# cmdb — Changelog

## v1.0.0 — 2026-06-23

Initial release. Foundational asset inventory for the cli.johlem.net
suite. First tool in the "productivity-boost" series queued after the
2026-06-23 fleet review (queue: cmdb → notify → compose-audit →
pkgaudit → shellrec → webfuzz → changefeed → signtree → backupcheck
→ tabletop → stegcrypt v1.1 audio → pwgen → burp-cli → sftui).

### Purpose

Every cli.johlem.net tool needs to know what to target. cmdb is the
canonical answer: a SQLite-backed (XDG paths) inventory of hosts,
services, and owners with DORA Art. 8 / NIS2 Art. 21(1)(a) metadata
baked into every record. Downstream tools (urlrecon, hostwatch,
avwatch, socialscope, …) read cmdb as their target list and
`cmdb link` attaches finding URLs to specific assets so the post-mortem
walk-through ("which assets were touched by this finding?") is a
one-liner.

### Subcommands

```
cmdb add      --id <ID> --kind host|service|owner --name <N>
              [--address …] [--owner …] [--criticality critical|important|standard|none]
              [--entity-type …] [--business-line …] [--data-location-country …]
              [--tags a,b,c]
cmdb list     [--kind …] [--criticality …] [--tag …] [-F human|json|jfind]
cmdb show     <ID> [-F human|json|jfind]
cmdb edit     <ID> [--name …] [--criticality …] [--tags …] [other flags…]
cmdb rm       <ID>
cmdb check    <ID>                      # mark last_seen = now
cmdb link     --asset <ID> --finding <URL> [--note <text>]
```

### Storage

- `$XDG_DATA_HOME/cli-johlem/cmdb.db` (override with `$CMDB_DB`).
- WAL journal mode, foreign keys on.
- Schema versioned in `meta` table; v1 = `asset` + `link`.

### jfind/v1 output

`cmdb list -F jfind` and `cmdb show -F jfind` emit `asset-inventory`
findings. Every asset carries DORA Art. 8 as a pre-filled control;
critical / important assets additionally carry NIS2 Art. 21(1)(a) and
ISO/IEC 27001:2022 A.5.9. Severity mapping: critical → High, important
→ Medium, standard → Low, none → Info.

### Suite interop

| Producer | Consumer | Use case |
|---|---|---|
| operator | cmdb | enrol assets |
| cmdb | urlrecon | feed batch targets |
| cmdb | hostwatch | feed monitoring list |
| cmdb | avwatch | feed FIM scope |
| cmdb | roigen | RT.04.01 critical-function source |
| credsweep / urlrecon / socialscope / phishprobe | cmdb link | attach finding URLs to assets |
| cmdb | complymap | jfind/v1 → control mapping |
| cmdb | dossier | per-asset audit appendix |

### Build

- Library crate (`cmdb`) + thin CLI binary.
- 6 unit + 14 integration tests = 20 tests, all green.
- Zero compiler warnings.
- SQLite via `rusqlite` (bundled) — no system libsqlite3 dependency.
- Directories via `directories` crate — XDG-compliant.
- jfind/v1 native via path-dependency on `jfind`.
- Suite-standard exit codes (0 ok | 2 usage | 3 runtime).
- NixOS-only platform gate in `install.sh`.

### Deferred to v1.1

- `cmdb import` — read JSON / CSV / NDJSON / jfind-bundle and bulk-insert.
- `cmdb export` — same shapes outbound.
- Active probe in `cmdb check` (TCP / HTTP) instead of the manual "mark
  seen" form.
- Per-asset alerting hook (wire to `notify` once that lands).
- `cmdb diff` — show what changed since the last snapshot.
- Schema-migration test harness for v1 → v2.