pub struct ProbeSubResult {
pub control_id: String,
pub status: ProbeStatus,
pub framework: String,
pub article: Option<String>,
pub effective_mode: ProbeMode,
pub override_reason: Option<String>,
}Expand description
Per-control sub-result on a kind = evidence probe (RFC-0007 §7.1).
None aggregate for non-evidence probes; Some(vec) for evidence
probes — the applier’s probe_failures co-write iterates sub_results
to populate one row per failing control_id.
Fields§
§control_id: String§status: ProbeStatus§framework: StringFramework label (e.g. “nis2-essential”). Echoes the probe
declaration’s framework field.
article: Option<String>Framework-specific control reference (e.g. “nis2:21(b)”).
effective_mode: ProbeModePer-control effective mode after applying the probe’s
controlOverrides / controls map. The compliance_wave gate
counts only Enforce-mode sub_results; Observe is recorded
for visibility but does not gate. Disabled controls are
dropped from sub_results entirely at the agent runner.
serde(default) falls back to the probe-level mode for events
emitted by pre-override-aware agents.
override_reason: Option<String>Operator-declared audit rationale for the override, sourced
from controlOverrides[control].reason or
controls[control].reason in fleet.nix. None when no
override applies (effective_mode equals probe-level mode);
Some("") when the operator declared an override but left
the rationale blank. CP writes this verbatim into event_log
payloads so auditors recover “why was this control
downgraded” from the signed event stream alone.
Trait Implementations§
Source§impl Clone for ProbeSubResult
impl Clone for ProbeSubResult
Source§fn clone(&self) -> ProbeSubResult
fn clone(&self) -> ProbeSubResult
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more