the client-facing TLS is terminated at the proxy, whether the proxy-to-origin hop is plaintext, and any request body_limit the proxy enforces.

route_ref: str¶

upstream_node_ref: str¶

upstream_service_ref: str¶

client_tls_terminated: bool | str | None¶

origin_plaintext: bool | str | None¶

body_limit: str¶

description: str¶

classmethod validate_route_ref(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_flags(v, info)¶

Parameters:

v (bool | str | None)
info (ValidationInfo)

Return type:

bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationDisclosure¶

Bases: SDLModel

Observable error or information-disclosure behavior of a route.

disclosure is a classified description of what the application exposes (a stack trace, an internal path, a backend version), never the raw payload, token, password, or cookie itself.

trigger: str¶

status_code: int | str | None¶

disclosure: str¶

sensitivity: RuntimeSensitivityClassification | str¶

description: str¶

classmethod parse_status_code(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod normalize_sensitivity(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationExposedField¶

Bases: SDLModel

A route-visible fixture secret or intentionally exposed diagnostic field.

The sensitivity vocabulary is shared with the rest of the runtime surface. A redacted or operator_secret field must omit its raw value. Other values, including credential-shaped fixture facts, are scenario content needed for range realization and participant observation.

name: str¶

sensitivity: RuntimeSensitivityClassification | str¶

value: str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_sensitivity(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

validate_redacted_value()¶

Return type:: RuntimeApplicationExposedField

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationParameter¶

Bases: SDLModel

A typed request input observed on an application route.

location distinguishes path variables, query string, headers, cookies, form fields, JSON body fields, and uploaded-file fields.

name: str¶

location: RuntimeApplicationParameterLocation | str¶

required: bool | str | None¶

data_type: str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_location(v)¶

Parameters:: v (RuntimeApplicationParameterLocation | str)
Return type:: RuntimeApplicationParameterLocation | str

classmethod parse_required(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationParameterLocation¶

Bases: str, Enum

Where a request input is carried on an observed route.

PATH = 'path'¶

QUERY = 'query'¶

HEADER = 'header'¶

COOKIE = 'cookie'¶

FORM = 'form'¶

JSON_BODY = 'json_body'¶

UPLOADED_FILE = 'uploaded_file'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeApplicationProtocol¶

Bases: str, Enum

Application-layer protocol class for an observed application surface.

HTTP = 'http'¶

HTTPS = 'https'¶

WS = 'ws'¶

WSS = 'wss'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeApplicationRedirect¶

Bases: SDLModel

An observed redirect a route can issue.

Target path/URL, status code, and the triggering condition are kept distinct; the target is recorded verbatim, never resolved.

target: str¶

status_code: int | str | None¶

condition: str¶

description: str¶

classmethod validate_target(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_status_code(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationResponse¶

Bases: SDLModel

An observed response a route can produce.

status_code: int | str¶

content_type: str¶

description: str¶

classmethod parse_status_code(v)¶

Parameters:: v (int | str)
Return type:: int | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationRoute¶

Bases: SDLModel

An observed application route — a participant-visible endpoint.

route_id is the stable identity; path is data and may carry path variables, may be shared across HTTP methods, and is never a mapping key.

route_id: str¶

path: str¶

methods: list[str]¶

name: str¶

description: str¶

auth_required: bool | str | None¶

auth_scheme: str¶

session_required: bool | str | None¶

parameters: list[RuntimeApplicationParameter]¶

responses: list[RuntimeApplicationResponse]¶

templates: list[str]¶

static_assets: list[str]¶

vulnerability_refs: list[str]¶

redirects: list[RuntimeApplicationRedirect]¶

disclosures: list[RuntimeApplicationDisclosure]¶

exposed_fields: list[RuntimeApplicationExposedField]¶

upstream_target: RuntimeApplicationRouteUpstreamTarget | None¶

classmethod validate_route_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_methods(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod normalize_methods(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod parse_auth_flags(v, info)¶

Parameters:

v (bool | str | None)
info (ValidationInfo)

Return type:

bool | str | None

classmethod coerce_ref_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

validate_route()¶

Return type:: RuntimeApplicationRoute

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationRouteUpstreamScheme¶

Bases: str, Enum

Wire scheme a reverse proxy uses to reach a route’s upstream origin.

This is a CLOSED taxonomy: an upstream is reached over either cleartext HTTP or TLS-wrapped HTTPS. Unlike the open RuntimeApplicationProtocol, it carries neither other nor unknown — a proxy-to-origin hop that is neither HTTP nor HTTPS is not an application route upstream.

HTTP = 'http'¶

HTTPS = 'https'¶

__new__(value)¶

class raes.nodes.RuntimeApplicationRouteUpstreamTarget¶

Bases: SDLModel

The origin a reverse-proxied route forwards to.

A proxy/gateway route does not itself serve content; it relays to an upstream origin on this or another node. target_node_ref / target_service name that origin (the service-name forms mirror RuntimeApplicationSurface.service), scheme is the CLOSED proxy-to-origin wire scheme, and tls_terminated_here records whether TLS is terminated at the proxy (re-encrypted or plaintext to the origin). All fields are observation metadata; nothing is resolved.

target_node_ref: str¶

target_service: str¶

scheme: RuntimeApplicationRouteUpstreamScheme | str¶

tls_terminated_here: bool | str | None¶

classmethod normalize_scheme(v)¶

Parameters:: v (RuntimeApplicationRouteUpstreamScheme | str)
Return type:: RuntimeApplicationRouteUpstreamScheme | str

classmethod parse_tls_terminated_here(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeApplicationSurface¶

Bases: SDLModel

An observed application surface hosted by a transport service on a node.

service references the owning same-node Node.services[].name (bare name or the qualified nodes.<node>.services.<name> form). The surface is observation metadata; it never mutates Node.services.

application_id: str¶

service: str¶

protocol: RuntimeApplicationProtocol | str¶

name: str¶

base_path: str¶

framework: str¶

description: str¶

routes: list[RuntimeApplicationRoute]¶

classmethod validate_application_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeApplicationProtocol | str)
Return type:: RuntimeApplicationProtocol | str

classmethod validate_base_path(v)¶

Parameters:: v (str)
Return type:: str

validate_surface()¶

Return type:: RuntimeApplicationSurface

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.Database¶

Bases: SDLModel

An observed logical database within a database service.

database_id: str¶

name: str¶

origin: DatabaseObjectOrigin | str¶

schemas: list[DatabaseSchema]¶

description: str¶

classmethod validate_database_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_origin(v)¶

Parameters:: v (DatabaseObjectOrigin | str)
Return type:: DatabaseObjectOrigin | str

validate_database()¶

Return type:: Database

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseAuthMethod¶

Bases: str, Enum

How a client authenticates to a database on an access relationship.

PASSWORD = 'password'¶

MD5 = 'md5'¶

SCRAM_SHA_256 = 'scram_sha_256'¶

CERT = 'cert'¶

TRUST = 'trust'¶

PEER = 'peer'¶

IDENT = 'ident'¶

GSSAPI = 'gssapi'¶

SSPI = 'sspi'¶

LDAP = 'ldap'¶

RADIUS = 'radius'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DatabaseEngine¶

Bases: str, Enum

The database engine of an observed database service.

POSTGRESQL = 'postgresql'¶

MYSQL = 'mysql'¶

MARIADB = 'mariadb'¶

SQLITE = 'sqlite'¶

MONGODB = 'mongodb'¶

MSSQL = 'mssql'¶

ORACLE = 'oracle'¶

REDIS = 'redis'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DatabaseGrant¶

Bases: SDLModel

An observed privilege grant to a database role.

The grant is structured by grantee, target object, and privileges; raw GRANT statements are not the portable model (ADR-029 §4). object_ref is the stable *_id of a database/schema/table in the same service.

grantee_role_ref: str¶

object_type: DatabaseObjectType | str¶

object_ref: str¶

privileges: list[str]¶

with_grant_option: bool | str¶

description: str¶

classmethod validate_refs(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod normalize_object_type(v)¶

Parameters:: v (DatabaseObjectType | str)
Return type:: DatabaseObjectType | str

classmethod coerce_privileges(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_privileges(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod parse_with_grant_option(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseListener¶

Bases: SDLModel

An observed listener of a database service.

This records what the database process itself listens on. It is not host publication — runtime.network.published_ports remains the host-exposure fact (ADR-029 §3).

address: str¶

port: int | str | None¶

description: str¶

classmethod validate_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_port(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseObjectOrigin¶

Bases: str, Enum

Whether a database object was scenario-authored or engine-supplied.

Keeps engine built-ins (postgres, template0, template1, information_schema) and system roles from looking scenario-authored.

SCENARIO = 'scenario'¶

BUILT_IN = 'built_in'¶

SYSTEM = 'system'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.DatabaseObjectType¶

Bases: str, Enum

The kind of database object a grant applies to.

DATABASE = 'database'¶

SCHEMA = 'schema'¶

TABLE = 'table'¶

__new__(value)¶

class raes.nodes.DatabaseProtocol¶

Bases: str, Enum

The wire protocol an observed database service speaks.

Kept distinct from DatabaseEngine: a MariaDB engine speaks the mysql protocol, and PostgreSQL must never be other (ADR-029 §3).

POSTGRESQL = 'postgresql'¶

MYSQL = 'mysql'¶

TDS = 'tds'¶

MONGODB = 'mongodb'¶

REDIS = 'redis'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DatabaseRole¶

Bases: SDLModel

An observed database-local role — an authorization principal.

Database roles are not OS accounts, runtime.local_identity users, or top-level scenario accounts (ADR-029 §4).

role_id: str¶

name: str¶

role_type: DatabaseRoleType | str¶

origin: DatabaseObjectOrigin | str¶

can_login: bool | str | None¶

description: str¶

classmethod validate_role_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role_type(v)¶

Parameters:: v (DatabaseRoleType | str)
Return type:: DatabaseRoleType | str

classmethod normalize_origin(v)¶

Parameters:: v (DatabaseObjectOrigin | str)
Return type:: DatabaseObjectOrigin | str

classmethod parse_can_login(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseRoleType¶

Bases: str, Enum

Portable classification of a database-local role.

LOGIN = 'login'¶

GROUP = 'group'¶

APPLICATION = 'application'¶

SERVICE = 'service'¶

ADMIN = 'admin'¶

SYSTEM = 'system'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DatabaseSchema¶

Bases: SDLModel

An observed schema (namespace) within a database.

schema_id: str¶

name: str¶

origin: DatabaseObjectOrigin | str¶

tables: list[DatabaseTable]¶

description: str¶

classmethod validate_schema_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_origin(v)¶

Parameters:: v (DatabaseObjectOrigin | str)
Return type:: DatabaseObjectOrigin | str

validate_schema()¶

Return type:: DatabaseSchema

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseSetting¶

Bases: SDLModel

An observed database runtime setting with provenance and sensitivity.

Explicit redacted/operator_secret classifications omit raw values; credential-shaped names remain scenario content unless the author marks the value withheld.

name: str¶

value: str¶

value_classification: RuntimeSensitivityClassification | str¶

provenance: DatabaseSettingProvenance | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_provenance(v)¶

Parameters:: v (DatabaseSettingProvenance | str)
Return type:: DatabaseSettingProvenance | str

validate_redacted_value()¶

Return type:: DatabaseSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DatabaseSettingProvenance¶

Bases: str, Enum

Where an observed database runtime setting value came from.

INTROSPECTION = 'introspection'¶

CONFIGURATION_FILE = 'configuration_file'¶

IMAGE_DEFAULT = 'image_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

RUNTIME_DEFAULT = 'runtime_default'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.DatabaseTable¶

Bases: SDLModel

An observed table in a database schema.

table_id is the stable identity; name is the observed table name and is data, never a mapping key or reference segment.

table_id: str¶

name: str¶

description: str¶

classmethod validate_table_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RelationshipDatabaseAccess¶

Bases: SDLModel

Typed database-access detail carried by a top-level relationship edge.

When an application connects to a database, the relationship’s target resolves to the database (service or logical database) and this block keeps the role_ref (a role_id in that service) and auth_method structurally validated rather than recorded as prose (ADR-029 §4).

role_ref: str¶

auth_method: DatabaseAuthMethod | str¶

description: str¶

classmethod normalize_auth_method(v)¶

Parameters:: v (DatabaseAuthMethod | str)
Return type:: DatabaseAuthMethod | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatabaseService¶

Bases: SDLModel

An observed database service hosted by a transport service on a node.

service references the owning same-node Node.services[].name (bare name or the qualified nodes.<node>.services.<name> form). The inventory is observation metadata; it never mutates Node.services.

database_service_id: str¶

service: str¶

engine: DatabaseEngine | str¶

protocol: DatabaseProtocol | str¶

version: str¶

name: str¶

description: str¶

listeners: list[DatabaseListener]¶

databases: list[Database]¶

roles: list[DatabaseRole]¶

grants: list[DatabaseGrant]¶

settings: list[DatabaseSetting]¶

classmethod validate_database_service_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_engine(v)¶

Parameters:: v (DatabaseEngine | str)
Return type:: DatabaseEngine | str

classmethod normalize_protocol(v)¶

Parameters:: v (DatabaseProtocol | str)
Return type:: DatabaseProtocol | str

validate_service()¶

Return type:: RuntimeDatabaseService

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsDynamicUpdatePolicy¶

Bases: SDLModel

Observed dynamic-update posture without raw update credentials.

enabled: bool | str | None¶

allowed_clients: list[str]¶

key_names: list[str]¶

policy: str¶

description: str¶

classmethod parse_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod coerce_lists(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_allowed_clients(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod validate_key_names(v)¶

Parameters:: v (list[str])
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsForwarder¶

Bases: SDLModel

Recursive upstream resolver endpoint.

address: str¶

port: int | str¶

transport: DnsForwarderTransport | str¶

tls_server_name: str¶

description: str¶

classmethod validate_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_port(v)¶

Parameters:: v (object)
Return type:: int | str

classmethod normalize_transport(v)¶

Parameters:: v (DnsForwarderTransport | str)
Return type:: DnsForwarderTransport | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsForwarderTransport¶

Bases: str, Enum

Transport used to contact a recursive upstream.

UDP = 'udp'¶

TCP = 'tcp'¶

TLS = 'tls'¶

HTTPS = 'https'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsForwardingPolicy¶

Bases: str, Enum

How upstream forwarders are used.

FIRST = 'first'¶

ONLY = 'only'¶

RANDOM = 'random'¶

ROUND_ROBIN = 'round_robin'¶

SEQUENTIAL = 'sequential'¶

NONE = 'none'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsMxRdata¶

Bases: SDLModel

Typed MX RDATA fields.

preference: int | str¶

exchange: str¶

classmethod parse_preference(v)¶

Parameters:: v (object)
Return type:: int | str

classmethod validate_exchange(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsRecordClass¶

Bases: str, Enum

DNS RR class.

IN = 'in'¶

CH = 'ch'¶

HS = 'hs'¶

NONE = 'none'¶

ANY = 'any'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsRecordProvenance¶

Bases: str, Enum

Where an observed DNS record or zone fact came from.

AXFR = 'axfr'¶

IXFR = 'ixfr'¶

QUERY = 'query'¶

CONFIGURATION_FILE = 'configuration_file'¶

ZONE_FILE = 'zone_file'¶

PROVIDER_API = 'provider_api'¶

RUNTIME_DEFAULT = 'runtime_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.DnsRecordType¶

Bases: str, Enum

Common DNS RR types plus an escape hatch for IANA extensions.

A = 'a'¶

AAAA = 'aaaa'¶

CNAME = 'cname'¶

NS = 'ns'¶

MX = 'mx'¶

PTR = 'ptr'¶

SOA = 'soa'¶

SRV = 'srv'¶

TXT = 'txt'¶

CAA = 'caa'¶

DS = 'ds'¶

DNSKEY = 'dnskey'¶

RRSIG = 'rrsig'¶

NSEC = 'nsec'¶

NSEC3 = 'nsec3'¶

TLSA = 'tlsa'¶

SVCB = 'svcb'¶

HTTPS = 'https'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsResolverPolicy¶

Bases: SDLModel

Recursive/forwarding resolver policy for a DNS service.

recursion_enabled: bool | str | None¶

allow_recursion: list[str]¶

forwarders: list[DnsForwarder]¶

forwarding_policy: DnsForwardingPolicy | str¶

dnssec_validation: DnssecValidationMode | str¶

query_logging: bool | str | None¶

default_logging: bool | str | None¶

description: str¶

classmethod parse_optional_bool(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

bool | str | None

classmethod coerce_allow_recursion(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_allow_recursion(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod normalize_forwarding_policy(v)¶

Parameters:: v (DnsForwardingPolicy | str)
Return type:: DnsForwardingPolicy | str

classmethod normalize_dnssec_validation(v)¶

Parameters:: v (DnssecValidationMode | str)
Return type:: DnssecValidationMode | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsResourceRecord¶

Bases: SDLModel

One observed record within an RRset.

rdata: str¶

address: str¶

target: str¶

text: list[str]¶

soa: DnsSoaRdata | None¶

mx: DnsMxRdata | None¶

srv: DnsSrvRdata | None¶

description: str¶

classmethod validate_target(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_text(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_text(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_payload_present()¶

Return type:: DnsResourceRecord

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsResourceRecordSet¶

Bases: SDLModel

Records grouped by owner name, class, type, and TTL.

rrset_id: str¶

owner: str¶

record_type: DnsRecordType | str¶

zone_class: DnsRecordClass | str¶

ttl: int | str | None¶

type_code: int | str | None¶

records: list[DnsResourceRecord]¶

provenance: DnsRecordProvenance | str¶

description: str¶

classmethod validate_rrset_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_owner(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_record_type(v)¶

Parameters:: v (DnsRecordType | str)
Return type:: DnsRecordType | str

classmethod normalize_zone_class(v)¶

Parameters:: v (DnsRecordClass | str)
Return type:: DnsRecordClass | str

classmethod parse_ttl(v)¶

Parameters:: v (object)
Return type:: int | str | None

classmethod parse_type_code(v)¶

Parameters:: v (object)
Return type:: int | str | None

classmethod normalize_provenance(v)¶

Parameters:: v (DnsRecordProvenance | str)
Return type:: DnsRecordProvenance | str

validate_rrset()¶

Return type:: DnsResourceRecordSet

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsRuntimeSetting¶

Bases: SDLModel

Bounded DNS runtime setting with provenance and redaction.

name: str¶

value: str¶

value_classification: RuntimeSensitivityClassification | str¶

provenance: DnsSettingProvenance | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_provenance(v)¶

Parameters:: v (DnsSettingProvenance | str)
Return type:: DnsSettingProvenance | str

validate_redacted_value()¶

Return type:: DnsRuntimeSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsSettingProvenance¶

Bases: str, Enum

Where an observed DNS setting value came from.

CONFIGURATION_FILE = 'configuration_file'¶

INTROSPECTION = 'introspection'¶

IMAGE_DEFAULT = 'image_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

RUNTIME_DEFAULT = 'runtime_default'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.DnsSrvRdata¶

Bases: SDLModel

Typed SRV RDATA fields.

priority: int | str¶

weight: int | str¶

port: int | str¶

target: str¶

classmethod parse_uint16(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str

classmethod parse_port(v)¶

Parameters:: v (object)
Return type:: int | str

classmethod validate_target(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsSoaRdata¶

Bases: SDLModel

Typed SOA RDATA fields.

mname: str¶

rname: str¶

serial: int | str¶

refresh: int | str¶

retry: int | str¶

expire: int | str¶

minimum: int | str¶

classmethod validate_names(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod parse_timers(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsZone¶

Bases: SDLModel

An observed authoritative or forwarding DNS zone.

zone_id: str¶

name: str¶

kind: DnsZoneKind | str¶

purpose: DnsZonePurpose | str¶

zone_class: DnsRecordClass | str¶

provenance: DnsRecordProvenance | str¶

zone_file_refs: list[str]¶

transfer: DnsZoneTransferPolicy | None¶

rrsets: list[DnsResourceRecordSet]¶

description: str¶

classmethod validate_zone_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (DnsZoneKind | str)
Return type:: DnsZoneKind | str

classmethod normalize_purpose(v)¶

Parameters:: v (DnsZonePurpose | str)
Return type:: DnsZonePurpose | str

classmethod normalize_zone_class(v)¶

Parameters:: v (DnsRecordClass | str)
Return type:: DnsRecordClass | str

classmethod normalize_provenance(v)¶

Parameters:: v (DnsRecordProvenance | str)
Return type:: DnsRecordProvenance | str

classmethod coerce_zone_file_refs(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_zone_file_refs(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_zone()¶

Return type:: DnsZone

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsZoneKind¶

Bases: str, Enum

Portable zone role independent of one server’s configuration grammar.

PRIMARY = 'primary'¶

SECONDARY = 'secondary'¶

STUB = 'stub'¶

FORWARD = 'forward'¶

HINT = 'hint'¶

CATALOG = 'catalog'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsZonePurpose¶

Bases: str, Enum

Semantic purpose of a zone name.

FORWARD = 'forward'¶

REVERSE = 'reverse'¶

SERVICE_DISCOVERY = 'service_discovery'¶

INFRASTRUCTURE = 'infrastructure'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsZoneTransferPolicy¶

Bases: SDLModel

Observed zone-transfer posture for a DNS zone.

axfr_enabled: bool | str | None¶

ixfr_enabled: bool | str | None¶

allowed_clients: list[str]¶

primary_servers: list[str]¶

secondary_servers: list[str]¶

description: str¶

classmethod parse_optional_bool(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

bool | str | None

classmethod coerce_lists(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_selectors(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnssecValidationMode¶

Bases: str, Enum

Recursive DNSSEC validation posture.

ENABLED = 'enabled'¶

DISABLED = 'disabled'¶

AUTO = 'auto'¶

PERMISSIVE = 'permissive'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDnsService¶

Bases: SDLModel

An observed DNS service hosted by a node.

dns_service_id: str¶

service: str¶

implementation: DnsServerImplementation | str¶

version: str¶

name: str¶

roles: list[DnsServiceRole | str]¶

configuration_file_refs: list[str]¶

log_file_refs: list[str]¶

resolver_policy: DnsResolverPolicy | None¶

dynamic_update: DnsDynamicUpdatePolicy | None¶

zones: list[DnsZone]¶

settings: list[DnsRuntimeSetting]¶

description: str¶

classmethod validate_dns_service_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_implementation(v)¶

Parameters:: v (DnsServerImplementation | str)
Return type:: DnsServerImplementation | str

classmethod coerce_roles(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod normalize_roles(v)¶

Parameters:: v (list[DnsServiceRole | str])
Return type:: list[DnsServiceRole | str]

classmethod coerce_file_refs(v)¶

Parameters:: v (object)
Return type:: list[str]

classmethod validate_file_refs(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

validate_service()¶

Return type:: RuntimeDnsService

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.DnsServerImplementation¶

Bases: str, Enum

Portable implementation family for the observed DNS service.

BIND = 'bind'¶

COREDNS = 'coredns'¶

POWERDNS = 'powerdns'¶

KNOT_DNS = 'knot_dns'¶

NSD = 'nsd'¶

WINDOWS_DNS = 'windows_dns'¶

DNSMASQ = 'dnsmasq'¶

UNBOUND = 'unbound'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.DnsServiceRole¶

Bases: str, Enum

Role the DNS service performs for participants or peers.

AUTHORITATIVE = 'authoritative'¶

RECURSIVE_RESOLVER = 'recursive_resolver'¶

FORWARDING_RESOLVER = 'forwarding_resolver'¶

CACHING_RESOLVER = 'caching_resolver'¶

STUB_RESOLVER = 'stub_resolver'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityAttribute¶

Bases: SDLModel

Observed identity attribute or bounded setting.

Secret-bearing names must not carry raw values. This keeps directory passwords, Kerberos keys, keytabs, tokens, and client secrets out of fixtures, diagnostics, schemas, and generated runtime artifacts.

name: str¶

values: list[str]¶

value_classification: RuntimeSensitivityClassification | str¶

origin: RuntimeIdentityRecordOrigin | str¶

provenance: RuntimeIdentityRecordOrigin | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_values(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_values(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_origin(v)¶

Parameters:: v (RuntimeIdentityRecordOrigin | str)
Return type:: RuntimeIdentityRecordOrigin | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeIdentityRecordOrigin | str)
Return type:: RuntimeIdentityRecordOrigin | str

align_origin_and_provenance()¶

Return type:: RuntimeIdentityAttribute

validate_redacted_values()¶

Return type:: RuntimeIdentityAttribute

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentityAuthority¶

Bases: SDLModel

A node-scoped identity authority inventory.

identity_authority_id: str¶

kind: RuntimeIdentityAuthorityKind | str¶

name: str¶

namespace: str¶

domain_name: str¶

realm: str¶

issuer: str¶

tenant_id: str¶

base_dn: str¶

description: str¶

services: list[RuntimeIdentityAuthorityService]¶

subjects: list[RuntimeIdentitySubject]¶

policies: list[RuntimeIdentityPolicy]¶

relationships: list[RuntimeIdentityRelationship]¶

classmethod validate_identity_authority_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeIdentityAuthorityKind | str)
Return type:: RuntimeIdentityAuthorityKind | str

validate_authority()¶

Return type:: RuntimeIdentityAuthority

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentityAuthorityKind¶

Bases: str, Enum

Portable kind of identity authority represented by the inventory.

DIRECTORY = 'directory'¶

DOMAIN = 'domain'¶

KERBEROS_REALM = 'kerberos_realm'¶

IDENTITY_PROVIDER = 'identity_provider'¶

CLOUD_IAM = 'cloud_iam'¶

AUTHORIZATION_SYSTEM = 'authorization_system'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityAuthorityProtocol¶

Bases: str, Enum

Protocol or API family exposed by an identity authority service.

LDAP = 'ldap'¶

LDAPS = 'ldaps'¶

KERBEROS = 'kerberos'¶

SAML = 'saml'¶

OIDC = 'oidc'¶

OAUTH2 = 'oauth2'¶

SCIM = 'scim'¶

AD_DS_RPC = 'ad_ds_rpc'¶

GRAPH_API = 'graph_api'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityAuthorityService¶

Bases: SDLModel

A protocol/API endpoint associated with an identity authority.

service_id: str¶

service: str¶

protocol: RuntimeIdentityAuthorityProtocol | str¶

address: str¶

port: int | str | None¶

description: str¶

classmethod validate_service_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeIdentityAuthorityProtocol | str)
Return type:: RuntimeIdentityAuthorityProtocol | str

classmethod parse_port(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentityPolicy¶

Bases: SDLModel

Observed identity authority policy or bounded policy setting group.

policy_id: str¶

policy_kind: RuntimeIdentityPolicyKind | str¶

name: str¶

applies_to_refs: list[str]¶

settings: list[RuntimeIdentityAttribute]¶

description: str¶

classmethod validate_policy_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_policy_kind(v)¶

Parameters:: v (RuntimeIdentityPolicyKind | str)
Return type:: RuntimeIdentityPolicyKind | str

classmethod coerce_applies_to_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

validate_policy()¶

Return type:: RuntimeIdentityPolicy

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentityPolicyKind¶

Bases: str, Enum

Portable policy family attached to an identity authority.

PASSWORD = 'password'¶

LOCKOUT = 'lockout'¶

KERBEROS = 'kerberos'¶

ACCESS = 'access'¶

CONDITIONAL_ACCESS = 'conditional_access'¶

MFA = 'mfa'¶

GROUP_POLICY = 'group_policy'¶

TRUST = 'trust'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityRecordOrigin¶

Bases: str, Enum

Origin class for an observed identity authority record.

BUILT_IN = 'built_in'¶

DIRECTORY = 'directory'¶

SYNCHRONIZED = 'synchronized'¶

FEDERATED = 'federated'¶

PROVISIONED = 'provisioned'¶

RUNTIME_CREATED = 'runtime_created'¶

OPERATOR = 'operator'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityRelationship¶

Bases: SDLModel

Observed membership, trust, federation, or delegation relationship.

relationship_id: str¶

relationship_type: RuntimeIdentityRelationshipKind | str¶

source_ref: str¶

target_ref: str¶

external_target: str¶

description: str¶

classmethod validate_relationship_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_relationship_type(v)¶

Parameters:: v (RuntimeIdentityRelationshipKind | str)
Return type:: RuntimeIdentityRelationshipKind | str

classmethod validate_source_ref(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_optional_targets(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

validate_relationship_target()¶

Return type:: RuntimeIdentityRelationship

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentityRelationshipKind¶

Bases: str, Enum

Portable relationship kind between authority-local identity objects.

MEMBER_OF = 'member_of'¶

HAS_MEMBER = 'has_member'¶

TRUSTS = 'trusts'¶

FEDERATES_WITH = 'federates_with'¶

MANAGES = 'manages'¶

OWNS = 'owns'¶

DELEGATED_ADMIN = 'delegated_admin'¶

SYNCS_FROM = 'syncs_from'¶

ASSOCIATED = 'associated'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeIdentitySubject¶

Bases: SDLModel

An authority-local user, group, device, role, or service principal.

subject_id: str¶

kind: RuntimeIdentitySubjectKind | str¶

name: str¶

display_name: str¶

principal_name: str¶

distinguished_name: str¶

domain: str¶

enabled: bool | str | None¶

origin: RuntimeIdentityRecordOrigin | str¶

service_principal_names: list[str]¶

attributes: list[RuntimeIdentityAttribute]¶

description: str¶

classmethod validate_subject_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeIdentitySubjectKind | str)
Return type:: RuntimeIdentitySubjectKind | str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_enabled(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

classmethod normalize_origin(v)¶

Parameters:: v (RuntimeIdentityRecordOrigin | str)
Return type:: RuntimeIdentityRecordOrigin | str

classmethod coerce_service_principal_names(v)¶

Parameters:: v (Any)
Return type:: list[str]

validate_subject()¶

Return type:: RuntimeIdentitySubject

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeIdentitySubjectKind¶

Bases: str, Enum

Portable subject/principal kind within an identity authority.

USER = 'user'¶

GROUP = 'group'¶

COMPUTER = 'computer'¶

DEVICE = 'device'¶

SERVICE_ACCOUNT = 'service_account'¶

SERVICE_PRINCIPAL = 'service_principal'¶

ROLE = 'role'¶

APPLICATION = 'application'¶

ORGANIZATIONAL_UNIT = 'organizational_unit'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeFileService¶

Bases: SDLModel

A node-scoped runtime file-service inventory.

service references the owning same-node Node.services[].name (bare name or qualified nodes.<node>.services.<name>).

file_service_id: str¶

service: str¶

protocol: RuntimeFileServiceProtocol | str¶

backend: str¶

description: str¶

shares: list[RuntimeFileServiceShare]¶

principals: list[RuntimeFileServicePrincipal]¶

access_rules: list[RuntimeFileServiceAccessRule]¶

access_observations: list[RuntimeFileServiceAccessObservation]¶

classmethod validate_file_service_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeFileServiceProtocol | str)
Return type:: RuntimeFileServiceProtocol | str

validate_service()¶

Return type:: RuntimeFileService

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFileServiceAccessAction¶

Bases: str, Enum

Portable action vocabulary for file-service access policy/observations.

BROWSE = 'browse'¶

LIST = 'list'¶

READ = 'read'¶

WRITE = 'write'¶

CREATE = 'create'¶

DELETE = 'delete'¶

EXECUTE = 'execute'¶

ADMINISTER = 'administer'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceAccessBasis¶

Bases: str, Enum

Basis/provenance for an access claim or observation.

SHARE_CONFIG = 'share_config'¶

PASSDB = 'passdb'¶

FILESYSTEM_ACL = 'filesystem_acl'¶

DIRECTORY_POLICY = 'directory_policy'¶

OBSERVED_PROBE = 'observed_probe'¶

COMPUTED = 'computed'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceAccessEffect¶

Bases: str, Enum

Portable effect for an authored or computed file-service access rule.

ALLOW = 'allow'¶

DENY = 'deny'¶

NOT_APPLICABLE = 'not_applicable'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceAccessObservation¶

Bases: SDLModel

An observed probe outcome against a file-service resource.

Observations are evidence; they support but do not overwrite authored or configured policy.

observation_id: str¶

subject_ref: str¶

resource_ref: str¶

action: RuntimeFileServiceAccessAction | str¶

outcome: RuntimeFileServiceAccessOutcome | str¶

basis: RuntimeFileServiceAccessBasis | str¶

sensitivity: RuntimeSensitivityClassification | str¶

description: str¶

classmethod validate_observation_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_refs(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod normalize_action(v)¶

Parameters:: v (RuntimeFileServiceAccessAction | str)
Return type:: RuntimeFileServiceAccessAction | str

classmethod normalize_outcome(v)¶

Parameters:: v (RuntimeFileServiceAccessOutcome | str)
Return type:: RuntimeFileServiceAccessOutcome | str

classmethod normalize_basis(v)¶

Parameters:: v (RuntimeFileServiceAccessBasis | str)
Return type:: RuntimeFileServiceAccessBasis | str

classmethod normalize_sensitivity(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFileServiceAccessOutcome¶

Bases: str, Enum

Observed outcome class for a per-share access probe.

ALLOWED = 'allowed'¶

DENIED = 'denied'¶

ERROR = 'error'¶

NOT_OBSERVED = 'not_observed'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceAccessRule¶

Bases: SDLModel

An authored or computed access rule for a file-service resource.

rule_id: str¶

subject_ref: str¶

resource_ref: str¶

action: RuntimeFileServiceAccessAction | str¶

effect: RuntimeFileServiceAccessEffect | str¶

basis: RuntimeFileServiceAccessBasis | str¶

description: str¶

classmethod validate_rule_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_refs(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod normalize_action(v)¶

Parameters:: v (RuntimeFileServiceAccessAction | str)
Return type:: RuntimeFileServiceAccessAction | str

classmethod normalize_effect(v)¶

Parameters:: v (RuntimeFileServiceAccessEffect | str)
Return type:: RuntimeFileServiceAccessEffect | str

classmethod normalize_basis(v)¶

Parameters:: v (RuntimeFileServiceAccessBasis | str)
Return type:: RuntimeFileServiceAccessBasis | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFileServiceCredentialClassification¶

Bases: str, Enum

Semantic classification of a service-local credential.

The raw credential value MUST NOT be recorded; the principal model has no field that can hold one. This vocabulary is the only credential representation in the file-service surface — it describes the strength/posture of the credential as observed (or its absence) so downstream consumers can reason about exposure without leaking secret material into fixtures, schemas, diagnostics, or logs.

NO_CREDENTIAL = 'no_credential'¶

WEAK = 'weak'¶

DEFAULT_OR_TRIVIAL = 'default_or_trivial'¶

STRONG = 'strong'¶

REDACTED = 'redacted'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServicePrincipal¶

Bases: SDLModel

A service-local principal (Samba passdb-style account or group).

Service-local principals are NOT promoted to top-level accounts, runtime.local_identity, or runtime.identity_authorities. Optional local_user_ref and directory_subject_ref carry refs to those surfaces when a mapping is observed.

Raw credential material (passwords, NT/LM hashes, Kerberos keys, private keys, bearer tokens, captured credentials) is unrepresentable on this record per ADR-037 §4 and the secret-handling gate; only credential_classification is carried, so the field surface itself cannot smuggle a secret into models, schemas, fixtures, diagnostics, or snapshots.

principal_id: str¶

kind: RuntimeFileServicePrincipalKind | str¶

name: str¶

external_id: str¶

status: RuntimeFileServicePrincipalStatus | str¶

credential_classification: RuntimeFileServiceCredentialClassification | str¶

origin: RuntimeFileServicePrincipalOrigin | str¶

local_user_ref: str¶

directory_subject_ref: str¶

description: str¶

classmethod validate_principal_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeFileServicePrincipalKind | str)
Return type:: RuntimeFileServicePrincipalKind | str

classmethod normalize_status(v)¶

Parameters:: v (RuntimeFileServicePrincipalStatus | str)
Return type:: RuntimeFileServicePrincipalStatus | str

classmethod normalize_credential_classification(v)¶

Parameters:: v (RuntimeFileServiceCredentialClassification | str)
Return type:: RuntimeFileServiceCredentialClassification | str

classmethod normalize_origin(v)¶

Parameters:: v (RuntimeFileServicePrincipalOrigin | str)
Return type:: RuntimeFileServicePrincipalOrigin | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFileServicePrincipalKind¶

Bases: str, Enum

Portable kind of a service-local principal in a file service.

USER = 'user'¶

GROUP = 'group'¶

MACHINE = 'machine'¶

ALIAS = 'alias'¶

GUEST = 'guest'¶

ANONYMOUS = 'anonymous'¶

SERVICE_ACCOUNT = 'service_account'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeFileServicePrincipalStatus¶

Bases: str, Enum

Observed account status for a service-local principal.

ENABLED = 'enabled'¶

DISABLED = 'disabled'¶

LOCKED = 'locked'¶

NO_LOGIN = 'no_login'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServicePrincipalOrigin¶

Bases: str, Enum

Origin/provenance class for a service-local principal record.

BUILT_IN = 'built_in'¶

PROVISIONED = 'provisioned'¶

SYNCHRONIZED = 'synchronized'¶

RUNTIME_CREATED = 'runtime_created'¶

OPERATOR = 'operator'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceProtocol¶

Bases: str, Enum

Portable protocol family for an observed runtime file service.

SMB = 'smb'¶

CIFS = 'cifs'¶

NFS = 'nfs'¶

AFP = 'afp'¶

FTP = 'ftp'¶

SFTP = 'sftp'¶

WEBDAV = 'webdav'¶

OBJECT_STORE = 'object_store'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeFileServiceShare¶

Bases: SDLModel

A published share/resource on a runtime file service.

share_id: str¶

name: str¶

kind: RuntimeFileShareKind | str¶

backing_path: str¶

comment: str¶

read_only: bool | str | None¶

browseable: bool | str | None¶

guest_ok: bool | str | None¶

valid_users: list[str]¶

valid_groups: list[str]¶

invalid_users: list[str]¶

write_users: list[str]¶

description: str¶

classmethod validate_share_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeFileShareKind | str)
Return type:: RuntimeFileShareKind | str

classmethod validate_backing_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_share_bool(v, info)¶

Parameters:

v (bool | str | None)
info (ValidationInfo)

Return type:

bool | str | None

classmethod coerce_user_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFileShareKind¶

Bases: str, Enum

Observed kind of a published file-service share/resource.

DISK = 'disk'¶

IPC = 'ipc'¶

PRINTER = 'printer'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RelationshipMailAccess¶

Bases: SDLModel

Typed mail-access detail carried by a top-level relationship edge.

protocol: RuntimeMailProtocol | str¶

auth_mechanism: RuntimeMailAuthMechanism | str¶

tls_mode: RuntimeMailTlsMode | str¶

listener_ref: str¶

mailbox_ref: str¶

domain_ref: str¶

description: str¶

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeMailProtocol | str)
Return type:: RuntimeMailProtocol | str

classmethod normalize_auth_mechanism(v)¶

Parameters:: v (RuntimeMailAuthMechanism | str)
Return type:: RuntimeMailAuthMechanism | str

classmethod normalize_tls_mode(v)¶

Parameters:: v (RuntimeMailTlsMode | str)
Return type:: RuntimeMailTlsMode | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailAlias¶

Bases: SDLModel

A service-local mailbox alias or forwarding address.

alias_id: str¶

address: str¶

domain_ref: str¶

target_refs: list[str]¶

external_targets: list[str]¶

description: str¶

classmethod validate_alias_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_targets(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_external_targets(v)¶

Parameters:: v (list[str])
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailAuthMechanism¶

Bases: str, Enum

Portable mail authentication mechanism vocabulary.

NONE = 'none'¶

PLAIN = 'plain'¶

LOGIN = 'login'¶

CRAM_MD5 = 'cram_md5'¶

DIGEST_MD5 = 'digest_md5'¶

SCRAM_SHA_1 = 'scram_sha_1'¶

SCRAM_SHA_256 = 'scram_sha_256'¶

OAUTHBEARER = 'oauthbearer'¶

EXTERNAL = 'external'¶

ANONYMOUS = 'anonymous'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailComponent¶

Bases: SDLModel

A mail-service engine/component such as Postfix, Dovecot, or a filter.

component_id: str¶

kind: RuntimeMailComponentKind | str¶

name: str¶

version: str¶

description: str¶

classmethod validate_component_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeMailComponentKind | str)
Return type:: RuntimeMailComponentKind | str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailComponentKind¶

Bases: str, Enum

Portable component kind inside a runtime mail service.

MTA = 'mta'¶

MDA = 'mda'¶

IMAP_SERVER = 'imap_server'¶

POP3_SERVER = 'pop3_server'¶

SUBMISSION_AGENT = 'submission_agent'¶

MAILBOX_STORE = 'mailbox_store'¶

SPAM_FILTER = 'spam_filter'¶

ANTIVIRUS = 'antivirus'¶

QUEUE_MANAGER = 'queue_manager'¶

RELAY = 'relay'¶

POLICY_SERVICE = 'policy_service'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailCredentialClassification¶

Bases: str, Enum

Semantic classification of a mailbox credential, never its raw value.

NO_CREDENTIAL = 'no_credential'¶

WEAK = 'weak'¶

DEFAULT_OR_TRIVIAL = 'default_or_trivial'¶

FIXTURE = 'fixture'¶

STRONG = 'strong'¶

REDACTED = 'redacted'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeMailDomain¶

Bases: SDLModel

A domain known to the runtime mail service.

domain_id: str¶

name: str¶

role: RuntimeMailDomainRole | str¶

description: str¶

classmethod validate_domain_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role(v)¶

Parameters:: v (RuntimeMailDomainRole | str)
Return type:: RuntimeMailDomainRole | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailDomainRole¶

Bases: str, Enum

Role of a domain known to the mail service.

LOCAL_DELIVERY = 'local_delivery'¶

VIRTUAL = 'virtual'¶

RELAY = 'relay'¶

ALIAS = 'alias'¶

CATCH_ALL = 'catch_all'¶

OUTBOUND = 'outbound'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailListener¶

Bases: SDLModel

A protocol listener bound to a same-node transport service.

listener_id: str¶

service: str¶

protocol: RuntimeMailProtocol | str¶

role: RuntimeMailListenerRole | str¶

component_ref: str¶

banner: str¶

advertised_identity: str¶

capabilities: list[str]¶

auth_mechanisms: list[RuntimeMailAuthMechanism | str]¶

tls_mode: RuntimeMailTlsMode | str¶

tls_versions: list[str]¶

description: str¶

classmethod validate_listener_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeMailProtocol | str)
Return type:: RuntimeMailProtocol | str

classmethod normalize_role(v)¶

Parameters:: v (RuntimeMailListenerRole | str)
Return type:: RuntimeMailListenerRole | str

classmethod coerce_string_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod coerce_auth_mechanisms(v)¶

Parameters:: v (Any)
Return type:: list[Any]

classmethod normalize_auth_mechanisms(v)¶

Parameters:: v (list[RuntimeMailAuthMechanism | str])
Return type:: list[RuntimeMailAuthMechanism | str]

classmethod normalize_tls_mode(v)¶

Parameters:: v (RuntimeMailTlsMode | str)
Return type:: RuntimeMailTlsMode | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailListenerRole¶

Bases: str, Enum

Observed role a mail listener plays for the node-scoped mail service.

INBOUND_MX = 'inbound_mx'¶

SUBMISSION = 'submission'¶

MAIL_ACCESS = 'mail_access'¶

LOCAL_DELIVERY = 'local_delivery'¶

RELAY = 'relay'¶

LMTP = 'lmtp'¶

SIEVE = 'sieve'¶

MONITORING = 'monitoring'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailMailbox¶

Bases: SDLModel

A service-local mailbox/account record.

Raw credentials are intentionally unrepresentable. The model records only authentication mechanisms and credential-strength classification.

mailbox_id: str¶

address: str¶

local_part: str¶

domain_ref: str¶

role: RuntimeMailMailboxRole | str¶

status: RuntimeMailMailboxStatus | str¶

auth_mechanisms: list[RuntimeMailAuthMechanism | str]¶

credential_classification: RuntimeMailCredentialClassification | str¶

store_ref: str¶

account_ref: str¶

local_user_ref: str¶

description: str¶

classmethod validate_mailbox_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role(v)¶

Parameters:: v (RuntimeMailMailboxRole | str)
Return type:: RuntimeMailMailboxRole | str

classmethod normalize_status(v)¶

Parameters:: v (RuntimeMailMailboxStatus | str)
Return type:: RuntimeMailMailboxStatus | str

classmethod coerce_auth_mechanisms(v)¶

Parameters:: v (Any)
Return type:: list[Any]

classmethod normalize_auth_mechanisms(v)¶

Parameters:: v (list[RuntimeMailAuthMechanism | str])
Return type:: list[RuntimeMailAuthMechanism | str]

classmethod normalize_credential_classification(v)¶

Parameters:: v (RuntimeMailCredentialClassification | str)
Return type:: RuntimeMailCredentialClassification | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailMailboxRole¶

Bases: str, Enum

Portable role/classification of a service-local mailbox.

USER = 'user'¶

ADMIN = 'admin'¶

SERVICE = 'service'¶

SHARED = 'shared'¶

POSTMASTER = 'postmaster'¶

ABUSE = 'abuse'¶

AUTOMATED = 'automated'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailMailboxStatus¶

Bases: str, Enum

Observed account status for a service-local mailbox.

ENABLED = 'enabled'¶

DISABLED = 'disabled'¶

LOCKED = 'locked'¶

SUSPENDED = 'suspended'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeMailMailboxStore¶

Bases: SDLModel

Mailbox storage backing for service-local mailboxes.

store_id: str¶

kind: RuntimeMailMailboxStoreKind | str¶

path: str¶

description: str¶

classmethod validate_store_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeMailMailboxStoreKind | str)
Return type:: RuntimeMailMailboxStoreKind | str

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailMailboxStoreKind¶

Bases: str, Enum

Observed mailbox storage backing kind.

MAILDIR = 'maildir'¶

MBOX = 'mbox'¶

DATABASE = 'database'¶

OBJECT_STORE = 'object_store'¶

REMOTE = 'remote'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailProtocol¶

Bases: str, Enum

Portable protocol family for a runtime mail listener or relationship.

SMTP = 'smtp'¶

ESMTP = 'esmtp'¶

SUBMISSION = 'submission'¶

SMTPS = 'smtps'¶

IMAP = 'imap'¶

IMAPS = 'imaps'¶

POP3 = 'pop3'¶

POP3S = 'pop3s'¶

LMTP = 'lmtp'¶

SIEVE = 'sieve'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailQueue¶

Bases: SDLModel

Shape of a mail queue; dynamic content is explicitly classified.

queue_id: str¶

kind: RuntimeMailQueueKind | str¶

name: str¶

message_count: int | str | None¶

stability: RuntimeMailQueueStability | str¶

description: str¶

classmethod validate_queue_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeMailQueueKind | str)
Return type:: RuntimeMailQueueKind | str

classmethod parse_message_count(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod normalize_stability(v)¶

Parameters:: v (RuntimeMailQueueStability | str)
Return type:: RuntimeMailQueueStability | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailQueueKind¶

Bases: str, Enum

Observed mail queue kind.

INCOMING = 'incoming'¶

ACTIVE = 'active'¶

DEFERRED = 'deferred'¶

HOLD = 'hold'¶

BOUNCE = 'bounce'¶

CORRUPT = 'corrupt'¶

MAILDROP = 'maildrop'¶

MAILBOX = 'mailbox'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailQueueStability¶

Bases: str, Enum

Stability class for dynamic mail queue facts.

STEADY_STATE = 'steady_state'¶

DYNAMIC = 'dynamic'¶

VOLATILE = 'volatile'¶

LOG_DERIVED = 'log_derived'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeMailRoutingKind¶

Bases: str, Enum

Portable mail routing/aliasing rule kind.

ALIAS = 'alias'¶

FORWARD = 'forward'¶

VIRTUAL_ALIAS = 'virtual_alias'¶

RELAY = 'relay'¶

LOCAL_DELIVERY = 'local_delivery'¶

CATCH_ALL = 'catch_all'¶

LIST = 'list'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeMailRoutingRule¶

Bases: SDLModel

A portable routing, aliasing, local-delivery, or relay rule.

rule_id: str¶

kind: RuntimeMailRoutingKind | str¶

source_ref: str¶

target_ref: str¶

relay_host: str¶

description: str¶

classmethod validate_rule_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeMailRoutingKind | str)
Return type:: RuntimeMailRoutingKind | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailService¶

Bases: SDLModel

A node-scoped runtime mail-service logical inventory.

mail_service_id: str¶

service: str¶

engine: str¶

version: str¶

name: str¶

description: str¶

components: list[RuntimeMailComponent]¶

listeners: list[RuntimeMailListener]¶

domains: list[RuntimeMailDomain]¶

mailbox_stores: list[RuntimeMailMailboxStore]¶

mailboxes: list[RuntimeMailMailbox]¶

aliases: list[RuntimeMailAlias]¶

routing_rules: list[RuntimeMailRoutingRule]¶

queues: list[RuntimeMailQueue]¶

settings: list[RuntimeMailSetting]¶

classmethod validate_mail_service_id(v)¶

Parameters:: v (str)
Return type:: str

validate_service()¶

Return type:: RuntimeMailService

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailSetting¶

Bases: SDLModel

A mail-service runtime setting with source/provenance and redaction.

setting_id: str¶

component_ref: str¶

name: str¶

value: str¶

value_classification: RuntimeSensitivityClassification | str¶

provenance: RuntimeMailSettingProvenance | str¶

source_path: str¶

description: str¶

classmethod validate_setting_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeMailSettingProvenance | str)
Return type:: RuntimeMailSettingProvenance | str

classmethod validate_source_path(v)¶

Parameters:: v (str)
Return type:: str

validate_redacted_value()¶

Return type:: RuntimeMailSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMailSettingProvenance¶

Bases: str, Enum

Origin/provenance class for a mail-service configuration setting.

CONFIGURATION_FILE = 'configuration_file'¶

COMMAND_OUTPUT = 'command_output'¶

IMAGE_DEFAULT = 'image_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

RUNTIME_DEFAULT = 'runtime_default'¶

ENVIRONMENT = 'environment'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeMailTlsMode¶

Bases: str, Enum

Observed TLS/STARTTLS posture for a mail listener or relationship.

NONE = 'none'¶

STARTTLS_AVAILABLE = 'starttls_available'¶

STARTTLS_REQUIRED = 'starttls_required'¶

IMPLICIT_TLS = 'implicit_tls'¶

TLS_TERMINATED_UPSTREAM = 'tls_terminated_upstream'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkSensor¶

Bases: SDLModel

Node-scoped runtime inventory for a passive or inline network sensor.

network_sensor_id: str¶

implementation: RuntimeNetworkSensorImplementation | str¶

sensor_kind: RuntimeNetworkSensorKind | str¶

monitoring_posture: RuntimeNetworkSensorMonitoringPosture | str¶

capture_mode: RuntimeNetworkSensorCaptureMode | str¶

capture_interfaces: list[str]¶

monitored_network_refs: list[str]¶

process_ref: str¶

version: str¶

revision: str¶

name: str¶

configuration_file_refs: list[str]¶

log_file_refs: list[str]¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_network_sensor_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_implementation(v)¶

Parameters:: v (RuntimeNetworkSensorImplementation | str)
Return type:: RuntimeNetworkSensorImplementation | str

classmethod normalize_sensor_kind(v)¶

Parameters:: v (RuntimeNetworkSensorKind | str)
Return type:: RuntimeNetworkSensorKind | str

classmethod normalize_monitoring_posture(v)¶

Parameters:: v (RuntimeNetworkSensorMonitoringPosture | str)
Return type:: RuntimeNetworkSensorMonitoringPosture | str

classmethod normalize_capture_mode(v)¶

Parameters:: v (RuntimeNetworkSensorCaptureMode | str)
Return type:: RuntimeNetworkSensorCaptureMode | str

classmethod coerce_ref_lists(v)¶

Parameters:: v (object)
Return type:: object

classmethod coerce_file_refs(v)¶

Parameters:: v (object)
Return type:: object

classmethod validate_file_refs(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

validate_unique_refs()¶

Return type:: RuntimeNetworkSensor

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkSensorCaptureMode¶

Bases: str, Enum

Portable capture mechanism family for an observed sensor.

PCAP = 'pcap'¶

AF_PACKET = 'af_packet'¶

NFQUEUE = 'nfqueue'¶

NETMAP = 'netmap'¶

DPDK = 'dpdk'¶

FLOW = 'flow'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkSensorImplementation¶

Bases: str, Enum

Observed product family for a network sensor.

SURICATA = 'suricata'¶

SNORT = 'snort'¶

ZEEK = 'zeek'¶

TCPDUMP = 'tcpdump'¶

SECURITY_ONION = 'security_onion'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkSensorKind¶

Bases: str, Enum

Portable network-sensor function.

IDS = 'ids'¶

IPS = 'ips'¶

NSM = 'nsm'¶

NDR = 'ndr'¶

PACKET_CAPTURE = 'packet_capture'¶

FLOW_COLLECTOR = 'flow_collector'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkSensorMonitoringPosture¶

Bases: str, Enum

Whether the sensor observes passively, inline, or locally.

PASSIVE = 'passive'¶

INLINE = 'inline'¶

HOST_LOCAL = 'host_local'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionAppProtocol¶

Bases: str, Enum

App-layer parser family enabled in the detection engine.

HTTP = 'http'¶

TLS = 'tls'¶

DNS = 'dns'¶

SSH = 'ssh'¶

SMTP = 'smtp'¶

FTP = 'ftp'¶

SMB = 'smb'¶

HTTP2 = 'http2'¶

NFS = 'nfs'¶

RDP = 'rdp'¶

KRB5 = 'krb5'¶

MQTT = 'mqtt'¶

MODBUS = 'modbus'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionControlCapability¶

Bases: str, Enum

Operation supported by a detection-engine control channel.

RULE_RELOAD = 'rule_reload'¶

RULESET_UPDATE = 'ruleset_update'¶

CONFIG_RELOAD = 'config_reload'¶

STATS_QUERY = 'stats_query'¶

PAUSE = 'pause'¶

RESUME = 'resume'¶

SHUTDOWN = 'shutdown'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionControlChannel¶

Bases: SDLModel

A bounded detection-engine control or reload channel.

channel_id: str¶

kind: RuntimeNetworkDetectionControlChannelKind | str¶

path: str¶

service: str¶

capabilities: list[RuntimeNetworkDetectionControlCapability | str]¶

auth_required: bool | str | None¶

description: str¶

classmethod validate_channel_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeNetworkDetectionControlChannelKind | str)
Return type:: object

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_capabilities(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_auth_required(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_unique_capabilities()¶

Return type:: RuntimeNetworkDetectionControlChannel

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDetectionControlChannelKind¶

Bases: str, Enum

Portable local or remote control-channel family.

UNIX_SOCKET = 'unix_socket'¶

TCP_API = 'tcp_api'¶

HTTP_API = 'http_api'¶

CLI = 'cli'¶

SIGNAL = 'signal'¶

FILE_DROP = 'file_drop'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionEngine¶

Bases: SDLModel

Node-scoped runtime inventory for an IDS/NDR detection engine.

network_detection_engine_id: str¶

implementation: RuntimeNetworkDetectionEngineImplementation | str¶

engine_kind: RuntimeNetworkDetectionEngineKind | str¶

version: str¶

revision: str¶

name: str¶

process_ref: str¶

sensor_ref: str¶

configuration_file_refs: list[str]¶

log_file_refs: list[str]¶

evidence_refs: list[str]¶

app_layer_protocols: list[RuntimeNetworkDetectionAppProtocol | str]¶

rule_sources: list[RuntimeNetworkDetectionRuleSource]¶

network_sets: list[RuntimeNetworkDetectionNetworkSet]¶

output_streams: list[RuntimeNetworkDetectionOutputStream]¶

control_channels: list[RuntimeNetworkDetectionControlChannel]¶

description: str¶

classmethod validate_network_detection_engine_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_implementation(v)¶

Parameters:: v (RuntimeNetworkDetectionEngineImplementation | str)
Return type:: object

classmethod normalize_engine_kind(v)¶

Parameters:: v (RuntimeNetworkDetectionEngineKind | str)
Return type:: object

classmethod coerce_file_refs(v)¶

Parameters:: v (object)
Return type:: object

classmethod validate_file_refs(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

classmethod normalize_app_layer_protocols(v)¶

Parameters:: v (object)
Return type:: object

validate_engine()¶

Return type:: RuntimeNetworkDetectionEngine

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDetectionEngineImplementation¶

Bases: str, Enum

Observed product family for a network detection engine.

SURICATA = 'suricata'¶

SNORT = 'snort'¶

ZEEK = 'zeek'¶

SECURITY_ONION = 'security_onion'¶

ARKIME = 'arkime'¶

CORELIGHT = 'corelight'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionEngineKind¶

Bases: str, Enum

Portable detection-engine role/family.

IDS = 'ids'¶

IPS = 'ips'¶

NDR = 'ndr'¶

NSM = 'nsm'¶

NTA = 'nta'¶

DETECTION_ENGINE = 'detection_engine'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionEventType¶

Bases: str, Enum

Event family emitted by a detection output stream.

ALERT = 'alert'¶

HTTP = 'http'¶

DNS = 'dns'¶

TLS = 'tls'¶

SSH = 'ssh'¶

SMTP = 'smtp'¶

FTP = 'ftp'¶

SMB = 'smb'¶

FLOW = 'flow'¶

NETFLOW = 'netflow'¶

STATS = 'stats'¶

FILEINFO = 'fileinfo'¶

ANOMALY = 'anomaly'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionNetworkSet¶

Bases: SDLModel

A network zoning or service-group address-set variable.

set_id: str¶

kind: RuntimeNetworkDetectionNetworkSetKind | str¶

name: str¶

selector_values: list[str]¶

network_refs: list[str]¶

description: str¶

classmethod validate_set_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeNetworkDetectionNetworkSetKind | str)
Return type:: object

classmethod coerce_lists(v)¶

Parameters:: v (object)
Return type:: object

validate_unique_values()¶

Return type:: RuntimeNetworkDetectionNetworkSet

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDetectionNetworkSetKind¶

Bases: str, Enum

Portable network/address-set variable role.

HOME_NET = 'home_net'¶

EXTERNAL_NET = 'external_net'¶

DMZ_NET = 'dmz_net'¶

INTERNAL_NET = 'internal_net'¶

SERVICE_GROUP = 'service_group'¶

CUSTOM = 'custom'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionOutputFormat¶

Bases: str, Enum

Portable detection output stream format.

EVE_JSON = 'eve_json'¶

FAST_LOG = 'fast_log'¶

JSON = 'json'¶

PCAP = 'pcap'¶

NETFLOW = 'netflow'¶

SYSLOG = 'syslog'¶

TEXT = 'text'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionOutputStream¶

Bases: SDLModel

A detection alert, telemetry, or summary output stream.

stream_id: str¶

format: RuntimeNetworkDetectionOutputFormat | str¶

path: str¶

event_types: list[RuntimeNetworkDetectionEventType | str]¶

enabled: bool | str | None¶

description: str¶

classmethod validate_stream_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_format(v)¶

Parameters:: v (RuntimeNetworkDetectionOutputFormat | str)
Return type:: object

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_event_types(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_unique_events()¶

Return type:: RuntimeNetworkDetectionOutputStream

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDetectionRuleFormat¶

Bases: str, Enum

Portable rule/content syntax family.

SURICATA_RULE = 'suricata_rule'¶

SNORT_RULE = 'snort_rule'¶

ZEEK_SCRIPT = 'zeek_script'¶

SIGMA = 'sigma'¶

YARA = 'yara'¶

STIX = 'stix'¶

JSON = 'json'¶

YAML = 'yaml'¶

TEXT = 'text'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkDetectionRuleSource¶

Bases: SDLModel

A loaded rule, IOC, script, or managed detection-content source.

source_id: str¶

kind: RuntimeNetworkDetectionRuleSourceKind | str¶

format: RuntimeNetworkDetectionRuleFormat | str¶

name: str¶

rule_count: int | str | None¶

file_refs: list[str]¶

generated_by: str¶

loaded: bool | str | None¶

description: str¶

classmethod validate_source_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeNetworkDetectionRuleSourceKind | str)
Return type:: object

classmethod normalize_format(v)¶

Parameters:: v (RuntimeNetworkDetectionRuleFormat | str)
Return type:: object

classmethod parse_rule_count(v)¶

Parameters:: v (object)
Return type:: int | str | None

classmethod coerce_file_refs(v)¶

Parameters:: v (object)
Return type:: object

classmethod validate_file_refs(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod parse_loaded(v)¶

Parameters:: v (object)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDetectionRuleSourceKind¶

Bases: str, Enum

Portable rule-source provenance/family.

BUILT_IN = 'built_in'¶

COMMUNITY = 'community'¶

MANAGED = 'managed'¶

LOCAL = 'local'¶

THREAT_INTEL = 'threat_intel'¶

IOC = 'ioc'¶

EMERGING_THREATS = 'emerging_threats'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringAgent¶

Bases: SDLModel

An agent or sensor enrolled with the manager.

agent_id: str¶

name: str¶

status: RuntimeSecurityMonitoringAgentStatus | str¶

address: str¶

version: str¶

os: str¶

node_ref: str¶

group_refs: list[str]¶

description: str¶

classmethod validate_agent_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_status(v)¶

Parameters:: v (RuntimeSecurityMonitoringAgentStatus | str)
Return type:: RuntimeSecurityMonitoringAgentStatus | str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_group_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringAgentGroup¶

Bases: SDLModel

A manager-side enrolled-agent group.

group_id: str¶

name: str¶

member_refs: list[str]¶

configuration_file_refs: list[str]¶

description: str¶

classmethod validate_group_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_configuration_file_refs(v)¶

Parameters:: v (list[str])
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringAgentStatus¶

Bases: str, Enum

Observed enrolled-agent status.

AVAILABLE = 'available'¶

ACTIVE = 'active'¶

DISCONNECTED = 'disconnected'¶

NEVER_CONNECTED = 'never_connected'¶

PENDING = 'pending'¶

REMOVED = 'removed'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringComponent¶

Bases: SDLModel

A manager daemon, module, or internal component.

component_id: str¶

kind: RuntimeSecurityMonitoringComponentKind | str¶

name: str¶

status: RuntimeSecurityMonitoringComponentStatus | str¶

enabled: bool | str | None¶

process_ref: str¶

description: str¶

classmethod validate_component_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeSecurityMonitoringComponentKind | str)
Return type:: RuntimeSecurityMonitoringComponentKind | str

classmethod normalize_status(v)¶

Parameters:: v (RuntimeSecurityMonitoringComponentStatus | str)
Return type:: RuntimeSecurityMonitoringComponentStatus | str

classmethod parse_enabled(v)¶

Parameters:: v (Any)
Return type:: bool | str | None

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringComponentKind¶

Bases: str, Enum

Portable component/module kind inside a security-monitoring manager.

ANALYSIS_ENGINE = 'analysis_engine'¶

AGENT_INGESTION = 'agent_ingestion'¶

AGENT_ENROLLMENT = 'agent_enrollment'¶

MODULE_SUPERVISOR = 'module_supervisor'¶

LOG_COLLECTION = 'log_collection'¶

ALERTING = 'alerting'¶

API = 'api'¶

CLUSTER = 'cluster'¶

INDEXER_FORWARDER = 'indexer_forwarder'¶

VULNERABILITY_DETECTION = 'vulnerability_detection'¶

FILE_INTEGRITY_MONITORING = 'file_integrity_monitoring'¶

ROOTKIT_DETECTION = 'rootkit_detection'¶

SCA = 'sca'¶

ACTIVE_RESPONSE = 'active_response'¶

INTEGRATION = 'integration'¶

DATABASE = 'database'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringComponentStatus¶

Bases: str, Enum

Observed component/module status.

RUNNING = 'running'¶

STOPPED = 'stopped'¶

DISABLED = 'disabled'¶

ENABLED = 'enabled'¶

DEGRADED = 'degraded'¶

FAILED = 'failed'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringContentFormat¶

Bases: str, Enum

Portable format family for manager-owned content.

WAZUH_RULE_XML = 'wazuh_rule_xml'¶

WAZUH_DECODER_XML = 'wazuh_decoder_xml'¶

SIGMA = 'sigma'¶

YARA = 'yara'¶

STIX = 'stix'¶

JSON = 'json'¶

YAML = 'yaml'¶

XML = 'xml'¶

QUERY = 'query'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringContentKind¶

Bases: str, Enum

Kind of manager-owned detection or monitoring content.

RULE_CORPUS = 'rule_corpus'¶

DECODER_CORPUS = 'decoder_corpus'¶

CORRELATION_RULES = 'correlation_rules'¶

SCA_POLICIES = 'sca_policies'¶

ACTIVE_RESPONSE = 'active_response'¶

CDB_LIST = 'cdb_list'¶

THREAT_INTEL = 'threat_intel'¶

DASHBOARD = 'dashboard'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringContentSet¶

Bases: SDLModel

A manager-owned rule, decoder, policy, list, or query corpus.

content_id: str¶

kind: RuntimeSecurityMonitoringContentKind | str¶

format: RuntimeSecurityMonitoringContentFormat | str¶

name: str¶

file_count: int | str | None¶

file_refs: list[str]¶

loaded: bool | str | None¶

description: str¶

classmethod validate_content_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeSecurityMonitoringContentKind | str)
Return type:: RuntimeSecurityMonitoringContentKind | str

classmethod normalize_format(v)¶

Parameters:: v (RuntimeSecurityMonitoringContentFormat | str)
Return type:: RuntimeSecurityMonitoringContentFormat | str

classmethod parse_file_count(v)¶

Parameters:: v (Any)
Return type:: int | str | None

classmethod coerce_file_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_file_refs(v)¶

Parameters:: v (list[str])
Return type:: list[str]

classmethod parse_loaded(v)¶

Parameters:: v (Any)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringDetectionDefinition¶

Bases: SDLModel

A parsed detection definition loaded by a security-monitoring manager.

definition_id: str¶

engine: RuntimeSecurityMonitoringDetectionEngine | str¶

definition_kind: RuntimeSecurityMonitoringDetectionDefinitionKind | str¶

native_id: str¶

name: str¶

content_set_ref: str¶

source_artifact_ref: str¶

source_file_ref: str¶

source_start_line: int | str | None¶

source_end_line: int | str | None¶

digest_algorithm: str¶

canonical_digest: str¶

enabled: bool | str | None¶

loaded: bool | str | None¶

parser_accepted: bool | str | None¶

level: int | str | None¶

severity: str¶

description: str¶

match_strings: list[str]¶

regex_patterns: list[str]¶

field_predicates: list[RuntimeSecurityMonitoringFieldPredicate]¶

decoded_as: list[str]¶

decoder_names: list[str]¶

decoder_fields: list[str]¶

if_sid_refs: list[str]¶

if_matched_sid_refs: list[str]¶

parent_definition_refs: list[str]¶

frequency: int | str | None¶

timeframe_seconds: int | str | None¶

same_source_constraints: list[str]¶

groups: list[str]¶

mitre_attack_ids: list[str]¶

compliance_tags: list[str]¶

tactic_labels: list[str]¶

technique_labels: list[str]¶

tags: list[str]¶

target_refs: list[str]¶

evidence_refs: list[str]¶

classmethod validate_definition_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_engine(v)¶

Parameters:: v (RuntimeSecurityMonitoringDetectionEngine | str)
Return type:: RuntimeSecurityMonitoringDetectionEngine | str

classmethod normalize_definition_kind(v)¶

Parameters:: v (RuntimeSecurityMonitoringDetectionDefinitionKind | str)
Return type:: RuntimeSecurityMonitoringDetectionDefinitionKind | str

classmethod validate_source_file_ref(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_source_line(v, info)¶

Parameters:

v (Any)
info (ValidationInfo)

Return type:

int | str | None

classmethod parse_non_negative_int(v, info)¶

Parameters:

v (Any)
info (ValidationInfo)

Return type:

int | str | None

classmethod parse_level(v)¶

Parameters:: v (Any)
Return type:: int | str | None

classmethod parse_optional_state_bool(v, info)¶

Parameters:

v (Any)
info (ValidationInfo)

Return type:

bool | str | None

classmethod coerce_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_evidence_refs(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_definition()¶

Return type:: RuntimeSecurityMonitoringDetectionDefinition

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringDetectionDefinitionKind¶

Bases: str, Enum

Portable kind of parsed security-monitoring detection definition.

RULE = 'rule'¶

CORRELATION_RULE = 'correlation_rule'¶

DECODER = 'decoder'¶

LIST_BACKED_RULE = 'list_backed_rule'¶

SCA_POLICY_CHECK = 'sca_policy_check'¶

ACTIVE_RESPONSE_TRIGGER = 'active_response_trigger'¶

SIGMA_RULE = 'sigma_rule'¶

YARA_RULE = 'yara_rule'¶

SURICATA_RULE = 'suricata_rule'¶

SIEM_ANALYTIC = 'siem_analytic'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringDetectionEngine¶

Bases: str, Enum

Portable detection-definition engine family.

WAZUH = 'wazuh'¶

OSSEC = 'ossec'¶

SIGMA = 'sigma'¶

YARA = 'yara'¶

SURICATA = 'suricata'¶

ELASTIC_SECURITY = 'elastic_security'¶

SPLUNK_ENTERPRISE_SECURITY = 'splunk_enterprise_security'¶

MICROSOFT_SENTINEL = 'microsoft_sentinel'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringFieldPredicate¶

Bases: SDLModel

A normalized field predicate extracted from a detection definition.

field: str¶

operator: RuntimeSecurityMonitoringFieldPredicateOperator | str¶

value: str¶

description: str¶

classmethod validate_field(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_operator(v)¶

Parameters:: v (RuntimeSecurityMonitoringFieldPredicateOperator | str)
Return type:: RuntimeSecurityMonitoringFieldPredicateOperator | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringFieldPredicateOperator¶

Bases: str, Enum

Portable operator for a parsed field-level predicate.

EQUALS = 'equals'¶

MATCHES = 'matches'¶

CONTAINS = 'contains'¶

EXISTS = 'exists'¶

IN = 'in'¶

REGEX = 'regex'¶

LESS_THAN = 'less_than'¶

GREATER_THAN = 'greater_than'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringImplementation¶

Bases: str, Enum

Product family for an observed security-monitoring manager.

WAZUH = 'wazuh'¶

OSSEC = 'ossec'¶

ELASTIC_SECURITY = 'elastic_security'¶

SPLUNK_ENTERPRISE_SECURITY = 'splunk_enterprise_security'¶

SECURITY_ONION = 'security_onion'¶

MICROSOFT_SENTINEL = 'microsoft_sentinel'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringListener¶

Bases: SDLModel

A manager listener bound to a same-node transport service.

listener_id: str¶

service: str¶

role: RuntimeSecurityMonitoringListenerRole | str¶

protocol: str¶

auth_required: bool | str | None¶

tls_enabled: bool | str | None¶

description: str¶

classmethod validate_listener_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role(v)¶

Parameters:: v (RuntimeSecurityMonitoringListenerRole | str)
Return type:: RuntimeSecurityMonitoringListenerRole | str

classmethod parse_optional_bool(v, info)¶

Parameters:

v (Any)
info (ValidationInfo)

Return type:

bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringListenerRole¶

Bases: str, Enum

Logical role of a manager transport listener.

AGENT_EVENT_INGESTION = 'agent_event_ingestion'¶

AGENT_ENROLLMENT = 'agent_enrollment'¶

SYSLOG_INGESTION = 'syslog_ingestion'¶

API = 'api'¶

ALERT_FORWARDING = 'alert_forwarding'¶

INDEXER_FORWARDING = 'indexer_forwarding'¶

DASHBOARD = 'dashboard'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringManager¶

Bases: SDLModel

Node-scoped runtime inventory for a SIEM/security-monitoring manager.

security_monitoring_manager_id: str¶

service: str¶

implementation: RuntimeSecurityMonitoringImplementation | str¶

manager_kind: RuntimeSecurityMonitoringManagerKind | str¶

version: str¶

revision: str¶

name: str¶

configuration_file_refs: list[str]¶

log_file_refs: list[str]¶

evidence_refs: list[str]¶

listeners: list[RuntimeSecurityMonitoringListener]¶

components: list[RuntimeSecurityMonitoringComponent]¶

agents: list[RuntimeSecurityMonitoringAgent]¶

agent_groups: list[RuntimeSecurityMonitoringAgentGroup]¶

content_sets: list[RuntimeSecurityMonitoringContentSet]¶

detection_definitions: list[RuntimeSecurityMonitoringDetectionDefinition]¶

settings: list[RuntimeSecurityMonitoringSetting]¶

description: str¶

classmethod validate_security_monitoring_manager_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_implementation(v)¶

Parameters:: v (RuntimeSecurityMonitoringImplementation | str)
Return type:: RuntimeSecurityMonitoringImplementation | str

classmethod normalize_manager_kind(v)¶

Parameters:: v (RuntimeSecurityMonitoringManagerKind | str)
Return type:: RuntimeSecurityMonitoringManagerKind | str

classmethod coerce_file_refs(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_file_refs(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

validate_manager()¶

Return type:: RuntimeSecurityMonitoringManager

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringManagerKind¶

Bases: str, Enum

Portable manager role/family.

SIEM = 'siem'¶

XDR = 'xdr'¶

HIDS = 'hids'¶

NDR = 'ndr'¶

LOG_MANAGEMENT = 'log_management'¶

DETECTION_ENGINE = 'detection_engine'¶

SECURITY_MONITORING = 'security_monitoring'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSecurityMonitoringSetting¶

Bases: SDLModel

A bounded manager setting with sensitivity classification.

setting_id: str¶

component_ref: str¶

name: str¶

value: str¶

value_classification: RuntimeSensitivityClassification | str¶

provenance: RuntimeSecurityMonitoringSettingProvenance | str¶

source_path: str¶

description: str¶

classmethod validate_setting_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeSecurityMonitoringSettingProvenance | str)
Return type:: RuntimeSecurityMonitoringSettingProvenance | str

classmethod validate_source_path(v)¶

Parameters:: v (str)
Return type:: str

validate_redacted_value()¶

Return type:: RuntimeSecurityMonitoringSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSecurityMonitoringSettingProvenance¶

Bases: str, Enum

Where an observed manager setting came from.

INTROSPECTION = 'introspection'¶

CONFIGURATION_FILE = 'configuration_file'¶

API = 'api'¶

IMAGE_DEFAULT = 'image_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

RUNTIME_DEFAULT = 'runtime_default'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSshServer¶

Bases: _SshDirectiveBundle

A scoped sshd server configuration observed on a node.

Each configuration carries a stable ssh_server_id and an explicit service reference pointing at the owning same-node service (bare name or nodes.<node>.services.<name> form). Global sshd directives sit at the top level; scoped overrides live in match_rules.

The configuration is the SDL surface for participant-observable sshd policy. It is not a backend sshd-payload dump and must not embed raw sshd_config text, raw sshd -T output, container inspect payloads, session transcripts, or environment values.

ssh_server_id: str¶

service: str¶

match_rules: list[SshMatchRule]¶

classmethod validate_ssh_server_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_service(v)¶

Parameters:: v (str)
Return type:: str

validate_match_rules_unique()¶

Return type:: RuntimeSshServer

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.SshForcedCommand¶

Bases: SDLModel

A typed sshd ForceCommand configuration.

The command_kind discriminates how command is interpreted:

absolute_path: a concrete executable path (or ${var}) starting with /. Validated via absolute_path_or_var.
internal_sftp: the sshd-internal sftp subsystem; command must equal the literal "internal-sftp".
redacted: the underlying command is withheld from the SDL model because it carries secrets, session identifiers, or operator-only arguments; command must be empty and command_redacted must be true.

command_kind: SshForcedCommandKind | str¶

command: str¶

command_redacted: bool | str¶

description: str¶

classmethod normalize_command_kind(v)¶

Parameters:: v (SshForcedCommandKind | str)
Return type:: SshForcedCommandKind | str

classmethod parse_command_redacted(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

validate_command_shape()¶

Return type:: SshForcedCommand

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.SshForcedCommandKind¶

Bases: str, Enum

Kind of forced command an sshd ForceCommand directive carries.

ABSOLUTE_PATH = 'absolute_path'¶

INTERNAL_SFTP = 'internal_sftp'¶

REDACTED = 'redacted'¶

__new__(value)¶

class raes.nodes.SshMatchCriterion¶

Bases: SDLModel

A single sshd Match criterion (one kind + one pattern).

kind: SshMatchCriterionKind | str¶

pattern: str¶

classmethod normalize_kind(v)¶

Parameters:: v (SshMatchCriterionKind | str)
Return type:: SshMatchCriterionKind | str

classmethod validate_pattern(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.SshMatchCriterionKind¶

Bases: str, Enum

OpenSSH Match criterion kinds.

LOCAL_USER is the explicit “match this concrete account” form that semantic validation may cross-check against runtime.local_identity when that inventory is present. USER is the looser pattern form (wildcards, comma-separated lists) and is not cross-checked.

USER = 'user'¶

GROUP = 'group'¶

HOST = 'host'¶

ADDRESS = 'address'¶

LOCAL_USER = 'local_user'¶

LOCAL_PORT = 'local_port'¶

RDOMAIN = 'rdomain'¶

ALL = 'all'¶

__new__(value)¶

class raes.nodes.SshMatchRule¶

Bases: _SshDirectiveBundle

A scoped sshd Match rule.

criteria is the ordered conjunction of one-or-more match criteria (Match User kali is one criterion; Match User kali Address 10.0.0.0/8 is two). Per-rule sshd directives override the surrounding global directives for sessions that match all listed criteria.

match_id: str¶

criteria: list[SshMatchCriterion]¶

classmethod validate_match_id(v)¶

Parameters:: v (str)
Return type:: str

validate_criteria()¶

Return type:: SshMatchRule

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorization¶

Bases: SDLModel

Application-internal RBAC store inventory for a single owning spine.

app_authorization_id: str¶

resource_vocabulary: RuntimeAppAuthorizationResourceVocabulary | str¶

auth_enabled: bool | str | None¶

name: str¶

principals: list[RuntimeAppAuthorizationPrincipal]¶

roles: list[RuntimeAppAuthorizationRole]¶

permission_grants: list[RuntimeAppAuthorizationGrant]¶

role_mappings: list[RuntimeAppAuthorizationRoleMapping]¶

tenants: list[RuntimeAppAuthorizationTenant]¶

description: str¶

classmethod validate_app_authorization_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_resource_vocabulary(v)¶

Parameters:: v (RuntimeAppAuthorizationResourceVocabulary | str)
Return type:: object

classmethod parse_auth_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_app_authorization()¶

Return type:: RuntimeAppAuthorization

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorizationCredentialClassification¶

Bases: str, Enum

Closed posture vocabulary for a principal credential.

The raw credential value MUST NOT be recorded; the principal model has no field that can hold one. This vocabulary is the only credential representation in the surface. Closed structural vocab: no unknown / other.

NONE = 'none'¶

REDACTED = 'redacted'¶

OPERATOR_SECRET = 'operator_secret'¶

__new__(value)¶

class raes.nodes.RuntimeAppAuthorizationGrant¶

Bases: SDLModel

A resource-scoped permission grant (role -> actions -> resource pattern).

resource_kind is the single author-settable source of truth for the resource vocabulary; the owning authorization’s resource_vocabulary is the declared set validated against these grants.

grant_id: str¶

role_ref: str¶

resource_kind: RuntimeAppAuthorizationResourceVocabulary | str¶

actions: list[str]¶

resource_patterns: list[str]¶

effect: RuntimeAppAuthorizationGrantEffect | str¶

description: str¶

classmethod validate_grant_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_resource_kind(v)¶

Parameters:: v (RuntimeAppAuthorizationResourceVocabulary | str)
Return type:: object

classmethod normalize_effect(v)¶

Parameters:: v (RuntimeAppAuthorizationGrantEffect | str)
Return type:: object

classmethod coerce_lists(v)¶

Parameters:: v (object)
Return type:: object

validate_grant()¶

Return type:: RuntimeAppAuthorizationGrant

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorizationGrantEffect¶

Bases: str, Enum

Closed allow/deny effect for a permission grant.

Closed structural vocab: no unknown / other.

ALLOW = 'allow'¶

DENY = 'deny'¶

__new__(value)¶

class raes.nodes.RuntimeAppAuthorizationPrincipal¶

Bases: SDLModel

A user, service account, API key, or backend role known to the store.

No raw secret is ever carried: the credential posture is recorded purely via credential_classification.

principal_id: str¶

kind: RuntimeAppAuthorizationPrincipalKind | str¶

name: str¶

reserved: bool | str | None¶

hidden: bool | str | None¶

credential_classification: RuntimeAppAuthorizationCredentialClassification | str¶

backend_roles: list[str]¶

description: str¶

classmethod validate_principal_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeAppAuthorizationPrincipalKind | str)
Return type:: object

classmethod normalize_credential_classification(v)¶

Parameters:: v (RuntimeAppAuthorizationCredentialClassification | str)
Return type:: object

classmethod parse_optional_bools(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod coerce_backend_roles(v)¶

Parameters:: v (object)
Return type:: object

validate_principal()¶

Return type:: RuntimeAppAuthorizationPrincipal

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorizationPrincipalKind¶

Bases: str, Enum

Open taxonomy of authorization principal kinds.

Carries both unknown and other (extensible real-world vocab).

USER = 'user'¶

SERVICE_ACCOUNT = 'service_account'¶

API_KEY = 'api_key'¶

BACKEND_ROLE = 'backend_role'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeAppAuthorizationResourceVocabulary¶

Bases: str, Enum

Open spine discriminator for the resource space an RBAC store governs.

Tier placement (storage RBAC vs presentation RBAC) is derived from which spine references the authorization, not declared here. Open taxonomy: carries both unknown and other.

INDEX_PATTERN = 'index_pattern'¶

CQL_RESOURCE = 'cql_resource'¶

REDIS_ACL = 'redis_acl'¶

APP_RESOURCE = 'app_resource'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeAppAuthorizationRole¶

Bases: SDLModel

A named role defined within the application authorization store.

role_id: str¶

name: str¶

description: str¶

classmethod validate_role_id(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorizationRoleMapping¶

Bases: SDLModel

A mapping that binds backend roles, users, or hosts onto a local role.

mapping_id: str¶

role_ref: str¶

backend_roles: list[str]¶

users: list[str]¶

hosts: list[str]¶

description: str¶

classmethod validate_mapping_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_lists(v)¶

Parameters:: v (object)
Return type:: object

validate_role_mapping()¶

Return type:: RuntimeAppAuthorizationRoleMapping

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeAppAuthorizationTenant¶

Bases: SDLModel

A tenant/namespace scope within the application authorization store.

tenant_id: str¶

name: str¶

description: str¶

classmethod validate_tenant_id(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeScheduledJob¶

Bases: SDLModel

Node-scoped runtime inventory for a recurring scheduled job (cadence + run-state).

scheduled_job_id: str¶

name: str¶

command_ref: str¶

enabled: bool | str | None¶

schedule: RuntimeScheduledJobSchedule | None¶

run_state: RuntimeScheduledJobRunState | None¶

description: str¶

classmethod validate_scheduled_job_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_scheduled_job()¶

Return type:: RuntimeScheduledJob

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeScheduledJobLastResult¶

Bases: str, Enum

Open run-outcome taxonomy for the most recent scheduled-job execution.

SUCCESS = 'success'¶

FAILURE = 'failure'¶

PENDING = 'pending'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeScheduledJobRunState¶

Bases: SDLModel

Observed run-state for a scheduled job.

last_run: str¶

next_run: str¶

last_result: RuntimeScheduledJobLastResult | str¶

classmethod normalize_last_result(v)¶

Parameters:: v (RuntimeScheduledJobLastResult | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeScheduledJobSchedule¶

Bases: SDLModel

The recurrence cadence for a scheduled job.

kind: RuntimeScheduledJobScheduleKind | str¶

spec: str¶

enabled: bool | str | None¶

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeScheduledJobScheduleKind | str)
Return type:: object

classmethod parse_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeScheduledJobScheduleKind¶

Bases: str, Enum

Closed structural recurrence vocabulary for a scheduled-job schedule.

This is a fixed structural vocabulary (POSIX crontab / RFC 5545 RRULE / fixed-interval), so per the DSL-139 enum-sentinel rule it carries neither unknown nor other.

INTERVAL = 'interval'¶

CRON = 'cron'¶

CALENDAR = 'calendar'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreCluster¶

Bases: SDLModel

The single observed cluster posture of a datastore service.

Captures the cluster-identity facts a search/wide-column cluster exposes: native UUID, aggregate cardinality and size, shard totals, health, discovery mode, partitioner, and native protocol version.

cluster_id: str¶

uuid: str¶

name: str¶

health: str¶

discovery_mode: str¶

partitioner: str¶

native_protocol_version: str¶

node_count: int | str | None¶

shard_total: int | str | None¶

shard_primaries: int | str | None¶

doc_count: int | str | None¶

store_size_bytes: int | str | None¶

description: str¶

classmethod validate_cluster_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_counts(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreDataModel¶

Bases: str, Enum

The logical data model of a datastore — the spine discriminator.

OPEN taxonomy (per the SCN-010 adversarial verdict): carries both unknown and other so an unrecognized model is permissive rather than forcing a shallow relational encoding. document is intentionally absent — no observed container realizes it (forbidden-completion discipline).

SEARCH_INDEX = 'search_index'¶

WIDE_COLUMN = 'wide_column'¶

KEY_VALUE = 'key_value'¶

RELATIONAL = 'relational'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreEngine¶

Bases: str, Enum

Observed product family for a datastore service.

OPEN taxonomy: real-world datastore engines are unbounded, so both unknown and other are carried.

OPENSEARCH = 'opensearch'¶

ELASTICSEARCH = 'elasticsearch'¶

CASSANDRA = 'cassandra'¶

SCYLLADB = 'scylladb'¶

REDIS = 'redis'¶

VALKEY = 'valkey'¶

MEMCACHED = 'memcached'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreEnginePlugin¶

Bases: SDLModel

An engine extension/plugin/module installed on a datastore node.

Per-node installed-capability inventory (OpenSearch plugins, Redis modules, …). Carries the per-plugin version the name-only service-level list could not. plugin_id is a stable symbol; name is the observed engine name.

plugin_id: str¶

name: str¶

version: str¶

description: str¶

classmethod validate_plugin_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreEvictionPolicy¶

Bases: str, Enum

A key-value eviction policy.

OPEN taxonomy: carries both unknown and other. Covers Redis maxmemory-policy values.

NOEVICTION = 'noeviction'¶

ALLKEYS_LRU = 'allkeys_lru'¶

ALLKEYS_LFU = 'allkeys_lfu'¶

ALLKEYS_RANDOM = 'allkeys_random'¶

VOLATILE_LRU = 'volatile_lru'¶

VOLATILE_LFU = 'volatile_lfu'¶

VOLATILE_RANDOM = 'volatile_random'¶

VOLATILE_TTL = 'volatile_ttl'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreMapping¶

Bases: SDLModel

A bounded manifest of an observed search-index mapping/schema.

Carries schema geometry and digest/evidence facts, never the raw OpenSearch/Elasticsearch _mapping response body.

mapping_id: str¶

name: str¶

partition_ref: str¶

top_level_field_count: int | str | None¶

leaf_field_count: int | str | None¶

field_type_census: dict[str, int | str]¶

dynamic_policy: str¶

dynamic_template_count: int | str | None¶

date_detection: bool | str | None¶

schema_digest: str¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_mapping_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_counts(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str | None

classmethod parse_field_type_census(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_date_detection(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod coerce_evidence_refs(v)¶

Parameters:: v (object)
Return type:: object

validate_mapping()¶

Return type:: RuntimeDatastoreMapping

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreNode¶

Bases: SDLModel

An observed node participating in a datastore cluster.

Beyond cluster membership and roles, a node carries product-neutral engine provenance (version, build hash/type), JVM/process memory posture (initial and maximum heap byte bounds, memory-lock state), a typed per-node engine plugin inventory, and typed published endpoints (client vs peer listeners). All are observed runtime facts — never host policy or software-component identity (ADR-058 amending ADR-048).

node_id: str¶

name: str¶

roles: list[RuntimeDatastoreNodeRole | str]¶

is_coordinator: bool | str | None¶

engine_version: str¶

build_hash: str¶

build_type: str¶

heap_init_bytes: int | str | None¶

heap_max_bytes: int | str | None¶

memory_locked: bool | str | None¶

endpoints: list[RuntimeDatastoreNodeEndpoint]¶

plugins: list[RuntimeDatastoreEnginePlugin]¶

description: str¶

classmethod validate_node_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_roles(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_is_coordinator(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod parse_heap_bytes(v)¶

Parameters:: v (object)
Return type:: int | str | None

classmethod parse_memory_locked(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_node()¶

Return type:: RuntimeDatastoreNode

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreNodeEndpoint¶

Bases: SDLModel

An observed published listener on a datastore node.

Product-neutral node listener topology: role distinguishes the participant-facing client listener from the inter-node peer listener without encoding engine-native names. address and port stay split, matching every other runtime listener surface. A node endpoint records published topology, not proof of an OS bind or host publication (ADR-058).

endpoint_id: str¶

role: RuntimeDatastoreNodeEndpointRole | str¶

protocol: str¶

address: str¶

port: int | str | None¶

description: str¶

classmethod validate_endpoint_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_port(v)¶

Parameters:: v (object)
Return type:: int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreNodeEndpointRole¶

Bases: str, Enum

The role a datastore node’s published listener fulfils.

OPEN taxonomy: carries both unknown and other. client is the participant/application-facing listener (OpenSearch http, Cassandra native/CQL, Redis client); peer is the inter-node/cluster listener (OpenSearch transport, Cassandra internode, Redis cluster-bus). Engine-native listener names are intentionally not modelled — the datastore spine stays product-neutral (ADR-048, ADR-058).

CLIENT = 'client'¶

PEER = 'peer'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreNodeRole¶

Bases: str, Enum

A role a cluster node fulfils.

OPEN taxonomy: carries both unknown and other. Covers OpenSearch cluster_manager/data/ingest/ml roles and Cassandra coordinator/seed roles uniformly.

CLUSTER_MANAGER = 'cluster_manager'¶

DATA = 'data'¶

INGEST = 'ingest'¶

COORDINATING = 'coordinating'¶

ML = 'ml'¶

SEED = 'seed'¶

COORDINATOR = 'coordinator'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastorePartition¶

Bases: SDLModel

An observed partition primitive (index / keyspace / logical_db / family).

Carries the geometry that differentiates one datastore data model from another: native partition/index UUID, shard/replica and document counts for a search index, replication strategy + factor + per-DC factor map for a wide-column keyspace, and a datatype census for a key-value logical database.

partition_id: str¶

kind: RuntimeDatastorePartitionKind | str¶

name: str¶

uuid: str¶

shard_count: int | str | None¶

replica_count: int | str | None¶

doc_count: int | str | None¶

doc_count_deleted: int | str | None¶

store_size_bytes: int | str | None¶

creation_timestamp: str¶

open_closed_status: str¶

replication_strategy: RuntimeDatastoreReplicationStrategy | str¶

replication_factor: int | str | None¶

per_dc_factor_map: dict[str, int | str]¶

durable_writes: bool | str | None¶

datatype_census: dict[str, int | str]¶

health: str¶

description: str¶

classmethod validate_partition_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeDatastorePartitionKind | str)
Return type:: object

classmethod normalize_replication_strategy(v)¶

Parameters:: v (RuntimeDatastoreReplicationStrategy | str)
Return type:: object

classmethod parse_counts(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str | None

classmethod parse_durable_writes(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod parse_int_maps(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastorePartitionKind¶

Bases: str, Enum

The kind of a datastore partition/namespace primitive.

OPEN taxonomy: carries both unknown and other. An index is the search-cluster primary object, a keyspace the wide-column one, a logical_db a numbered key-value database, and a column_family a wide-column table.

INDEX = 'index'¶

KEYSPACE = 'keyspace'¶

LOGICAL_DB = 'logical_db'¶

COLUMN_FAMILY = 'column_family'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastorePersistence¶

Bases: SDLModel

The single observed persistence posture of a key-value datastore.

Captures Redis-style persistence: RDB save points, AOF on/off, the eviction policy, and the maxmemory ceiling. Its presence is the defining profile a key_value data model must carry.

persistence_id: str¶

rdb_save_points: list[str]¶

aof: bool | str | None¶

eviction: RuntimeDatastoreEvictionPolicy | str¶

maxmemory: str¶

description: str¶

classmethod validate_persistence_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_save_points(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_aof(v)¶

Parameters:: v (object)
Return type:: bool | str | None

classmethod normalize_eviction(v)¶

Parameters:: v (RuntimeDatastoreEvictionPolicy | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreReplicationStrategy¶

Bases: str, Enum

A wide-column replication strategy — the spine discriminator’s geometry.

OPEN taxonomy (per the SCN-010 verdict): carries both unknown and other. Covers Cassandra SimpleStrategy/NetworkTopologyStrategy.

SIMPLE_STRATEGY = 'simple_strategy'¶

NETWORK_TOPOLOGY_STRATEGY = 'network_topology_strategy'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreService¶

Bases: SDLModel

An observed datastore service hosted by a transport service on a node.

The single non-relational datastore spine. service references the owning same-node Node.services[].name (bare name or the qualified nodes.<node>.services.<name> form). The data_model discriminator selects the required profile the require_profile_for_data_model guard enforces.

datastore_service_id: str¶

service: str¶

engine: RuntimeDatastoreEngine | str¶

data_model: RuntimeDatastoreDataModel | str¶

protocol: str¶

version: str¶

name: str¶

cluster: RuntimeDatastoreCluster | None¶

nodes: list[RuntimeDatastoreNode]¶

partitions: list[RuntimeDatastorePartition]¶

templates: list[RuntimeDatastoreTemplate]¶

aliases: list[str]¶

mappings: list[RuntimeDatastoreMapping]¶

lifecycle_policies: list[str]¶

ingest_pipelines: list[str]¶

persistence: RuntimeDatastorePersistence | None¶

pubsub_channels: list[str]¶

queues_streams: list[str]¶

transport_security: RuntimeDatastoreTransportSecurity | None¶

backup_targets: list[str]¶

settings: list[RuntimeDatastoreSetting]¶

authorization_ref: str¶

description: str¶

classmethod validate_datastore_service_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_engine(v)¶

Parameters:: v (RuntimeDatastoreEngine | str)
Return type:: object

classmethod normalize_data_model(v)¶

Parameters:: v (RuntimeDatastoreDataModel | str)
Return type:: object

classmethod coerce_string_lists(v)¶

Parameters:: v (object)
Return type:: object

classmethod coerce_templates(v)¶

Parameters:: v (object)
Return type:: object

classmethod coerce_mappings(v)¶

Parameters:: v (object)
Return type:: object

validate_datastore_service()¶

Return type:: RuntimeDatastoreService

require_profile_for_data_model()¶

Fail validation when the declared data_model lacks its profile.

A ${var} placeholder discriminator is exempt (nothing concrete is asserted); the OPEN unknown / other sentinels impose no profile (permissive tail). Each concrete structural data model REQUIRES (and in some cases REJECTS) specific child state per SCN-010 §5.1.

Return type:: None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreSetting¶

Bases: SDLModel

An observed datastore runtime setting with scope, provenance, and class.

Explicit redacted / operator_secret classifications omit raw values; names that look credential-bearing remain scenario content unless the author marks the value withheld.

setting_id: str¶

scope: RuntimeDatastoreSettingScope | str¶

provenance: RuntimeDatastoreSettingProvenance | str¶

classification: RuntimeSensitivityClassification | str¶

name: str¶

value: str¶

description: str¶

classmethod validate_setting_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_scope(v)¶

Parameters:: v (RuntimeDatastoreSettingScope | str)
Return type:: object

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeDatastoreSettingProvenance | str)
Return type:: object

classmethod normalize_classification(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: object

validate_setting()¶

Return type:: RuntimeDatastoreSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreSettingProvenance¶

Bases: str, Enum

Where an observed datastore runtime setting value came from.

OPEN taxonomy: provenance sources are extensible, so both unknown and other are carried (mirrors DatabaseSettingProvenance).

INTROSPECTION = 'introspection'¶

CONFIGURATION_FILE = 'configuration_file'¶

IMAGE_DEFAULT = 'image_default'¶

OPERATOR_OVERRIDE = 'operator_override'¶

RUNTIME_DEFAULT = 'runtime_default'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreSettingScope¶

Bases: str, Enum

The scope a datastore runtime setting applies at.

CLOSED structural vocab: the scope lattice (cluster / node / partition / engine) is fixed by the spine’s own topology, so no unknown / other.

CLUSTER = 'cluster'¶

NODE = 'node'¶

PARTITION = 'partition'¶

ENGINE = 'engine'¶

__new__(value)¶

class raes.nodes.RuntimeDatastoreTemplate¶

Bases: SDLModel

A bounded manifest of an observed index template body.

The template captures patterns, selected settings, optional mapping linkage, digest, and evidence refs without embedding the backend’s raw template JSON.

template_id: str¶

name: str¶

index_patterns: list[str]¶

settings_summary: dict[str, str | int | bool]¶

mapping_ref: str¶

template_digest: str¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_template_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_string_fields(v)¶

Parameters:: v (object)
Return type:: object

validate_template()¶

Return type:: RuntimeDatastoreTemplate

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreTransportSecurity¶

Bases: SDLModel

The single observed transport-security posture of a datastore service.

Records the intra-cluster transport TLS mode and whether client/node certificate verification is enforced — the observable xpack.security / SKIPSSL_VERIFY posture, never the certificate material itself.

transport_security_id: str¶

mode: RuntimeDatastoreTransportSecurityMode | str¶

client_verification: bool | str | None¶

node_verification: bool | str | None¶

description: str¶

classmethod validate_transport_security_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_mode(v)¶

Parameters:: v (RuntimeDatastoreTransportSecurityMode | str)
Return type:: object

classmethod parse_verifications(v)¶

Parameters:: v (object)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeDatastoreTransportSecurityMode¶

Bases: str, Enum

The transport-security posture of a datastore service.

CLOSED structural vocab: the observable TLS posture is a fixed three-way distinction (none / one-way TLS / mutual TLS), so no unknown / other. A ${var} placeholder remains expressible at the field level.

NONE = 'none'¶

TLS = 'tls'¶

MUTUAL_TLS = 'mutual_tls'¶

__new__(value)¶

class raes.nodes.RelationshipServiceIntegration¶

Bases: SDLModel

Typed service-integration detail carried by a top-level relationship edge.

When a consumer application integrates with a platform engine (analyzer, responder, webhook, notification, or enrichment), the relationship’s endpoints resolve to the two platform applications and this block keeps the integration_kind, auth_principal_ref (an app_authorization principal_id in the target), and direction structurally validated rather than recorded as prose. consumer_ref/engine_ref are the platform_application_id symbols of the two endpoints; a ${var} placeholder is permitted in those refs.

consumer_ref: str¶

engine_ref: str¶

integration_kind: RelationshipServiceIntegrationKind | str¶

auth_principal_ref: str¶

enabled: bool | str | None¶

direction: RelationshipServiceIntegrationDirection | str¶

description: str¶

classmethod normalize_integration_kind(v)¶

Parameters:: v (RelationshipServiceIntegrationKind | str)
Return type:: RelationshipServiceIntegrationKind | str

classmethod normalize_direction(v)¶

Parameters:: v (RelationshipServiceIntegrationDirection | str)
Return type:: RelationshipServiceIntegrationDirection | str

classmethod parse_enabled(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RelationshipServiceIntegrationDirection¶

Bases: str, Enum

Closed structural vocabulary for an integration edge’s data direction.

Closed structural vocabulary: carries neither unknown nor other.

INBOUND = 'inbound'¶

OUTBOUND = 'outbound'¶

BIDIRECTIONAL = 'bidirectional'¶

__new__(value)¶

class raes.nodes.RelationshipServiceIntegrationKind¶

Bases: str, Enum

Open taxonomy of how a consumer integrates with a platform engine.

Open taxonomy: carries both unknown and other.

ANALYZER = 'analyzer'¶

RESPONDER = 'responder'¶

WEBHOOK = 'webhook'¶

NOTIFICATION = 'notification'¶

ENRICHMENT = 'enrichment'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplication¶

Bases: SDLModel

Node-scoped runtime inventory for a security platform application.

service references the owning same-node Node.services[].name. The inventory is application state above transport; it never duplicates the inbound HTTP route surface (runtime.applications) or mutates Node.services. capabilities declare composable provider-neutral functional roles without implying content or configuration completeness. authorization_ref is the app_authorization_id of the platform’s internal RBAC store (resolved by the semantic validator).

platform_application_id: str¶

service: str¶

platform_kind: RuntimePlatformApplicationKind | str¶

product: str¶

version: str¶

name: str¶

capabilities: list[RuntimePlatformApplicationCapability]¶

organizations: list[RuntimePlatformApplicationOrganization]¶

tenants: list[RuntimePlatformApplicationTenant]¶

content_objects: list[RuntimePlatformApplicationContentObject]¶

markings: list[RuntimePlatformApplicationMarking]¶

upstream_bindings: list[RuntimePlatformApplicationUpstreamBinding]¶

connectors: list[RuntimePlatformApplicationConnector]¶

execution_policy: RuntimePlatformApplicationExecutionPolicy | None¶

settings: list[RuntimePlatformApplicationSetting]¶

authorization_ref: str¶

description: str¶

classmethod validate_platform_application_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_platform_kind(v)¶

Parameters:: v (RuntimePlatformApplicationKind | str)
Return type:: object

validate_platform_application()¶

Return type:: RuntimePlatformApplication

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationCapability¶

Bases: SDLModel

A provider-neutral functional role exposed by the application.

Capability declarations are composable and independent of product categories, configuration completeness, loaded content, policy, and execution guarantees. evidence_refs may identify the evidence supporting the declared runtime contract without embedding backend payloads.

capability_id: str¶

kind: RuntimePlatformApplicationCapabilityKind | str¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_capability_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimePlatformApplicationCapabilityKind | str)
Return type:: object

classmethod coerce_evidence_refs(v)¶

Parameters:: v (object)
Return type:: object

validate_capability()¶

Return type:: RuntimePlatformApplicationCapability

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationCapabilityKind¶

Bases: str, Enum

Open taxonomy of provider-neutral application capabilities.

A capability describes a functional role exposed by an application. It does not imply a product identity, configuration profile, content inventory, policy, or execution guarantee. Open taxonomy: carries both unknown and other.

THREAT_INTELLIGENCE_MANAGEMENT = 'threat_intelligence_management'¶

INTELLIGENCE_EXCHANGE = 'intelligence_exchange'¶

CASE_MANAGEMENT = 'case_management'¶

ANALYSIS_EXECUTION = 'analysis_execution'¶

WORKFLOW_AUTOMATION = 'workflow_automation'¶

ANALYTICS_PRESENTATION = 'analytics_presentation'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationConnector¶

Bases: SDLModel

A connector/integration wired into the platform.

A connector never carries a raw credential value; its credential posture is recorded purely via credential_classification.

connector_id: str¶

kind: RuntimePlatformApplicationConnectorKind | str¶

name: str¶

enabled: bool | str | None¶

credential_classification: RuntimePlatformApplicationSettingClassification | str¶

description: str¶

classmethod validate_connector_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimePlatformApplicationConnectorKind | str)
Return type:: object

classmethod normalize_credential_classification(v)¶

Parameters:: v (RuntimePlatformApplicationSettingClassification | str)
Return type:: object

classmethod parse_enabled(v)¶

Parameters:: v (object)
Return type:: bool | str | None

validate_connector()¶

Return type:: RuntimePlatformApplicationConnector

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationConnectorKind¶

Bases: str, Enum

Open taxonomy of platform connector/integration kinds.

Open taxonomy: carries both unknown and other.

ANALYZER_ENGINE = 'analyzer_engine'¶

RESPONDER = 'responder'¶

WEBHOOK = 'webhook'¶

NOTIFICATION = 'notification'¶

SYNC = 'sync'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationContentObject¶

Bases: SDLModel

A legacy typed platform content object as a bounded manifest entry.

The object carries a typed kind, bounded typed attributes, typed references (to other content_object_id values), marking_refs, and evidence_refs — structurally never a raw object body. Its presence does not imply an application capability.

content_object_id: str¶

kind: RuntimePlatformApplicationContentObjectKind | str¶

name: str¶

attributes: dict[str, Any]¶

references: list[str]¶

marking_refs: list[str]¶

evidence_refs: list[str]¶

description: str¶

classmethod validate_content_object_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimePlatformApplicationContentObjectKind | str)
Return type:: object

classmethod coerce_ref_lists(v)¶

Parameters:: v (object)
Return type:: object

validate_content_object()¶

Return type:: RuntimePlatformApplicationContentObject

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationContentObjectKind¶

Bases: str, Enum

Legacy open taxonomy of typed platform content objects.

A content object is a bounded parsed manifest entry (typed kind + bounded attributes + typed references) — never a raw object body. The collection is retained for compatibility and does not define an application’s capabilities. Open taxonomy: carries both unknown and other.

INDEX_PATTERN = 'index_pattern'¶

VISUALIZATION = 'visualization'¶

DASHBOARD = 'dashboard'¶

SEARCH = 'search'¶

FEED = 'feed'¶

TAXONOMY = 'taxonomy'¶

GALAXY_CLUSTER = 'galaxy_cluster'¶

WARNINGLIST = 'warninglist'¶

OBJECT_TEMPLATE = 'object_template'¶

SHARING_GROUP = 'sharing_group'¶

CASE_TEMPLATE = 'case_template'¶

CUSTOM_FIELD = 'custom_field'¶

ANALYZER = 'analyzer'¶

RESPONDER = 'responder'¶

WORKFLOW = 'workflow'¶

APP = 'app'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationExecutionPolicy¶

Bases: SDLModel

The platform’s job/analyzer execution model (rate limits, runner).

policy_id: str¶

runner: str¶

max_concurrent_jobs: int | str | None¶

job_timeout: str¶

rate_limit: str¶

description: str¶

classmethod validate_policy_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_max_concurrent_jobs(v)¶

Parameters:: v (object)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationKind¶

Bases: str, Enum

Legacy open category for a platform-application product family.

This category is retained for compatibility. It does not assert configuration completeness or imply application capabilities. New documents should use composable capabilities instead. Open taxonomy: carries both unknown and other.

ANALYTICS_DASHBOARD = 'analytics_dashboard'¶

THREAT_INTEL = 'threat_intel'¶

CASE_MANAGEMENT = 'case_management'¶

ANALYZER_ENGINE = 'analyzer_engine'¶

SOAR = 'soar'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationMarking¶

Bases: SDLModel

A releasability marking (TLP/PAP/distribution) defined by the platform.

marking_id: str¶

scheme: RuntimePlatformApplicationMarkingScheme | str¶

level: str¶

value: str¶

description: str¶

classmethod validate_marking_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_scheme(v)¶

Parameters:: v (RuntimePlatformApplicationMarkingScheme | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationMarkingScheme¶

Bases: str, Enum

Closed releasability-marking scheme vocabulary.

Standard-fixed (FIRST TLP 2.0 / PAP / MISP distribution lattice), so per the enum-sentinel rule it carries neither unknown nor other.

TLP = 'tlp'¶

PAP = 'pap'¶

DISTRIBUTION = 'distribution'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationOrganization¶

Bases: SDLModel

An organization/owner tenant known to the platform application.

organization_id: str¶

name: str¶

description: str¶

classmethod validate_organization_id(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationSetting¶

Bases: SDLModel

An observed platform setting with provenance and sensitivity.

Explicitly redacted/operator-secret settings must omit their raw value. A setting name does not by itself redact SDL scenario content.

setting_id: str¶

name: str¶

value: str¶

provenance: RuntimePlatformApplicationSettingProvenance | str¶

classification: RuntimePlatformApplicationSettingClassification | str¶

redaction: str¶

description: str¶

classmethod validate_setting_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimePlatformApplicationSettingProvenance | str)
Return type:: object

classmethod normalize_classification(v)¶

Parameters:: v (RuntimePlatformApplicationSettingClassification | str)
Return type:: object

validate_setting()¶

Return type:: RuntimePlatformApplicationSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationSettingClassification¶

Bases: str, Enum

Closed sensitivity classification for a platform setting value.

Closed structural redaction vocabulary: carries neither unknown nor other (an unclassified value is plain).

PLAIN = 'plain'¶

REDACTED = 'redacted'¶

OPERATOR_SECRET = 'operator_secret'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationSettingProvenance¶

Bases: str, Enum

Open taxonomy of where an observed platform setting originated.

Open taxonomy: carries both unknown and other.

DEFAULT = 'default'¶

ENVIRONMENT = 'environment'¶

CONFIG_FILE = 'config_file'¶

DATABASE = 'database'¶

RUNTIME = 'runtime'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimePlatformApplicationTenant¶

Bases: SDLModel

A tenant/namespace scope within the platform application.

tenant_id: str¶

name: str¶

description: str¶

classmethod validate_tenant_id(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationUpstreamBinding¶

Bases: SDLModel

An outbound binding to an upstream node/service (data source, backend).

binding_id: str¶

role: RuntimePlatformApplicationUpstreamBindingRole | str¶

target_node_ref: str¶

target_service_ref: str¶

description: str¶

classmethod validate_binding_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_role(v)¶

Parameters:: v (RuntimePlatformApplicationUpstreamBindingRole | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePlatformApplicationUpstreamBindingRole¶

Bases: str, Enum

Open taxonomy for the role an outbound upstream binding plays.

Open taxonomy: carries both unknown and other.

DATA_SOURCE = 'data_source'¶

BACKEND_API = 'backend_api'¶

SYNC_PEER = 'sync_peer'¶

INDEX_BACKEND = 'index_backend'¶

CQL_BACKEND = 'cql_backend'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RelationshipForwardingEdge¶

Bases: SDLModel

Typed forwarding-trust detail carried by a top-level relationship edge.

The inter-node trust edge between a forwarding / intel-sync agent (forwarder_ref, a forwarding_agent_id) and the downstream consumer it ships to. The consumer’s transport listener is named by target_listener_role — REUSING the manager-side RuntimeSecurityMonitoringListenerRole lattice rather than forking a parallel enum (SCN-010 §5.7).

The agent enrollment identity itself is never recorded: only the closed RuntimeForwardingEnrollmentClassification lattice (none / redacted / operator_secret). A present enrollment-identity ref must classify redacted / operator_secret — a raw identity is never the portable model.

forwarder_ref: str¶

target_listener_role: RuntimeSecurityMonitoringListenerRole | str¶

enrollment_identity_ref: str¶

enrollment_identity_classification: RuntimeForwardingEnrollmentClassification | str¶

protocol: str¶

crypto_method: str¶

parse_format: RuntimeForwardingParseFormat | str¶

description: str¶

classmethod validate_forwarder_ref(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_target_listener_role(v)¶

Parameters:: v (RuntimeSecurityMonitoringListenerRole | str)
Return type:: object

classmethod normalize_enrollment_classification(v)¶

Parameters:: v (RuntimeForwardingEnrollmentClassification | str)
Return type:: object

classmethod normalize_parse_format(v)¶

Parameters:: v (RuntimeForwardingParseFormat | str)
Return type:: object

validate_enrollment_identity()¶

Return type:: RelationshipForwardingEdge

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingAgent¶

Bases: SDLModel

Node-scoped runtime inventory for a forwarding / intel-sync agent.

The single forwarder spine. The agent_kind discriminator selects the required profile the require_profile_for_agent_kind guard enforces. Cadence composes a runtime.scheduled_jobs entry; the inter-node trust edge composes a RelationshipForwardingEdge — neither is re-typed here.

forwarding_agent_id: str¶

implementation: RuntimeForwardingAgentImplementation | str¶

agent_kind: RuntimeForwardingAgentKind | str¶

version: str¶

name: str¶

sources: list[RuntimeForwardingSource]¶

transforms: list[RuntimeForwardingTransform]¶

ship_targets: list[RuntimeForwardingShipTarget]¶

buffer_policy: RuntimeForwardingBufferPolicy | None¶

reload_channels: list[RuntimeForwardingReloadChannel]¶

settings: list[RuntimeForwardingSetting]¶

description: str¶

classmethod validate_forwarding_agent_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_implementation(v)¶

Parameters:: v (RuntimeForwardingAgentImplementation | str)
Return type:: object

classmethod normalize_agent_kind(v)¶

Parameters:: v (RuntimeForwardingAgentKind | str)
Return type:: object

validate_forwarding_agent()¶

Return type:: RuntimeForwardingAgent

require_profile_for_agent_kind()¶

Fail validation when a concrete agent_kind lacks its profile.

A ${var} placeholder discriminator is exempt (nothing concrete is asserted); the OPEN unknown / other sentinels impose no profile (permissive tail). log_forwarder and content_sync each REQUIRE (and REJECT) specific child state per SCN-010 §5.5.

Return type:: None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingAgentImplementation¶

Bases: str, Enum

Observed product family for a forwarding / intel-sync agent (OPEN).

FILEBEAT = 'filebeat'¶

WAZUH_AGENT = 'wazuh_agent'¶

FLUENT_BIT = 'fluent_bit'¶

FLUENTD = 'fluentd'¶

LOGSTASH = 'logstash'¶

VECTOR = 'vector'¶

RSYSLOG = 'rsyslog'¶

NXLOG = 'nxlog'¶

OTEL_COLLECTOR = 'otel_collector'¶

MISP_SURICATA_SYNC = 'misp_suricata_sync'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingAgentKind¶

Bases: str, Enum

Portable forwarding-agent role discriminator (OPEN per the verdict).

LOG_FORWARDER = 'log_forwarder'¶

CONTENT_SYNC = 'content_sync'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingBufferCrypto¶

Bases: str, Enum

Portable at-rest / in-transit crypto of a buffer policy (OPEN).

NONE = 'none'¶

AES = 'aes'¶

TLS = 'tls'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingBufferPolicy¶

Bases: SDLModel

The single observed buffer / back-pressure posture of a forwarder.

Captures the client_buffer shape: queue capacity, events-per-second ceiling, at-rest/in-transit crypto, and reconnect interval. Its presence is the defining profile a log_forwarder must carry.

buffer_policy_id: str¶

queue_capacity: int | str | None¶

eps: int | str | None¶

crypto: RuntimeForwardingBufferCrypto | str¶

reconnect_seconds: int | str | None¶

description: str¶

classmethod validate_buffer_policy_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_counts(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str | None

classmethod normalize_crypto(v)¶

Parameters:: v (RuntimeForwardingBufferCrypto | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingEnrollmentClassification¶

Bases: str, Enum

Redaction class for a ship-target enrollment identity (CLOSED).

A fixed structural lattice — an enrollment credential is either absent (none) or present-but-not-recorded (redacted / operator_secret). Raw enrollment-key material is never carried; per the enum-sentinel discipline this closed set carries no unknown / other tail.

NONE = 'none'¶

REDACTED = 'redacted'¶

OPERATOR_SECRET = 'operator_secret'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingParseFormat¶

Bases: str, Enum

Portable on-the-wire / on-disk parse format of a source (OPEN).

JSON = 'json'¶

SYSLOG = 'syslog'¶

EVE_JSON = 'eve_json'¶

CEF = 'cef'¶

LEEF = 'leef'¶

CSV = 'csv'¶

TEXT = 'text'¶

STIX = 'stix'¶

MISP_JSON = 'misp_json'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingProtocol¶

Bases: str, Enum

Portable wire protocol of a ship target (OPEN).

SYSLOG = 'syslog'¶

SYSLOG_TLS = 'syslog_tls'¶

SYSLOG_TCP = 'syslog_tcp'¶

BEATS = 'beats'¶

HTTP = 'http'¶

HTTPS = 'https'¶

TCP = 'tcp'¶

UDP = 'udp'¶

KAFKA = 'kafka'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingReloadChannel¶

Bases: SDLModel

An observed downstream reload channel a content-sync agent drives.

References the downstream consumer’s control channel (e.g. the Suricata rule-reload socket) rather than inventing a parallel socket model; the inter-node trust edge is carried by RelationshipForwardingEdge.

reload_channel_id: str¶

target_ref: str¶

kind: RuntimeForwardingReloadChannelKind | str¶

description: str¶

classmethod validate_reload_channel_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeForwardingReloadChannelKind | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingReloadChannelKind¶

Bases: str, Enum

Portable control / reload channel family for a downstream consumer (OPEN).

UNIX_SOCKET = 'unix_socket'¶

SIGNAL = 'signal'¶

HTTP_API = 'http_api'¶

CLI = 'cli'¶

FILE_DROP = 'file_drop'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingSetting¶

Bases: SDLModel

An observed forwarding-agent runtime setting with provenance and class.

Explicit redacted / operator_secret classifications omit raw values; credential-shaped names remain scenario content unless the author marks the value withheld.

setting_id: str¶

name: str¶

value: str¶

provenance: RuntimeForwardingSettingProvenance | str¶

classification: RuntimeForwardingSettingClassification | str¶

description: str¶

classmethod validate_setting_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeForwardingSettingProvenance | str)
Return type:: object

classmethod normalize_classification(v)¶

Parameters:: v (RuntimeForwardingSettingClassification | str)
Return type:: object

validate_setting()¶

Return type:: RuntimeForwardingSetting

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingSettingClassification¶

Bases: str, Enum

Redaction class for an observed forwarding setting value (CLOSED).

The fixed structural redaction lattice for a setting: a plain value, a present-but-not-recorded secret, or an operator-only secret. Carries no open tail by the enum-sentinel discipline.

PLAIN = 'plain'¶

REDACTED = 'redacted'¶

OPERATOR_SECRET = 'operator_secret'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingSettingProvenance¶

Bases: str, Enum

Portable provenance of an observed forwarding setting (OPEN).

CONFIGURATION_FILE = 'configuration_file'¶

ENVIRONMENT = 'environment'¶

COMMAND_LINE = 'command_line'¶

DEFAULT = 'default'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingShipTarget¶

Bases: SDLModel

An observed downstream ship target (event ingest and/or enrollment).

ingestion_port is the event-ingest endpoint (e.g. wazuh.manager:1514); enrollment_port is the enrollment endpoint (e.g. :1515). The enrollment identity itself is never recorded — only the closed enrollment_identity_classification lattice (none / redacted / operator_secret).

target_id: str¶

target_node_ref: str¶

target_service_ref: str¶

ingestion_port: int | str | None¶

enrollment_port: int | str | None¶

protocol: RuntimeForwardingProtocol | str¶

enrollment_identity_classification: RuntimeForwardingEnrollmentClassification | str¶

description: str¶

classmethod validate_target_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_ports(v, info)¶

Parameters:

v (object)
info (ValidationInfo)

Return type:

int | str | None

classmethod normalize_protocol(v)¶

Parameters:: v (RuntimeForwardingProtocol | str)
Return type:: object

classmethod normalize_enrollment_classification(v)¶

Parameters:: v (RuntimeForwardingEnrollmentClassification | str)
Return type:: object

has_ingestion_endpoint()¶

Return whether this target carries a concrete event-ingest endpoint.

Return type:: bool

has_enrollment_endpoint()¶

Return whether this target carries an enrollment endpoint or identity.

Return type:: bool

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingSource¶

Bases: SDLModel

An observed forwarder input source (tailed path, API pull, or queue).

source_id: str¶

kind: RuntimeForwardingSourceKind | str¶

location: str¶

parse_format: RuntimeForwardingParseFormat | str¶

selector: str¶

description: str¶

classmethod validate_source_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeForwardingSourceKind | str)
Return type:: object

classmethod normalize_parse_format(v)¶

Parameters:: v (RuntimeForwardingParseFormat | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingSourceKind¶

Bases: str, Enum

Portable provenance family for a forwarder input source (OPEN).

TAILED_PATH = 'tailed_path'¶

API_PULL = 'api_pull'¶

QUEUE = 'queue'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeForwardingTransform¶

Bases: SDLModel

An observed transform applied between a source and a ship target.

transform_id: str¶

kind: RuntimeForwardingTransformKind | str¶

sid_namespace: str¶

description: str¶

classmethod validate_transform_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeForwardingTransformKind | str)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeForwardingTransformKind¶

Bases: str, Enum

Portable transform family applied between source and ship target (OPEN).

PASSTHROUGH = 'passthrough'¶

PARSE = 'parse'¶

IOC_TO_RULE = 'ioc_to_rule'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeOrchestrationAuthority¶

Bases: SDLModel

Node-scoped runtime inventory for a container-spawn control authority.

control_interface_ref is the control_interface_id of a same-node RuntimeControlInterface (the docker.sock shell), resolved by validator.py — referenced, never duplicated. The privilege_class discriminator selects the required profile the require_profile_for_privilege_class guard enforces.

orchestration_authority_id: str¶

control_interface_ref: str¶

engine: RuntimeOrchestrationEngine | str¶

engine_api_version: str¶

name: str¶

scope: RuntimeOrchestrationScope | None¶

spawn_templates: list[RuntimeOrchestrationSpawnTemplate]¶

lifecycle_policy: RuntimeOrchestrationLifecyclePolicy | None¶

realized_children: list[RuntimeOrchestrationRealizedChild]¶

privilege_class: RuntimeOrchestrationPrivilegeClass | str¶

description: str¶

classmethod validate_orchestration_authority_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_engine(v)¶

Parameters:: v (RuntimeOrchestrationEngine | str)
Return type:: object

classmethod normalize_privilege_class(v)¶

Parameters:: v (RuntimeOrchestrationPrivilegeClass | str)
Return type:: object

validate_orchestration_authority()¶

Return type:: RuntimeOrchestrationAuthority

require_profile_for_privilege_class()¶

Fail validation when a concrete privilege_class lacks its profile.

A ${var} placeholder discriminator is exempt (nothing concrete is asserted); unknown / other are permissive. A host_root_equivalent authority REQUIRES a non-empty, non-${var} control_interface_ref — a host-root-equivalent spawn surface must resolve to a concrete control interface (the read_write docker.sock resolution itself is enforced at scenario level by validator.py), so the privilege escalation fact cannot be silently shallow-encoded.

Return type:: None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeOrchestrationEngine¶

Bases: str, Enum

Open taxonomy for the orchestration engine/runtime family.

Open taxonomy: carries both unknown and other per the DSL-139 enum-sentinel rule.

DOCKER = 'docker'¶

CONTAINERD = 'containerd'¶

PODMAN = 'podman'¶

KUBERNETES = 'kubernetes'¶

CRI_O = 'cri_o'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeOrchestrationLifecyclePolicy¶

Bases: SDLModel

The lifecycle posture applied to children the authority spawns.

timeout: str¶

cleanup: str¶

execution_timeout: str¶

description: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeOrchestrationPrivilegeClass¶

Bases: str, Enum

Open taxonomy for the privilege an orchestration authority commands.

host_root_equivalent denotes an authority whose spawn surface is equivalent to host root (e.g. a read-write docker.sock holder); namespaced denotes a privilege-scoped/rootless authority. Open taxonomy: carries both unknown and other.

HOST_ROOT_EQUIVALENT = 'host_root_equivalent'¶

NAMESPACED = 'namespaced'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeOrchestrationRealizedChild¶

Bases: SDLModel

An observed, realized child workload spawned by the authority.

workload_id: str¶

image_ref: str¶

count: int | str | None¶

evidence_ref: str¶

description: str¶

classmethod validate_workload_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_count(v)¶

Parameters:: v (object)
Return type:: int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeOrchestrationScope¶

Bases: SDLModel

The organizational/environment scope an orchestration authority governs.

organization_ref: str¶

environment_name: str¶

description: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeOrchestrationSpawnTemplate¶

Bases: SDLModel

A template the authority is authorized to instantiate (image + purpose).

template_id: str¶

image_ref: str¶

purpose: str¶

description: str¶

classmethod validate_template_id(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeCapabilityOverrideScope¶

Bases: str, Enum

Scope of a RuntimeProcessCapabilityOverride.

PROCESS records a capability delta that applies only to the subject process itself; SUBTREE records a delta that applies to the subject process and every descendant it spawns (the motivating case is capsh --drop=cap_audit_control exec’ing sshd, after which the interactive shell subtree runs without CAP_AUDIT_CONTROL).

PROCESS = 'process'¶

SUBTREE = 'subtree'¶

__new__(value)¶

class raes.nodes.RuntimeCapabilityPolicy¶

Bases: SDLModel

Linux/container capability policy observed for a runtime node.

required: list[str]¶

effective: list[str]¶

add: list[str]¶

drop: list[str]¶

process_overrides: list[RuntimeProcessCapabilityOverride]¶

description: str¶

classmethod coerce_capability_lists(v)¶

classmethod validate_capability_names(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_unique_capabilities()¶

Return type:: RuntimeCapabilityPolicy

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeContainerConfiguration¶

Bases: SDLModel

Required container runtime host and security configuration facts.

entrypoint: list[str]¶

command: list[str]¶

log_driver: str¶

log_options: dict[str, str]¶

namespaces: RuntimeNamespaceConfiguration | None¶

privileged: bool | str | None¶

read_only_rootfs: bool | str | None¶

publish_all_ports: bool | str | None¶

autoremove: bool | str | None¶

shm_size: int | str | None¶

masked_paths: list[str]¶

read_only_paths: list[str]¶

cgroup_parent: str¶

runtime_name: str¶

init_process: RuntimeInitProcess | None¶

devices: list[RuntimeDeviceMapping]¶

device_cgroup_rules: list[str]¶

seccomp_profile: str¶

security_opt: list[str]¶

extra_hosts: list[RuntimeExtraHost]¶

dns: list[str]¶

dns_options: list[str]¶

dns_search: list[str]¶

group_add: list[str]¶

description: str¶

classmethod normalize_command_list(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod normalize_string_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod parse_optional_flags(v, info)¶

Parameters:

v (bool | str | None)
info (ValidationInfo)

Return type:

bool | str | None

classmethod parse_shm_size(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod validate_path_lists(v, info)¶

Parameters:

v (list[str])
info (ValidationInfo)

Return type:

list[str]

classmethod validate_security_opt(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_seccomp_consistency()¶

Return type:: RuntimeContainerConfiguration

validate_unique_container_entries()¶

Return type:: RuntimeContainerConfiguration

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeConfiguration¶

Bases: SDLModel

Declarative runtime state required by a VM node.

Captured observations remain in evidence records unless an author deliberately promotes the fact to one of these contract fields.

mounts: list[RuntimeMount]¶

filesystem_inventory: list[RuntimeFilesystemEntry]¶

local_control_interfaces: list[RuntimeControlInterface]¶

processes: list[RuntimeProcessIdentity]¶

environment: list[RuntimeEnvironmentVariable]¶

linux_capabilities: RuntimeCapabilityPolicy | None¶

operational_policy: RuntimeOperationalPolicy | None¶

container: RuntimeContainerConfiguration | None¶

local_identity: RuntimeLocalIdentityInventory | None¶

identity_authorities: list[RuntimeIdentityAuthority]¶

file_services: list[RuntimeFileService]¶

mail_services: list[RuntimeMailService]¶

network: RuntimeNetworkRealization | None¶

service_listeners: list[RuntimeServiceListener]¶

applications: list[RuntimeApplicationSurface]¶

database_services: list[RuntimeDatabaseService]¶

dns_services: list[RuntimeDnsService]¶

network_sensors: list[RuntimeNetworkSensor]¶

network_detection_engines: list[RuntimeNetworkDetectionEngine]¶

security_monitoring_managers: list[RuntimeSecurityMonitoringManager]¶

ssh_servers: list[RuntimeSshServer]¶

datastore_services: list[RuntimeDatastoreService]¶

platform_applications: list[RuntimePlatformApplication]¶

forwarding_agents: list[RuntimeForwardingAgent]¶

orchestration_authorities: list[RuntimeOrchestrationAuthority]¶

app_authorizations: list[RuntimeAppAuthorization]¶

scheduled_jobs: list[RuntimeScheduledJob]¶

service_manager_units: list[ServiceManagerUnit]¶

packages: list[RuntimePackage]¶

software_components: list[RuntimeSoftwareComponent]¶

dependency_manifests: list[RuntimeDependencyManifest]¶

validate_unique_runtime_entries()¶

Return type:: RuntimeConfiguration

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeControlInterface¶

Bases: SDLModel

A non-network local control API exposed inside a runtime node.

control_interface_id: str¶

path: str¶

kind: RuntimeControlInterfaceKind | str¶

protocol: str¶

bind_source: str¶

bind_source_sensitivity: RuntimeSensitivityClassification | str¶

access: RuntimeControlInterfaceAccess | str¶

description: str¶

classmethod validate_control_interface_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_bind_source(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_bind_source_sensitivity(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

classmethod normalize_kind(v)¶

Parameters:: v (RuntimeControlInterfaceKind | str)
Return type:: RuntimeControlInterfaceKind | str

classmethod normalize_access(v)¶

Parameters:: v (RuntimeControlInterfaceAccess | str)
Return type:: RuntimeControlInterfaceAccess | str

validate_redacted_bind_source_and_named_pipe_kind()¶

Return type:: RuntimeControlInterface

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeControlInterfaceAccess¶

Bases: str, Enum

Observed local-control access mode.

READ_ONLY = 'read_only'¶

READ_WRITE = 'read_write'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeControlInterfaceKind¶

Bases: str, Enum

Path-local control interface shape observed at runtime.

UNIX_SOCKET = 'unix_socket'¶

NAMED_PIPE = 'named_pipe'¶

FILE = 'file'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeDeviceMapping¶

Bases: SDLModel

A host device mapping required in runtime configuration.

host_path: str¶

container_path: str¶

permissions: str¶

description: str¶

classmethod validate_device_path(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeEnvironmentValueClassification¶

Bases: str, Enum

Sensitivity classification for a required runtime environment value.

PLAIN = 'plain'¶

REDACTED = 'redacted'¶

SECRET_FIXTURE = 'secret_fixture'¶

OPERATOR_SECRET = 'operator_secret'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeEnvironmentVariable¶

Bases: SDLModel

Required runtime environment variable with provenance and sensitivity.

name: str¶

value: str¶

value_classification: RuntimeEnvironmentValueClassification | str¶

provenance: RuntimeEnvironmentVariableProvenance | str¶

source: str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_value_classification(v)¶

Parameters:: v (RuntimeEnvironmentValueClassification | str)
Return type:: RuntimeEnvironmentValueClassification | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeEnvironmentVariableProvenance | str)
Return type:: RuntimeEnvironmentVariableProvenance | str

validate_redacted_value()¶

Return type:: RuntimeEnvironmentVariable

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeEnvironmentVariableProvenance¶

Bases: str, Enum

Required origin class for a runtime environment variable.

COMPOSE = 'compose'¶

IMAGE = 'image'¶

OPERATOR = 'operator'¶

CONTAINER = 'container'¶

RUNTIME = 'runtime'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeExtraHost¶

Bases: SDLModel

A required extra host mapping in runtime configuration.

hostname: str¶

address: str¶

description: str¶

classmethod validate_non_empty(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFilesystemEntry¶

Bases: SDLModel

A filesystem entry observed inside a runtime node or container asset.

path: str¶

entry_type: RuntimeFilesystemEntryType | str¶

presence: RuntimeFilesystemPresence | str¶

owner_user: str¶

owner_group: str¶

uid: int | str | None¶

gid: int | str | None¶

mode: str¶

size: int | str | None¶

content_digest: str¶

digest_algorithm: str¶

source_path: str¶

provenance: str¶

stability: RuntimeFilesystemStability | str¶

sensitivity: RuntimeSensitivityClassification | str¶

description: str¶

classmethod validate_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_entry_type(v)¶

Parameters:: v (RuntimeFilesystemEntryType | str)
Return type:: RuntimeFilesystemEntryType | str

classmethod normalize_presence(v)¶

Parameters:: v (RuntimeFilesystemPresence | str)
Return type:: RuntimeFilesystemPresence | str

classmethod parse_identity_id(v, info)¶

Parameters:

v (int | str | None)
info (ValidationInfo)

Return type:

int | str | None

classmethod validate_mode(v)¶

Parameters:: v (str | int)
Return type:: str

classmethod parse_size(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod normalize_stability(v)¶

Parameters:: v (RuntimeFilesystemStability | str)
Return type:: RuntimeFilesystemStability | str

classmethod normalize_sensitivity(v)¶

Parameters:: v (RuntimeSensitivityClassification | str)
Return type:: RuntimeSensitivityClassification | str

validate_digest_pair()¶

Return type:: RuntimeFilesystemEntry

validate_presence()¶

Return type:: RuntimeFilesystemEntry

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeFilesystemEntryType¶

Bases: str, Enum

Observed type of a runtime filesystem inventory entry.

FILE = 'file'¶

DIRECTORY = 'directory'¶

SYMLINK = 'symlink'¶

DEVICE = 'device'¶

SOCKET = 'socket'¶

FIFO = 'fifo'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeFilesystemPresence¶

Bases: str, Enum

Observed presence state for a runtime filesystem inventory entry.

present is the default and preserves prior behavior. expected_absent records an authored or expected path that was not observed at capture time — for example a deploy-key path attempted by setup code but missing in the captured steady state. Absent entries retain their expected entry_type instead of collapsing to other; present-only facts (size, content digest, owner ids, mode) must be omitted, per ADR-037.

PRESENT = 'present'¶

EXPECTED_ABSENT = 'expected_absent'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeFilesystemStability¶

Bases: str, Enum

Stability class for an observed runtime filesystem or mount fact.

STABLE = 'stable'¶

GENERATED = 'generated'¶

LOG = 'log'¶

CACHE = 'cache'¶

RUNTIME_CREATED = 'runtime_created'¶

VOLUME_BACKED = 'volume_backed'¶

TRANSIENT = 'transient'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeIdentityProvenance¶

Bases: str, Enum

Origin class for an observed local identity record.

IMAGE = 'image'¶

PACKAGE = 'package'¶

RUNTIME_CREATED = 'runtime_created'¶

OPERATOR = 'operator'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeInitProcess¶

Bases: SDLModel

Required backend-injected container init / PID-1 reaper configuration.

Models authored container runtime intent — for example Docker Compose init: true causing PID 1 to be /sbin/docker-init (tini). This is distinct from the observed PID-1 process recorded in runtime.processes; see ADR-027.

enabled: bool | str | None¶

implementation: str¶

executable_path: str¶

reaps_children: bool | str | None¶

argv: list[str]¶

argv_redacted: bool | str¶

description: str¶

classmethod parse_optional_init_flags(v, info)¶

Parameters:

v (bool | str | None)
info (ValidationInfo)

Return type:

bool | str | None

classmethod parse_argv_redacted(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

classmethod normalize_argv(v)¶

Parameters:: v (Any)
Return type:: list[str]

classmethod validate_executable_path(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

validate_redacted_argv()¶

Return type:: RuntimeInitProcess

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeLocalGroup¶

Bases: SDLModel

A local group record observed in a node’s identity database (/etc/group).

name: str¶

gid: int | str | None¶

members: list[str]¶

provenance: RuntimeIdentityProvenance | str¶

description: str¶

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_gid(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod coerce_members(v)¶

Parameters:: v (str | list[str] | None)
Return type:: list[str]

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeIdentityProvenance | str)
Return type:: RuntimeIdentityProvenance | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeLocalIdentityInventory¶

Bases: SDLModel

Observed local identity database (users, groups, sudo rules) for a node.

users: list[RuntimeLocalUser]¶

groups: list[RuntimeLocalGroup]¶

sudo_rules: list[RuntimeSudoRule]¶

description: str¶

validate_unique_identity_records()¶

Return type:: RuntimeLocalIdentityInventory

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeLocalUser¶

Bases: SDLModel

A local user record observed in a node’s identity database (/etc/passwd).

username: str¶

uid: int | str | None¶

primary_gid: int | str | None¶

primary_group: str¶

gecos: str¶

home: str¶

shell: str¶

supplemental_groups: list[str]¶

disabled: bool | str¶

locked: bool | str¶

no_login: bool | str¶

provenance: RuntimeIdentityProvenance | str¶

stability: RuntimeFilesystemStability | str¶

description: str¶

classmethod validate_username(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_identity_id(v, info)¶

Parameters:

v (int | str | None)
info (ValidationInfo)

Return type:

int | str | None

classmethod validate_paths(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod coerce_supplemental_groups(v)¶

Parameters:: v (str | list[str] | None)
Return type:: list[str]

classmethod parse_status_flags(v, info)¶

Parameters:

v (bool | str)
info (ValidationInfo)

Return type:

bool | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeIdentityProvenance | str)
Return type:: RuntimeIdentityProvenance | str

classmethod normalize_stability(v)¶

Parameters:: v (RuntimeFilesystemStability | str)
Return type:: RuntimeFilesystemStability | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMount¶

Bases: SDLModel

A filesystem mount observed on a runtime node.

target: str¶

source: str¶

source_sensitivity: RuntimeSensitivityClassification | str¶

source_kind: RuntimeMountSourceKind | str¶

filesystem_type: str¶

read_only: bool | str¶

options: list[str]¶

options_sensitivity: RuntimeSensitivityClassification | str¶

propagation: RuntimeMountPropagation | str¶

stability: RuntimeFilesystemStability | str¶

backend_generated: bool | str | None¶

description: str¶

classmethod validate_target(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_mount_sensitivity(v, info)¶

Parameters:

v (RuntimeSensitivityClassification | str)
info (ValidationInfo)

Return type:

RuntimeSensitivityClassification | str

classmethod normalize_source_kind(v)¶

Parameters:: v (RuntimeMountSourceKind | str)
Return type:: RuntimeMountSourceKind | str

classmethod parse_read_only(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

classmethod normalize_propagation(v)¶

Parameters:: v (RuntimeMountPropagation | str)
Return type:: RuntimeMountPropagation | str

classmethod normalize_stability(v)¶

Parameters:: v (RuntimeFilesystemStability | str)
Return type:: RuntimeFilesystemStability | str

classmethod parse_backend_generated(v)¶

Parameters:: v (bool | str | None)
Return type:: bool | str | None

validate_redacted_mount_details()¶

Return type:: RuntimeMount

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeMountPropagation¶

Bases: str, Enum

Portable propagation mode for a runtime filesystem mount.

PRIVATE = 'private'¶

RPRIVATE = 'rprivate'¶

SHARED = 'shared'¶

RSHARED = 'rshared'¶

SLAVE = 'slave'¶

RSLAVE = 'rslave'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeMountSourceKind¶

Bases: str, Enum

Portable source kind for a runtime filesystem mount.

VOLUME = 'volume'¶

BIND = 'bind'¶

TMPFS = 'tmpfs'¶

IMAGE = 'image'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeNamespaceConfiguration¶

Bases: SDLModel

Required namespace modes for a runtime node or container.

cgroup: str¶

ipc: str¶

network: RuntimeNetworkNamespace | None¶

pid: str¶

userns: str¶

uts: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkNamespace¶

Bases: SDLModel

A request to use the exact network namespace owned by another node.

target_node_ref: str¶

classmethod validate_target_node_ref(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkBackendDetail¶

Bases: SDLModel

Required backend network driver and IPAM detail for an endpoint’s network.

driver_options and ipam_options are the bounded extension seam for backend-native key/value facts; raw backend inspect payloads are not stored.

driver: RuntimeNetworkDriver | str¶

ipam_driver: str¶

driver_options: dict[str, str]¶

ipam_options: dict[str, str]¶

description: str¶

classmethod normalize_driver(v)¶

Parameters:: v (RuntimeNetworkDriver | str)
Return type:: RuntimeNetworkDriver | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkDriver¶

Bases: str, Enum

Backend network driver class required by the scenario.

BRIDGE = 'bridge'¶

OVERLAY = 'overlay'¶

HOST = 'host'¶

IPVLAN = 'ipvlan'¶

MACVLAN = 'macvlan'¶

NONE = 'none'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeNetworkEndpoint¶

Bases: SDLModel

A required container network attachment.

network references a declared switch-backed infrastructure network by name. Runtime-generated identifiers and names are capture evidence, not declaration identity.

network: str¶

ip_address: str¶

ip_prefix_length: int | str | None¶

gateway: str¶

mac_address: str¶

aliases: list[str]¶

dns_names: list[str]¶

backend: RuntimeNetworkBackendDetail | None¶

description: str¶

classmethod validate_network(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_addresses(v, info)¶

Parameters:

v (str)
info (ValidationInfo)

Return type:

str

classmethod parse_ip_prefix_length(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod validate_mac_address(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_name_lists(v)¶

Parameters:: v (Any)
Return type:: list[str]

validate_unique_names()¶

Return type:: RuntimeNetworkEndpoint

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeNetworkRealization¶

Bases: SDLModel

Declarative container network state for a node.

hostname and domainname are required container network identities, kept distinct from per-network aliases and DNS names.

hostname: str¶

domainname: str¶

endpoints: list[RuntimeNetworkEndpoint]¶

published_ports: list[RuntimePublishedPort]¶

description: str¶

validate_unique_network_records()¶

Return type:: RuntimeNetworkRealization

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeOperationalPolicy¶

Bases: SDLModel

Required restart and resource-limit policy for a runtime node.

restart: RuntimeRestartPolicy | str¶

resource_limits: RuntimeResourceLimits | None¶

description: str¶

classmethod normalize_restart(v)¶

Parameters:: v (RuntimeRestartPolicy | str | bool)
Return type:: RuntimeRestartPolicy | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimePackage¶

Bases: SDLModel

A package required in a runtime image or node.

manager: str¶

name: str¶

version: str¶

architecture: str¶

source: str¶

purl: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeProcessCapabilityOverride¶

Bases: SDLModel

A capability delta scoped to a single process or its descendant subtree.

Per ADR-030, scoped Linux-capability facts stay under RuntimeCapabilityPolicy rather than migrating onto RuntimeProcessIdentity. subject reuses the existing process identity model as a selector / evidence anchor — it identifies which process or subtree the delta applies to but does not own capability semantics. effective / add / drop record the scoped delta relative to the container-wide baseline on the enclosing RuntimeCapabilityPolicy; required is intentionally omitted from this surface because overrides describe deltas, not new container-wide requirements.

subject: RuntimeProcessIdentity¶

scope: RuntimeCapabilityOverrideScope | str¶

effective: list[str]¶

add: list[str]¶

drop: list[str]¶

description: str¶

classmethod normalize_scope(v)¶

Parameters:: v (RuntimeCapabilityOverrideScope | str)
Return type:: RuntimeCapabilityOverrideScope | str

classmethod coerce_override_capability_lists(v)¶

classmethod validate_override_capability_names(v)¶

Parameters:: v (list[str])
Return type:: list[str]

validate_override_invariants()¶

Return type:: RuntimeProcessCapabilityOverride

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeProcessIdentity¶

Bases: SDLModel

Observed process identity for a runtime node.

name: str¶

pid: int | str | None¶

parent_pid: int | str | None¶

command: list[str]¶

command_redacted: bool | str¶

role: RuntimeProcessRole | str¶

user: str¶

group: str¶

working_directory: str¶

description: str¶

classmethod parse_pid(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod parse_parent_pid(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod normalize_command(v)¶

Parameters:: v (str | list[str] | None)
Return type:: list[str]

classmethod parse_command_redacted(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

classmethod normalize_role(v)¶

Parameters:: v (RuntimeProcessRole | str)
Return type:: RuntimeProcessRole | str

classmethod validate_working_directory(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeProcessRole¶

Bases: str, Enum

Observed role of a process in a runtime process set.

PRIMARY = 'primary'¶

SUPERVISOR = 'supervisor'¶

WORKER = 'worker'¶

SIDECAR = 'sidecar'¶

AGENT = 'agent'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimePublishedPort¶

Bases: SDLModel

A required host-published port binding for a container endpoint.

Host IP, host port, container port, and protocol are kept distinct; this is a runtime/host exposure fact, not a node service declaration (ADR-025).

container_port: int | str¶

protocol: str¶

host_ip: str¶

host_port: int | str | None¶

description: str¶

classmethod parse_container_port(v)¶

Parameters:: v (int | str)
Return type:: int | str

classmethod parse_host_port(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod validate_protocol(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_host_ip(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeResourceLimits¶

Bases: SDLModel

Required runtime/cgroup resource limits for a node.

memory: int | str | None¶

memory_swap: int | str | None¶

cpu: float | str | None¶

pids: int | str | None¶

open_files: int | str | None¶

description: str¶

classmethod parse_memory_limit(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod parse_cpu_limit(v)¶

Parameters:: v (float | str | None)
Return type:: float | str | None

classmethod parse_count_limit(v, info)¶

Parameters:

v (int | str | None)
info (ValidationInfo)

Return type:

int | str | None

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeRestartPolicy¶

Bases: str, Enum

Portable restart policy required by the scenario.

NO = 'no'¶

ALWAYS = 'always'¶

ON_FAILURE = 'on_failure'¶

UNLESS_STOPPED = 'unless_stopped'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSensitivityClassification¶

Bases: str, Enum

Sensitivity/redaction class for observed runtime facts.

PLAIN = 'plain'¶

REDACTED = 'redacted'¶

SECRET_FIXTURE = 'secret_fixture'¶

OPERATOR_SECRET = 'operator_secret'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSoftwareComponent¶

Bases: SDLModel

A software component required as part of a runtime node’s state.

component_id: str¶

name: str¶

version: str¶

component_type: RuntimeSoftwareComponentType | str¶

provenance: RuntimeSoftwareComponentProvenance | str¶

ecosystem: str¶

purl: str¶

cpe: str¶

package_manager: str¶

package_name: str¶

package_version: str¶

manifest_path: str¶

installed_paths: list[str]¶

hashes: list[RuntimeSoftwareComponentHash]¶

description: str¶

classmethod validate_component_id(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_name(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_component_type(v)¶

Parameters:: v (RuntimeSoftwareComponentType | str)
Return type:: RuntimeSoftwareComponentType | str

classmethod normalize_provenance(v)¶

Parameters:: v (RuntimeSoftwareComponentProvenance | str)
Return type:: RuntimeSoftwareComponentProvenance | str

classmethod validate_manifest_path(v)¶

Parameters:: v (str)
Return type:: str

classmethod coerce_installed_paths(v)¶

Parameters:: v (object)
Return type:: object

classmethod validate_installed_paths(v)¶

Parameters:: v (list[str])
Return type:: list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSoftwareComponentHash¶

Bases: SDLModel

Digest required for a runtime software component.

algorithm: str¶

value: str¶

classmethod validate_non_empty(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.RuntimeSoftwareComponentProvenance¶

Bases: str, Enum

Required source origin for a runtime software component.

PACKAGE_MANAGER = 'package_manager'¶

DEPENDENCY_MANIFEST = 'dependency_manifest'¶

IMAGE_METADATA = 'image_metadata'¶

OPERATOR = 'operator'¶

SELF_REPORTED = 'self_reported'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSoftwareComponentType¶

Bases: str, Enum

Portable type for a software component required on a runtime node.

APPLICATION = 'application'¶

FRAMEWORK = 'framework'¶

LIBRARY = 'library'¶

CONTAINER = 'container'¶

PLATFORM = 'platform'¶

OPERATING_SYSTEM = 'operating_system'¶

DEVICE = 'device'¶

DEVICE_DRIVER = 'device_driver'¶

FIRMWARE = 'firmware'¶

FILE = 'file'¶

DATA = 'data'¶

UNKNOWN = 'unknown'¶

OTHER = 'other'¶

__new__(value)¶

class raes.nodes.RuntimeSudoPrincipalKind¶

Bases: str, Enum

Kind of principal a sudo rule grants privilege to.

USER = 'user'¶

GROUP = 'group'¶

OTHER = 'other'¶

UNKNOWN = 'unknown'¶

__new__(value)¶

class raes.nodes.RuntimeSudoRule¶

Bases: SDLModel

An observed sudo/sudoers privilege grant.

The portable model is the structured principal/run-as/command scope. raw_entry may carry the original sudoers line only as optional descriptive evidence; command_redacted marks a rule whose command scope was withheld because it carried sensitive arguments.

principal: str¶

principal_kind: RuntimeSudoPrincipalKind | str¶

run_as_users: list[str]¶

run_as_groups: list[str]¶

commands: list[str]¶

host_scope: str¶

nopasswd: bool | str¶

command_redacted: bool | str¶

raw_entry: str¶

description: str¶

classmethod validate_principal(v)¶

Parameters:: v (str)
Return type:: str

classmethod normalize_principal_kind(v)¶

Parameters:: v (RuntimeSudoPrincipalKind | str)
Return type:: RuntimeSudoPrincipalKind | str

classmethod coerce_scope_lists(v)¶

Parameters:: v (str | list[str] | None)
Return type:: list[str]

classmethod parse_flags(v, info)¶

Parameters:

v (bool | str)
info (ValidationInfo)

Return type:

bool | str

validate_redacted_commands()¶

Return type:: RuntimeSudoRule

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.nodes.ServicePort¶

Bases: SDLModel

Authored identity of a node-local transport binding.

A service declaration does not authorize traffic, prove a live listener, publish a host port, or classify an internal/external audience. Traffic authorization belongs to infrastructure ACLs; observed bind state and host publication belong to their dedicated runtime surfaces.

port: int | str¶

protocol: str¶

name: WithJsonSchema(json_schema={'anyOf': [{'const': ''}, {'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}]}, mode=None)]¶

description: str¶

classmethod parse_port_value(v)¶

Parameters:: v (int | str)
Return type:: int | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

raes.nodes.parse_ram(value)¶

Parse a human-readable RAM string to bytes.

Accepts bare integers (treated as bytes) or strings like "4 GiB", "2048 MiB", "512mb".

Parameters:: value (str | int)
Return type:: int | str

Infrastructure¶

Infrastructure models — deployment topology.

Maps node names to deployment parameters: instance counts, network links, dependencies, and IP/CIDR properties. IP validation uses Python’s stdlib ipaddress module for backend-agnostic networking.

ACL rules adapted from CybORG’s Subnets.NACLs pattern.

class raes.infrastructure.ACLAction¶

Bases: str, Enum

Firewall rule action.

ALLOW = 'allow'¶

DENY = 'deny'¶

__new__(value)¶

class raes.infrastructure.ACLRule¶

Bases: SDLModel

A network access control rule on an infrastructure node.

Adapted from CybORG’s subnet NACL model. Specifies directional traffic rules between network segments.

name: WithJsonSchema(json_schema={'anyOf': [{'const': ''}, {'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}]}, mode=None)]¶

direction: str¶

from_net: str¶

to_net: str¶

protocol: str¶

ports: list[int | str]¶

action: ACLAction | str¶

description: str¶

classmethod normalize_action(v)¶

Parameters:: v (str)
Return type:: ACLAction | str

classmethod parse_ports(v)¶

Parameters:: v (list[int | str])
Return type:: list[int | str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.infrastructure.SimpleProperties¶

Bases: SDLModel

Network properties for a switch/subnet: CIDR, gateway, and flags.

cidr: str¶

gateway: str¶

internal: bool | str¶

classmethod validate_cidr(v)¶

Parameters:: v (str)
Return type:: str

classmethod validate_gateway(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_internal(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

gateway_within_cidr()¶

Return type:: SimpleProperties

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.infrastructure.InfraNode¶

Bases: SDLModel

Deployment parameters for a node.

Shorthand: node-name: 3 (just the count). Longhand: full dict with count, links, dependencies, properties, acls.

count: int | str¶

links: list[str]¶

dependencies: list[str]¶

properties: SimpleProperties | list[dict[str, str]] | None¶

acls: list[ACLRule]¶

description: str¶

classmethod parse_count(v)¶

Parameters:: v (int | str)
Return type:: int | str

validate_unique_links()¶

Return type:: InfraNode

validate_unique_dependencies()¶

Return type:: InfraNode

validate_unique_acl_names()¶

Return type:: InfraNode

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Features¶

Feature models — software deployed onto VMs.

Features are composable configuration units (Service, Configuration, or Artifact) with dependency graphs. The validator detects cycles.

class raes.features.FeatureType¶

Bases: str, Enum

Kind of feature deployed to a VM.

SERVICE = 'service'¶

CONFIGURATION = 'configuration'¶

ARTIFACT = 'artifact'¶

__new__(value)¶

class raes.features.Feature¶

Bases: SDLModel

A software artifact, service, or configuration deployed to a VM.

name: str¶

type: FeatureType¶

source: Source | None¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

dependencies: list[str]¶

vulnerabilities: list[str]¶

destination: str¶

description: str¶

environment: list[str]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Vulnerabilities¶

Vulnerability models — CWE-classified vulnerabilities.

Each vulnerability is classified by its CWE identifier (e.g., CWE-89 for SQL injection). The class field is validated against a regex.

class raes.vulnerabilities.Vulnerability¶

Bases: SDLModel

A named vulnerability with CWE classification.

name: str¶

description: str¶

technical: bool | str¶

vuln_class: str¶

classmethod parse_technical(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

classmethod validate_cwe_format(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Relationships¶

Relationship models — typed directed edges between scenario elements.

Adapted from STIX 2.1 Relationship SROs and OCR’s dependency patterns. Provides a general-purpose mechanism for expressing how services, nodes, and accounts relate to each other — authentication chains, trust relationships, federation, and connectivity.

This is how identity emerges in the SDL: accounts describe who, features describe what provides auth, and relationships describe how they connect.

class raes.relationships.RelationshipType¶

Bases: str, Enum

How two scenario elements relate to each other.

AUTHENTICATES_WITH = 'authenticates_with'¶

TRUSTS = 'trusts'¶

FEDERATES_WITH = 'federates_with'¶

CONNECTS_TO = 'connects_to'¶

DEPENDS_ON = 'depends_on'¶

MANAGES = 'manages'¶

REPLICATES_TO = 'replicates_to'¶

DOMAIN_CONTROLLER_FOR = 'domain_controller_for'¶

JOINS_DOMAIN = 'joins_domain'¶

FOREST_TRUSTS = 'forest_trusts'¶

DIRECTORY_FEDERATES_TO = 'directory_federates_to'¶

PLACED_ON_CARRIER = 'placed_on_carrier'¶

USES_SHARED_SERVICE = 'uses_shared_service'¶

__new__(value)¶

class raes.relationships.Relationship¶

Bases: SDLModel

A typed directed edge between two named scenario elements.

Source and target can reference any named element in the scenario: nodes, features, accounts, entities, or infrastructure entries. The validator checks that both endpoints resolve.

The properties dict carries type-specific metadata (e.g., trust_type: parent-child for AD trusts, protocol: SAML for federation). It’s a flat dict rather than typed sub-models because relationship properties vary widely and we don’t want to gate expressiveness on pre-modeling every variant.

database_access and mail_access are typed exceptions where protocol/auth details need structural validation rather than prose. forwarding_edge, service_integration, and proxy_upstream are the same kind of typed exception for, respectively, a forwarding / intel-sync agent’s inter-node trust edge (SCN-010 §5.7), a platform consumer-to-engine service integration, and a reverse-proxy/gateway route-to-origin upstream hop. Each keeps protocol/auth/topology facts structurally validated and cross-referable rather than buried in prose.

type: RelationshipType¶

source: str¶

target: str¶

description: str¶

properties: dict[str, str]¶

database_access: RelationshipDatabaseAccess | None¶

mail_access: RelationshipMailAccess | None¶

forwarding_edge: RelationshipForwardingEdge | None¶

service_integration: RelationshipServiceIntegration | None¶

proxy_upstream: RelationshipProxyUpstream | None¶

domain_controller: RelationshipDomainController | None¶

domain_join: RelationshipDomainJoin | None¶

forest_trust: RelationshipForestTrust | None¶

identity_federation: RelationshipIdentityFederation | None¶

carrier_placement: RelationshipCarrierPlacement | None¶

shared_service: RelationshipSharedService | None¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Accounts¶

Account models — user accounts within scenario systems.

Adapted from CyRIS add_account/modify_account and CybORG agent session definitions. Describes accounts that exist on scenario nodes — AD users, database users, SSH users, email accounts — including properties relevant to attack scenarios (password strength, Kerberos SPNs, group memberships).

class raes.accounts.PasswordStrength¶

Bases: str, Enum

How resistant the account password is to cracking.

WEAK = 'weak'¶

MEDIUM = 'medium'¶

STRONG = 'strong'¶

NONE = 'none'¶

__new__(value)¶

class raes.accounts.Account¶

Bases: SDLModel

A user account on a scenario node.

Distinct from OCR’s Role model: roles map exercise participants to VM logins for exercise access. Accounts describe the environment state — what accounts attackers will encounter or exploit.

username: str¶

node: str¶

groups: list[str]¶

password_strength: PasswordStrength | str¶

auth_method: str¶

description: str¶

mail: str¶

spn: str¶

domain_ref: str¶

shell: str¶

home: str¶

disabled: bool | str¶

classmethod normalize_strength(v)¶

Parameters:: v (str)
Return type:: PasswordStrength | str

classmethod parse_disabled(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

validate_required_node()¶

Return type:: Account

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Agents¶

Agent models — role-neutral participants in the scenario.

Adapted from CybORG’s Agents section. An agent has a role (from entities), available actions, initial authenticated access (via accounts), initial knowledge of the environment, and network scope constraints.

The SDL specifies what’s available to each agent, not how the agent executes. Framework bindings (Gymnasium, PettingZoo) are a deployment-layer concern.

The Agent model is the SDL-authoring surface for declarative participant framing (ACT-601, ADR-020). Identity binds to a declared entities entry, role reuses entities.role, starting conditions combine starting_accounts/initial_knowledge/starting_assertions, authority anchors point at declared SDL elements, and operating scope combines allowed_subnets with the broader operating_scope list.

class raes.agents.ParticipantInteractiveAccessChannel¶

Bases: str, Enum

Portable classes of authored participant interactive access.

SSH = 'ssh'¶

RDP = 'rdp'¶

__new__(value)¶

class raes.agents.ParticipantInteractiveAccess¶

Bases: SDLModel

One authored participant-to-VM interactive-access binding.

This record carries portable intent only. It is not a host locator, port, credential, portal session, listener observation, or realization claim.

target_ref: str¶

channel: )*[a-z0-9][a-z0-9_-]{0,63})\\}$', 'not': {'pattern': '[\\r\\n]'}, 'x-raes-variable-reference': True}, mode=None)]¶

account_ref: str | None¶

classmethod parse_channel(value)¶

Parameters:: value (object)
Return type:: ParticipantInteractiveAccessChannel | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.agents.InitialKnowledge¶

Bases: SDLModel

What an agent knows about the scenario at start time.

Adapted from CybORG’s INT (Initial Network Topology). Specifies which hosts, subnets, services, and accounts the agent has knowledge of before the scenario begins.

hosts: list[str]¶

subnets: list[str]¶

services: list[str]¶

accounts: list[str]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.agents.Agent¶

Bases: SDLModel

A role-neutral participant in the scenario.

Agents reference existing scenario elements:

entity links to the entities section (team/role) and supplies identity and role per ADR-020
starting_accounts links to the accounts section
allowed_subnets links to infrastructure entries
initial_knowledge references nodes and infrastructure
starting_assertions links to precondition assertions, giving the authoring surface a declarative hook for participant-relevant starting state without equating a probe implementation with truth (ACT-601)
authority_anchors links to declared SDL elements (entities, relationships, content, etc.) that anchor what the participant is allowed or expected to do in scenario meaning (ACT-601, ADR-020)
operating_scope links to targetable named scenario elements (subnets, hosts, services, content) defining where the participant may act or observe (ACT-601, ADR-020)
observation_boundaries links to declared participant observation boundaries that define participant-specific projections of world and evidence state (SEM-208)
interactive_access declares the VM/channel pairs that may be offered to this participant, without inferring a listener, locator, credential, operating scope, action authority, or successful realization (DSL-117)

Per ADR-073 the CybORG-inherited reward_calculator label was removed; it was an unbound, unvalidated string and graded reward lives in the experiment/evaluator plane (ADR-055/064/069).

entity: str¶

description: str¶

actions: list[str]¶

starting_accounts: list[str]¶

initial_knowledge: InitialKnowledge | None¶

allowed_subnets: list[str]¶

starting_assertions: list[str]¶

authority_anchors: list[str]¶

operating_scope: list[str]¶

observation_boundaries: list[str]¶

interactive_access: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], ~raes.agents.ParticipantInteractiveAccess]¶

classmethod reject_legacy_starting_conditions(value)¶

Parameters:: value (object)
Return type:: object

validate_required_entity()¶

Return type:: Agent

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Content¶

Content models — data placed into scenario systems.

Adapted from CyRIS copy_content and emulate_traffic_capture patterns. Represents files, datasets (email collections, DB records, pcap files), and directory structures that exist within scenario nodes as part of the environment state.

Examples: phishing lure emails in an Exchange mailbox, synthetic customer records in a database, planted credentials in shared directories, CTF flag files.

class raes.content.ContentType¶

Bases: str, Enum

Kind of content placed into a system.

FILE = 'file'¶

DATASET = 'dataset'¶

DIRECTORY = 'directory'¶

__new__(value)¶

class raes.content.ContentItem¶

Bases: SDLModel

A single item within a dataset (e.g., one email, one record).

name: WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)]¶

display_name: str¶

tags: list[str]¶

description: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.content.ServiceMaterializationRequirements¶

Bases: SDLModel

Exact portable operation, ownership, and readback requirements.

operation: Literal['ensure-owned-items']¶

conflict_policy: Literal['reject-unowned-collision']¶

readback: Literal['canonical-content-digest']¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.content.ServiceMaterialization¶

Bases: SDLModel

Portable control contract for placing content through a named service.

target_service_ref: str¶

interface_profile: Literal['service-content']¶

profile_version: Literal['1']¶

requirements: ServiceMaterializationRequirements¶

shared_service_relationship_ref: str¶

ordering_content_refs: list[str]¶

readback_assertion_refs: list[str]¶

evidence_requirement_refs: list[str]¶

observation_boundary_refs: list[str]¶

classmethod validate_references(values, info)¶

Parameters:

values (list[str])
info (ValidationInfo)

Return type:

list[str]

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.content.Content¶

Bases: SDLModel

Data or files placed into a scenario node.

Supports three forms:

file: A single file at a specific path, optionally with inline text.
dataset: A collection of related items (emails, records, pcaps) delivered via a source package or listed as items.
directory: A directory structure placed at a destination path.

type: ContentType¶

description: str¶

target: str¶

path: str¶

destination: str¶

text: str | None¶

source: Source | None¶

format: str¶

items: list[ContentItem]¶

sensitive: bool | str¶

tags: list[str]¶

service_materialization: ServiceMaterialization | None¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_sensitive(v)¶

Parameters:: v (bool | str)
Return type:: bool | str

validate_type_requirements()¶

Require the minimum anchors needed to describe real content.

Return type:: Content

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Entities¶

Entity models — organizations, teams, and people.

Entities form a recursive hierarchy with exercise roles (White/Green/Red/Blue). Nested entities are referenced via dot-notation (e.g., blue-team.bob).

class raes.entities.ExerciseRole¶

Bases: str, Enum

Role in the exercise.

WHITE = 'white'¶

GREEN = 'green'¶

RED = 'red'¶

BLUE = 'blue'¶

__new__(value)¶

class raes.entities.Entity¶

Bases: SDLModel

An organizational unit, team, or person in the exercise.

Entities can nest recursively. Flattened names use dot-notation: blue-team.bob refers to the bob entity nested inside blue-team.

name: str¶

description: str¶

role: ExerciseRole | str | None¶

classmethod normalize_role(v)¶

mission: str¶

categories: list[str]¶

vulnerabilities: list[str]¶

facts: dict[str, str]¶

events: list[str]¶

entities: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], Entity]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

raes.entities.flatten_entities(entities, prefix='')¶

Flatten a recursive entity hierarchy into dot-notation names.

Returns a dict mapping "parent.child.grandchild" to the leaf Entity objects.

Parameters:

entities (dict[str, Entity])
prefix (str)

Return type:

dict[str, Entity]

Conditions¶

Legacy probe implementation declarations run on VMs.

A condition is either command-based (command + interval) or source-based (a library package). It may explicitly bind the proposition it realizes, but its command/source fields never define that proposition’s meaning.

class raes.conditions.Condition¶

Bases: SDLModel

A probe implementation deployed to a VM.

Either command + interval or source must be set, not both.

name: str¶

proposition: str¶

command: str | None¶

interval: int | str | None¶

timeout: int | str | None¶

retries: int | str | None¶

start_period: int | str | None¶

source: Source | None¶

description: str¶

environment: list[str]¶

classmethod parse_scalar_fields(data)¶

validate_command_xor_source()¶

Return type:: Condition

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Orchestration¶

SDL orchestration and workflow models.

raes.orchestration.parse_duration(value)¶

Parse an OCR-compatible human-readable duration into seconds.

Parameters:: value (str | int | float)
Return type:: int | str

class raes.orchestration.Inject¶

Bases: SDLModel

An action injected between entities during an exercise.

name: str¶

source: Source | None¶

from_entity: str¶

to_entities: list[str]¶

description: str¶

environment: list[str]¶

validate_entity_pairing()¶

Return type:: Inject

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.Event¶

Bases: SDLModel

A triggered action combining assertion preconditions and injects.

name: str¶

source: Source | None¶

assertions: list[str]¶

injects: list[str]¶

description: str¶

classmethod reject_legacy_conditions(value)¶

Parameters:: value (object)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.Script¶

Bases: SDLModel

A timed sequence of human-readable durations parsed to seconds.

name: str¶

start_time: int | str¶

end_time: int | str¶

speed: float | str¶

events: dict[str, int | str]¶

description: str¶

classmethod parse_time(v)¶

Parameters:: v (str | int | float)
Return type:: int | str

classmethod parse_speed(v)¶

Parameters:: v (str | int | float)
Return type:: float | str

classmethod parse_event_times(v)¶

Parameters:: v (dict)
Return type:: dict[str, int | str]

validate_time_bounds()¶

Return type:: Script

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.Story¶

Bases: SDLModel

Top-level exercise orchestration — a group of scripts.

name: str¶

speed: float | str¶

scripts: list[str]¶

description: str¶

classmethod parse_speed(v)¶

Parameters:: v (str | int | float)
Return type:: float | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowStepType¶

Bases: str, Enum

Control-flow node types for declarative experiment workflows.

OBJECTIVE = 'objective'¶

DECISION = 'decision'¶

SWITCH = 'switch'¶

PARALLEL = 'parallel'¶

JOIN = 'join'¶

RETRY = 'retry'¶

CALL = 'call'¶

END = 'end'¶

__new__(value)¶

class raes.orchestration.WorkflowStepExecutionMode¶

Bases: str, Enum

Authored realization boundary for an executable workflow step.

SCRIPTED = 'scripted'¶

OBJECTIVE = 'objective'¶

SCAFFOLDED = 'scaffolded'¶

__new__(value)¶

class raes.orchestration.WorkflowStepOutcome¶

Bases: str, Enum

Portable workflow-visible outcomes emitted by executable steps.

SUCCEEDED = 'succeeded'¶

FAILED = 'failed'¶

EXHAUSTED = 'exhausted'¶

__new__(value)¶

class raes.orchestration.WorkflowStepStateRef¶

Bases: SDLModel

Predicate reference to previously observed workflow step state.

step: str¶

outcomes: list[WorkflowStepOutcome]¶

min_attempts: int | str | None¶

classmethod parse_min_attempts(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

validate_unique_outcomes()¶

Return type:: WorkflowStepStateRef

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowPredicate¶

Bases: SDLModel

Typed branch predicate over assertions, objectives, and prior step state.

assertions: list[str]¶

objectives: list[str]¶

steps: list[WorkflowStepStateRef]¶

classmethod reject_legacy_conditions(value)¶

Parameters:: value (object)
Return type:: object

validate_non_empty()¶

Return type:: WorkflowPredicate

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowSwitchCase¶

Bases: SDLModel

One ordered branch case within a switch workflow step.

when: WorkflowPredicate¶

next_step: str¶

description: str¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowTimeoutPolicy¶

Bases: SDLModel

Workflow-level timeout policy.

seconds: int | str¶

classmethod parse_seconds(v)¶

Parameters:: v (str | int | float)
Return type:: int | str

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowCompensationMode¶

Bases: str, Enum

Workflow-level compensation behavior.

AUTOMATIC = 'automatic'¶

DISABLED = 'disabled'¶

__new__(value)¶

class raes.orchestration.WorkflowCompensationTrigger¶

Bases: str, Enum

Terminal workflow reasons that may trigger compensation.

FAILED = 'failed'¶

CANCELLED = 'cancelled'¶

TIMED_OUT = 'timed_out'¶

__new__(value)¶

class raes.orchestration.WorkflowCompensationFailurePolicy¶

Bases: str, Enum

How primary workflow status should treat compensation failures.

FAIL_WORKFLOW = 'fail_workflow'¶

RECORD_AND_CONTINUE = 'record_and_continue'¶

__new__(value)¶

class raes.orchestration.WorkflowCompensationPolicy¶

Bases: SDLModel

Workflow-level compensation policy.

mode: WorkflowCompensationMode¶

on: list[WorkflowCompensationTrigger]¶

failure_policy: WorkflowCompensationFailurePolicy¶

order: str¶

classmethod normalize_order(v)¶

Parameters:: v (object)
Return type:: str

validate_policy()¶

Return type:: WorkflowCompensationPolicy

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.WorkflowStep¶

Bases: SDLModel

A named workflow step with explicit portable control semantics.

type: WorkflowStepType¶

execution_mode: WorkflowStepExecutionMode¶

objective: str¶

procedure_ref: str¶

scaffold_refs: list[str]¶

allowed_action_families: list[str]¶

tool_affordance_refs: list[str]¶

capability_refs: list[str]¶

fact_binding_refs: list[str]¶

next: str¶

on_success: str¶

on_failure: str¶

on_exhausted: str¶

when: WorkflowPredicate | None¶

then_step: str¶

else_step: str¶

cases: list[WorkflowSwitchCase]¶

default_step: str¶

branches: list[str]¶

join: str¶

workflow: str¶

compensate_with: str¶

max_attempts: int | str | None¶

description: str¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

classmethod parse_max_attempts(v)¶

Parameters:: v (int | str | None)
Return type:: int | str | None

classmethod validate_goal_refs(values)¶

Parameters:: values (list[str])
Return type:: list[str]

validate_execution_mode()¶

Return type:: WorkflowStep

validate_type_specific_fields()¶

Return type:: WorkflowStep

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.orchestration.Workflow¶

Bases: SDLModel

A declarative experiment control graph over objectives.

description: str¶

start: str¶

timeout: WorkflowTimeoutPolicy | None¶

compensation: WorkflowCompensationPolicy | None¶

steps: dict[~typing.Annotated[str, ~pydantic.functional_validators.AfterValidator(func=~raes._identifiers._validate_portable_identifier), ~pydantic.json_schema.WithJsonSchema(json_schema={'type': 'string', 'minLength': 1, 'maxLength': 64, 'pattern': '^[a-z0-9]', 'not': {'pattern': '[^a-z0-9_-]'}}, mode=None)], ~raes.orchestration.WorkflowStep]¶

classmethod parse_timeout(v)¶

Parameters:: v (object)
Return type:: object

classmethod parse_compensation(v)¶

Parameters:: v (object)
Return type:: object

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Objectives¶

Declarative experiment objectives for the SDL.

Objectives bind together: - who acts (agent or entity) - what they are trying to affect (targets, actions) - when it matters (window) - how success is interpreted (success)

This is intentionally different from backend-specific runtime probes. The SDL carries experiment semantics; concrete evaluation mechanics live in runtime adapters.

class raes.objectives.ObjectiveSuccess¶

Bases: SDLModel

Declarative success criteria for an objective.

Success composes backend-neutral invariant or postcondition assertions. Probe implementations, graded scoring, and reward remain outside this construct.

mode: TruthCompositionMode | str¶

assertions: list[str]¶

threshold: int | None¶

classmethod reject_legacy_conditions(value)¶

Parameters:: value (object)
Return type:: object

classmethod normalize_mode(v)¶

Parameters:: v (str)
Return type:: TruthCompositionMode | str

validate_non_empty()¶

Return type:: ObjectiveSuccess

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.objectives.ObjectiveWindow¶

Bases: SDLModel

Optional orchestration window constraining when an objective applies.

stories: list[str]¶

scripts: list[str]¶

events: list[str]¶

workflows: list[str]¶

steps: list[str]¶

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

class raes.objectives.Objective¶

Bases: SDLModel

A declarative experiment objective.

name: str¶

description: str¶

agent: str¶

entity: str¶

actions: list[str]¶

targets: list[str]¶

success: ObjectiveSuccess¶

window: ObjectiveWindow | None¶

depends_on: list[str]¶

validate_actor_binding()¶

Return type:: Objective

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].

Variables¶

Variable models — scenario parameterization.

Adapted from CACAO v2.0 playbook_variables. Named variables with types, defaults, and descriptions that can be referenced throughout the scenario via ${var_name} substitution syntax.

Variables are NOT resolved at parse time. The SDL parser stores ${var_name} strings as-is in the model. Resolution happens at instantiation time when a backend deploys the scenario.

class raes.variables.VariableType¶

Bases: str, Enum

Data type of a variable.

STRING = 'string'¶

INTEGER = 'integer'¶

BOOLEAN = 'boolean'¶

NUMBER = 'number'¶

__new__(value)¶

class raes.variables.Variable¶

Bases: SDLModel

A named variable for scenario parameterization.

Variables define configurable parameters with types, defaults, and optional value constraints. They’re referenced in other sections via ${variable_name} syntax.

type: VariableType¶

default: str | int | float | bool | None¶

description: str¶

allowed_values: list[str | int | float | bool]¶

required: bool¶

classmethod normalize_type(v)¶

Parameters:: v (str)
Return type:: str

validate_typed_values()¶

Defaults and allowed values must match the declared type.

Return type:: Variable

model_config = {'extra': 'forbid', 'populate_by_name': True, 'validate_by_alias': True, 'validate_by_name': True}¶: Configuration for the model, should be a dictionary conforming to [ConfigDict][pydantic.config.ConfigDict].