seceng doctor
The current diagnostics capability is real and live:
engines/seceng-engine/src/capabilities.rs
id: seceng.defend.doctor
title: SecEng Doctor
summary: Inspect engine health, compatibility, permissions,
local API state, and support-bundle readiness.
cli: savvy seceng doctor --json
http: GET /meta/diagnostics
lifecycle: Experimental
visibility: PublicA useful support report
Include:
- Engine, schema, and adapter versions
- Sanitized entitlement state
- The exact command or endpoint used
- Target type (never the target value itself, unless explicitly authorized)
- Correlation or job identifier
- Safe error code, if one applies
- Output manifest and sanitized logs
- Reproduction steps and business impact
Error categories
Draft — generated reference pending
SecEng does not yet publish a stable, versioned, partner-facing error code catalog — see the generated errors reference for the current honest status. Error responses today follow ad-hoc ErrorResponse shapes per route rather than one canonical catalog. Treat any error code you observe as provisional until a versioned catalog ships, and build your handling around HTTP status + safe message text rather than a fixed code enum.
Diagnostic bundle
A diagnostic bundle should:
- Exclude secrets by default
- Redact customer-sensitive values
- Include versions and correlation identifiers
- Include the smallest reproducible evidence, not a full dump
- Carry checksums
- State its own sensitivity and redaction status explicitly