Struct OcsfEvent 

pub struct OcsfEvent {

    pub metadata: Metadata,
    pub class_name: EventClass,
    pub class_uid: u32,
    pub category_uid: u8,
    pub activity_id: u8,
    pub type_uid: u64,
    pub time: u64,
    pub time_iso: String,
    pub severity_id: u8,
    pub status_id: u8,
    pub session_uid: String,
    pub ai_agent: AgentIdentity,
    pub stop_reason_id: Option<u8>,
    pub stop_reason: Option<String>,
    pub payload: Value,
    pub metrics: Option<EventMetrics>,
    pub inventory: Option<Fingerprint>,
    pub prev_inventory: Option<Fingerprint>,
    pub unmapped: Map<String, Value>,
}

A schema-conformant agent event.

Unknown inbound fields at the TOP LEVEL are preserved in Self::unmapped (never silently dropped); outbound serialization is always the current schema shape.

Round-34 F3 — additive tolerance is TOP-LEVEL ONLY

The deny_unknown_fields attribute on every nested struct (Metadata, AgentIdentity, Product, CharterFile, EventMetrics, Fingerprint) means an unknown field INSIDE one of those objects fails deserialization for the whole event — it does NOT flow into unmapped. Cross-version replay of a mixed-fleet stream during a rolling upgrade therefore requires that nested-object shape additions bump config_version in lockstep with the schema; only newly-added TOP-LEVEL fields are safe to deploy incrementally. This asymmetry is deliberate: nested types are the audit-trail schema surface consumers commit to (SIEM ingestion pipelines depend on their exact shape), while the top-level union tolerates additive OCSF evolution so consumers can continue to parse events emitted by newer nodes during a rolling deploy of the harness itself.

Fields

metadata: Metadata

Event metadata.

class_name: EventClass

Class enum (serialized as agent.<class>).

class_uid: u32

Numeric class uid.

category_uid: u8

OCSF Application Activity category uid.

activity_id: u8

Activity within the class (1 = default activity).

type_uid: u64

class_uid * 100 + activity_id per OCSF convention.

time: u64

Epoch milliseconds.

time_iso: String

ISO-8601 mirror of time for human consumers.

severity_id: u8

Severity (1 = informational … 6 = fatal).

status_id: u8

Outcome status.

session_uid: String

Session this event belongs to.

ai_agent: AgentIdentity

Agent config-state identity block.

stop_reason_id: Option<u8>

Stop reason id, when applicable.

stop_reason: Option<String>

Stop reason text: the provider’s native value when captured, otherwise the normalized crate::StopReason caption.

payload: Value

Class-specific payload.

metrics: Option<EventMetrics>

Token metrics (ATIF-mirrored names).

inventory: Option<Fingerprint>

Per-forward-pass inventory fingerprint (roadmap, flag-gated).

prev_inventory: Option<Fingerprint>

Previous inventory fingerprint (chained like prev_event).

unmapped: Map<String, Value>

Unknown fields captured on inbound parse (evolution tolerance).

Trait Implementations

impl Clone for OcsfEvent

fn clone(&self) -> OcsfEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OcsfEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OcsfEvent

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for OcsfEvent

fn eq(&self, other: &OcsfEvent) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for OcsfEvent

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OcsfEvent