mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-03 00:28:51 +00:00
rcourtman
e1103bf119
Third compounding slice on per-resource operator state, completing the suppression triangle: maintenance window (slice 31), intentionally offline (slice 32), and now NeverAutoRemediate at the action-broker boundary. When the operator has set NeverAutoRemediate=true on a resource, executeCommandWithAudit refuses the dispatch even with a valid approval and matching plan hash — per-resource operator intent outranks per-action approval. The check sits next to the drift refusal in the same audit hot path: fail-open on store-lookup error (logged but doesn't block), persist a Failed audit record with `resource_remediation_locked:` prefix on the ErrorMessage so audit-UI filters and alert rules can branch on the stable token. Returns ErrResourceRemediationLocked sentinel for caller-side branching. Reuses the existing actionAuditStore handle (which is the unified ResourceStore from slice 29), so no new provider plumbing needed — the broker already has the data path it needs.