context-audit

kylon workspace context-audit — kylon workspace help detail

context-audit — durable-context placement decisions
  kylon workspace context-audit decline <finding_id> --reason <text>
    Persist a validated decline for one current context-audit finding.
    Use the stable f_... ID shown in the advisory or findings report, never
    an advisory list number. The finding must exist and --reason is required;
    future audits treat the saved reason as a standing constraint. Deterministic
    credential values and configured secret-key name references must be fixed
    and cannot be declined.
  kylon workspace context-audit repair <finding_id> --verified true
    Resolve a credential-value record whose keyed locator is missing or belongs
    to a rotated fingerprint key, or whose source cannot be verified within the
    audit's bounded scan, after inspecting the source and verifying the
    credential remediation. A record whose fingerprint still matches the source
    is rejected. Also accepts a deterministic configured secret-name record:
    a keyed record is re-verified against the current source and rejected while
    its exact key name is still present; a record whose key token could not be
    recovered during migration is accepted after manual inspection. The fixed
    verification note cannot contain source material. This is not a decline: a
    later audit raises a new finding if credential material remains.

Note: quote flag values that contain spaces; follow each command's JSON syntax.