0.5.0

Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.

.forgejo/workflows/build-deb.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+
+jobs:
+  test:
+    runs-on: docker
+
+    steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+          build-essential \
+          devscripts \
+          debhelper \
+          dh-python \
+          pybuild-plugin-pyproject \
+          python3-all \
+          python3-poetry-core \
+          python3-yaml \
+          python3-paramiko \
+          python3-jsonschema \
+          rsync \
+          ca-certificates
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Build deb
+        run: |
+          mkdir /out
+
+          rsync -a --delete \
+            --exclude '.git' \
+            --exclude '.venv' \
+            --exclude 'dist' \
+            --exclude 'build' \
+            --exclude '__pycache__' \
+            --exclude '.pytest_cache' \
+            --exclude '.mypy_cache' \
+            ./ /out/
+
+          cd /out/
+          export DEBEMAIL="mig@mig5.net"
+          export DEBFULLNAME="Miguel Jacq"
+
+          dch --distribution "trixie" --local "~trixie" "CI build for trixie"
+          dpkg-buildpackage -us -uc -b
+
+      # Notify if any previous step in this job failed
+      - name: Notify on failure
+        if: ${{ failure() }}
+        env:
+          WEBHOOK_URL: ${{ secrets.NODERED_WEBHOOK_URL }}
+          REPOSITORY: ${{ forgejo.repository }}
+          RUN_NUMBER: ${{ forgejo.run_number }}
+          SERVER_URL: ${{ forgejo.server_url }}
+        run: |
+          curl -X POST \
+               -H "Content-Type: application/json" \
+               -d "{\"repository\":\"$REPOSITORY\",\"run_number\":\"$RUN_NUMBER\",\"status\":\"failure\",\"url\":\"$SERVER_URL/$REPOSITORY/actions/runs/$RUN_NUMBER\"}" \
+               "$WEBHOOK_URL"

.forgejo/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
         run: |
           apt-get update
           DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            ansible ansible-lint python3-venv pipx systemctl python3-apt
+            ansible ansible-lint python3-venv pipx systemctl python3-apt jq python3-jsonschema
 
       - name: Install Poetry
         run: |

.forgejo/workflows/trivy.yml

@@ -1,40 +0,0 @@
-name: Trivy
-
-on:
-  schedule:
-    - cron: '0 1 * * *'
-  push:
-
-jobs:
-  test:
-    runs-on: docker
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install system dependencies
-        run: |
-          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends wget gnupg
-          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | tee /usr/share/keyrings/trivy.gpg > /dev/null
-          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | tee -a /etc/apt/sources.list.d/trivy.list
-          apt-get update
-          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends trivy
-
-      - name: Run trivy
-        run: |
-          trivy fs --no-progress --ignore-unfixed --format table --disable-telemetry .
-
-      # Notify if any previous step in this job failed
-      - name: Notify on failure
-        if: ${{ failure() }}
-        env:
-          WEBHOOK_URL: ${{ secrets.NODERED_WEBHOOK_URL }}
-          REPOSITORY: ${{ forgejo.repository }}
-          RUN_NUMBER: ${{ forgejo.run_number }}
-          SERVER_URL: ${{ forgejo.server_url }}
-        run: |
-          curl -X POST \
-               -H "Content-Type: application/json" \
-               -d "{\"repository\":\"$REPOSITORY\",\"run_number\":\"$RUN_NUMBER\",\"status\":\"failure\",\"url\":\"$SERVER_URL/$REPOSITORY/actions/runs/$RUN_NUMBER\"}" \
-               "$WEBHOOK_URL"

CHANGELOG.md

@@ -1,3 +1,86 @@
+# 0.4.4
+
+ * Update cryptography dependency
+ * Add capability to handle passphrases on encrypted SSH private keys. Prompting can be forced with `--ask-key-passphrase` or automated (e.g for CI) with `--ssh-key-passphrase env SOMEVAR`
+
+# 0.4.3
+
+ * Add support for AddressFamily and ConnectTimeout in the .ssh/config when using `--remote-ssh-config`.
+ * Update dependencies
+
+# 0.4.2
+
+ * Support `--remote-ssh-config [path-to-ssh-config]` as an argument in case extra params are required beyond `--remote-port` or `--remote-user`. Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
+
+# 0.4.1
+
+ * Add interactive output when 'enroll diff --enforce' is invoking Ansible.
+
+# 0.4.0
+
+ * Introduce `enroll validate` - a tool to validate a harvest against the state schema, or check for missing or orphaned obsolete artifacts in a harvest.
+ * Attempt to generate Jinja2 templates of systemd unit files and Postfix main.cf (now that JinjaTurtle supports it)
+ * Update pynacl dependency to resolve CVE-2025-69277
+ * Add `--exclude-path` to `enroll diff` command, so that you can ignore certain churn from the diff (stuff you still wanted to harvest as a baseline but don't care if it changes day to day)
+ * Add `--ignore-package-versions` to `enroll diff` command, to optionally ignore package upgrades (e.g due to patching) from the diff.
+ * Add tags to the playbook for each role, to allow easier targeting of specific roles during play later.
+ * Add `--enforce` mode to `enroll diff`. If there is diff detected between the two harvests, and it can enforce restoring the state from the older harvest, it will manifest the state and apply it with ansible. Only the specific roles that had diffed will be applied (via the new tags capability)
+
+# 0.3.0
+
+ * Introduce `enroll explain` - a tool to analyze and explain what's in (or not in) a harvest and why.
+ * Centralise the cron and logrotate stuff into their respective roles, we had a bit of duplication between roles based on harvest discovery.
+ * Capture other files in the user's home directory such as `.bashrc`, `.bash_aliases`, `.profile`, if these files differ from the `/etc/skel` defaults
+ * Ignore files that end with a tilde or - (probably backup files generated by editors or shadow file changes)
+ * Manage certain symlinks e.g for apache2/nginx sites-enabled and so on
+
+# 0.2.3
+
+ * Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible. It will also fall back to this prompt if a password is required but the arg wasn't passed in.
+
+# 0.2.2
+
+ * Fix stat() of parent directory so that we set directory perms correct on --include paths.
+ * Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty
+
+# 0.2.1
+
+ * Don't accidentally add `extra_paths` role to `usr_local_custom` list, resulting in `extra_paths` appearing twice in manifested playbook
+ * Ensure directories in the tree of anything included with --include are defined in the state and manifest so we make dirs before we try to create files
+
+# 0.2.0
+
+ * Add version CLI arg
+ * Add ability to enroll RH-style systems (DNF5/DNF/RPM)
+ * Refactor harvest state to track package versions
+
+# 0.1.7
+
+ * Fix an attribution bug for certain files ending up in the wrong package/role.
+
+# 0.1.6
+
+ * DRY up some code logic
+ * More test coverage
+
+# 0.1.5
+
+ * Consolidate logrotate and cron files into their main service/package roles if they exist.
+ * Standardise on `MAX_FILES_CAP` in one place
+ * Manage apt stuff in its own role, not in `etc_custom`
+
+# 0.1.4
+
+ * Attempt to capture more stuff from /etc that might not be attributable to a specific package. This includes common singletons and systemd timers
+ * Avoid duplicate apt data in package-specific roles.
+
+# 0.1.3
+
+ * Allow the user to add extra paths to harvest, or paths to ignore, using `--exclude-path` and `--include-path`
+   arguments.
+ * Add support for an enroll.ini config file to store arguments per subcommand, to avoid having to remember
+   them all for repetitive executions.
+
 # 0.1.2
 
  * Include files from `/usr/local/bin` and `/usr/local/etc` in harvest (assuming they aren't binaries or

CONTRIBUTORS.md

@@ -0,0 +1,5 @@
+## Contributors
+
+mig5 would like to thank the following people for their contributions to Enroll.
+
+ * [slhck](https://slhck.info/)

Dockerfile.debbuild

@@ -26,6 +26,7 @@ RUN set -eux; \
       python3-poetry-core \
       python3-yaml \
       python3-paramiko \
+      python3-jsonschema \
       rsync \
       ca-certificates \
     ; \

Dockerfile.rpmbuild

@@ -0,0 +1,88 @@
+# syntax=docker/dockerfile:1
+ARG BASE_IMAGE=fedora:42
+FROM ${BASE_IMAGE}
+
+RUN set -eux; \
+    dnf -y update; \
+    dnf -y install \
+        rpm-build \
+        rpmdevtools \
+        redhat-rpm-config \
+        gcc \
+        make \
+        findutils \
+        tar \
+        gzip \
+        rsync \
+        python3 \
+        python3-devel \
+        python3-setuptools \
+        python3-wheel \
+        pyproject-rpm-macros \
+        python3-rpm-macros \
+        python3-yaml \
+        python3-paramiko \
+        python3-jsonschema \
+        openssl-devel \
+        python3-poetry-core ; \
+        dnf -y clean all
+
+# Build runner script (copies repo, tars, runs rpmbuild)
+RUN set -eux;   cat > /usr/local/bin/build-rpm <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+
+SRC="${SRC:-/src}"
+WORKROOT="${WORKROOT:-/work}"
+OUT="${OUT:-/out}"
+VERSION_ID="$(grep VERSION_ID /etc/os-release | cut -d= -f2)"
+echo "Version ID is ${VERSION_ID}"
+
+mkdir -p "${WORKROOT}" "${OUT}"
+WORK="${WORKROOT}/src"
+rm -rf "${WORK}"
+mkdir -p "${WORK}"
+
+rsync -a --delete \
+  --exclude '.git' \
+  --exclude '.venv' \
+  --exclude 'dist' \
+  --exclude 'build' \
+  --exclude '__pycache__' \
+  --exclude '.pytest_cache' \
+  --exclude '.mypy_cache' \
+  "${SRC}/" "${WORK}/"
+
+cd "${WORK}"
+
+# Determine version from pyproject.toml unless provided
+if [ -n "${VERSION:-}" ]; then
+  ver="${VERSION}"
+else
+  ver="$(grep -m1 '^version = ' pyproject.toml | sed -E 's/version = "([^"]+)".*/\1/')"
+fi
+
+TOPDIR="${WORKROOT}/rpmbuild"
+mkdir -p "${TOPDIR}"/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
+
+tarball="${TOPDIR}/SOURCES/enroll-${ver}.tar.gz"
+tar -czf "${tarball}" --transform "s#^#enroll/#" .
+
+spec_src="rpm/enroll.spec"
+
+cp -v "${spec_src}" "${TOPDIR}/SPECS/enroll.spec"
+
+rpmbuild -ba "${TOPDIR}/SPECS/enroll.spec" \
+  --define "_topdir ${TOPDIR}" \
+  --define "upstream_version ${ver}"
+
+shopt -s nullglob
+cp -v "${TOPDIR}"/RPMS/*/*.rpm "${OUT}/" || true
+cp -v "${TOPDIR}"/SRPMS/*.src.rpm "${OUT}/" || true
+echo "Artifacts copied to ${OUT}"
+EOF
+
+RUN chmod +x /usr/local/bin/build-rpm
+
+WORKDIR /work
+ENTRYPOINT ["/usr/local/bin/build-rpm"]

README.md

@@ -4,16 +4,16 @@
   <img src="https://git.mig5.net/mig5/enroll/raw/branch/main/enroll.svg" alt="Enroll logo" width="240" />
 </div>
 
-**enroll** inspects a Linux machine (currently Debian-only) and generates Ansible roles/playbooks (and optionally inventory) for what it finds.
+**enroll** inspects a Linux machine (Debian-like or RedHat-like) and generates Ansible roles/playbooks (and optionally inventory) for what it finds.
 
-It aims to be **optimistic and noninteractive**:
 - Detects packages that have been installed.
-- Detects Debian package ownership of `/etc` files using dpkg’s local database.
-- Captures config that has **changed from packaged defaults** (dpkg conffile hashes + package md5sums when available).
+- Detects package ownership of `/etc` files where possible
+- Captures config that has **changed from packaged defaults** where possible (e.g dpkg conffile hashes + package md5sums when available).
 - Also captures **service-relevant custom/unowned files** under `/etc/<service>/...` (e.g. drop-in config includes).
 - Defensively excludes likely secrets (path denylist + content sniff + size caps).
-- Captures non-system users and their SSH public keys.
-- Captures miscellaneous `/etc` files it can’t attribute to a package and installs them in an `etc_custom` role.
+- Captures non-system users and their SSH public keys and any .bashrc or .bash_aliases or .profile files that deviate from the skel defaults.
+- Captures miscellaneous `/etc` files it can't attribute to a package and installs them in an `etc_custom` role.
+- Captures symlinks in common applications that rely on them, e.g apache2/nginx 'sites-enabled'
 - Ditto for /usr/local/bin (for non-binary files) and /usr/local/etc
 - Avoids trying to start systemd services that were detected as inactive during harvest.
 
@@ -26,9 +26,10 @@ It aims to be **optimistic and noninteractive**:
 1) **Harvest**: collect host facts + relevant files into a harvest bundle (`state.json` + harvested artifacts)
 2) **Manifest**: turn that harvest into Ansible roles/playbooks (and optionally inventory)
 
-Additionally:
+Additionally, some other functionalities exist:
 
 - **Diff**: compare two harvests and report what changed (packages/services/users/files) since the previous snapshot.
+- **Single-shot mode**: run both harvest and manifest at once.
 
 ---
 
@@ -41,8 +42,8 @@ Use when enrolling **one server** (or generating a “golden” role set you int
 
 **Characteristics**
 - Roles are more self-contained.
-- Raw config files live in the role’s `files/`.
-- Template variables live in the role’s `defaults/main.yml`.
+- Raw config files live in the role's `files/`.
+- Template variables live in the role's `defaults/main.yml`.
 
 ### Multi-site mode (`--fqdn`)
 Use when enrolling **several existing servers** quickly, especially if they differ.
@@ -68,17 +69,47 @@ Harvest state about a host and write a harvest bundle.
 - “Manual” packages
 - Changed-from-default config (plus related custom/unowned files under service dirs)
 - Non-system users + SSH public keys
-- Misc `/etc` that can’t be attributed to a package (`etc_custom` role)
+- Misc `/etc` that can't be attributed to a package (`etc_custom` role)
+- Optional user-specified extra files/dirs via `--include-path` (emitted as an `extra_paths` role at manifest time)
 
 **Common flags**
 - Remote harvesting:
-  - `--remote-host`, `--remote-user`, `--remote-port`
-  - `--no-sudo` (if you don’t want/need sudo)
+  - `--remote-host`, `--remote-user`, `--remote-port`, `--remote-ssh-config`
+  - `--no-sudo` (if you don't want/need sudo)
 - Sensitive-data behaviour:
   - default: tries to avoid likely secrets
   - `--dangerous`: disables secret-safety checks (see “Sensitive data” below)
 - Encrypt bundles at rest:
   - `--sops <FINGERPRINT...>`: writes a single encrypted `harvest.tar.gz.sops` instead of a plaintext directory
+- Path selection (include/exclude):
+  - `--include-path <PATTERN>` (repeatable): add extra files/dirs to harvest (even from locations normally ignored, like `/home`). Still subject to secret-safety checks unless `--dangerous`.
+  - `--exclude-path <PATTERN>` (repeatable): skip files/dirs even if they would normally be harvested.
+  - Pattern syntax:
+    - plain path: matches that file; directories match the directory + everything under it
+    - glob (default): supports `*` and `**` (prefix with `glob:` to force)
+    - regex: prefix with `re:` or `regex:`
+  - Precedence: excludes win over includes.
+  * Using remote mode and auth requires secrets?
+    * sudo password:
+      * `--ask-become-pass` (or `-K`) prompts for the sudo password.
+      * If you forget, and remote sudo requires a password, Enroll will still fall back to prompting in interactive mode (slightly slower due to retry).
+    * SSH private-key passphrase:
+      * `--ask-key-passphrase` prompts for the SSH key passphrase.
+      * `--ssh-key-passphrase-env ENV_VAR` reads the SSH key passphrase from an environment variable (useful for CI/non-interactive runs).
+      * If neither is provided, and Enroll detects an encrypted key in an interactive session, it will still fall back to prompting on-demand.
+      * In non-interactive sessions, pass `--ask-key-passphrase` or `--ssh-key-passphrase-env ENV_VAR` when using encrypted private keys.
+    * Note: `--ask-key-passphrase` and `--ssh-key-passphrase-env` are mutually exclusive.
+
+Examples (encrypted SSH key)
+
+```bash
+# Interactive
+enroll harvest --remote-host myhost.example.com --remote-user myuser --ask-key-passphrase --out /tmp/enroll-harvest
+
+# Non-interactive / CI
+export ENROLL_SSH_KEY_PASSPHRASE='correct horse battery staple'
+enroll single-shot --remote-host myhost.example.com --remote-user myuser --ssh-key-passphrase-env ENROLL_SSH_KEY_PASSPHRASE --harvest /tmp/enroll-harvest --out /tmp/enroll-ansible --fqdn myhost.example.com
+```
 
 ---
 
@@ -96,6 +127,17 @@ Generate Ansible output from an existing harvest bundle.
 **Common flags**
 - `--fqdn <host>`: enables **multi-site** output style
 
+**Role tags**
+Generated playbooks tag each role so you can target just the parts you need:
+
+- Tag format: `role_<role_name>` (e.g. `role_services`, `role_users`)
+- Fallback/safe tag: `role_other`
+
+Example:
+```bash
+ansible-playbook -i "localhost," -c local /tmp/enroll-ansible/playbook.yml --tags role_services,role_users
+```
+
 ---
 
 ### `enroll single-shot`
@@ -119,6 +161,26 @@ Compare two harvest bundles and report what changed.
 **Inputs**
 - `--old <harvest>` and `--new <harvest>` (directories or `state.json` paths)
 - `--sops` when comparing SOPS-encrypted harvest bundles
+- `--exclude-path <PATTERN>` (repeatable) to ignore file/dir drift under matching paths (same pattern syntax as harvest)
+- `--ignore-package-versions` to ignore package version-only drift (upgrades/downgrades)
+- `--enforce` to apply the **old** harvest state locally (requires `ansible-playbook` on `PATH`)
+
+**Noise suppression**
+- `--exclude-path` is useful for things that change often but you still want in the harvest baseline (e.g. `/var/anacron`).
+- `--ignore-package-versions` keeps routine upgrades from alerting; package add/remove drift is still reported.
+
+**Enforcement (`--enforce`)**
+If a diff exists and `ansible-playbook` is available, Enroll will:
+1) generate a manifest from the **old** harvest into a temporary directory
+2) run `ansible-playbook -i localhost, -c local <tmp>/playbook.yml` (often with `--tags role_<...>` to limit runtime)
+3) record in the diff report that the old harvest was enforced
+
+Enforcement is intentionally “safe”:
+- reinstalls packages that were removed (`state: present`), but does **not** attempt downgrades/pinning
+- restores users, files (contents + permissions/ownership), and service enable/start state
+
+If `ansible-playbook` is not on `PATH`, Enroll returns an error and does not enforce.
+
 
 **Output formats**
 - `--format json` (default for webhooks)
@@ -134,6 +196,72 @@ Compare two harvest bundles and report what changed.
 
 ---
 
+### `enroll explain`
+Analyze a harvest and provide user-friendly explanations for what's in it and why.
+
+This may also explain why something *wasn't* included (e.g a binary file, a file that was too large, unreadable due to permissions, or looked like a log file/secret.
+
+Provide either the path to the harvest or the path to its state.json. It can also handle SOPS-encrypted harvests.
+
+Output can be provided in plaintext or json.
+
+---
+
+### `enroll validate`
+
+Validates a harvest by checking:
+
+ * state.json exists and is valid JSON
+ * state.json validates against a JSON Schema (by default the vendored one)
+ * Every `managed_file` entry has a corresponding artifact at: `artifacts/<role_name>/<src_rel>`
+ * That there are no **unreferenced files** sitting in `artifacts/` that aren't in the state.
+
+#### Schema location + overrides
+
+The master schema lives at: `enroll/schema/state.schema.json`.
+
+You can override with a local file or URL:
+
+```
+enroll validate /path/to/harvest --schema ./state.schema.json
+enroll validate /path/to/harvest --schema https://enroll.sh/schema/state.schema.json
+```
+
+Or skip schema checks (still does artifact consistency checks):
+
+```
+enroll validate /path/to/harvest --no-schema
+```
+
+#### CLI usage examples
+
+Validate a local harvest:
+
+```
+enroll validate ./harvest
+```
+
+Validate a harvest tarball or a sops bundle:
+
+```
+enroll validate ./harvest.tar.gz
+enroll validate ./harvest.sops --sops
+```
+
+JSON output + write to file:
+
+```
+enroll validate ./harvest --format json --out validate.json
+```
+
+Return exit code 1 for any warnings, not just errors (useful for CI):
+
+```
+enroll validate ./harvest --fail-on-warnings
+```
+
+---
+
 ## Sensitive data
 
 By default, `enroll` does **not** assume how you handle secrets in Ansible. It will attempt to avoid harvesting likely sensitive data (private keys, passwords, tokens, etc.). This can mean it skips some config files you may ultimately want to manage.
@@ -182,6 +310,25 @@ sudo apt update
 sudo apt install enroll
 ```
 
+## Fedora
+
+```bash
+sudo rpm --import https://mig5.net/static/mig5.asc
+
+sudo tee /etc/yum.repos.d/mig5.repo > /dev/null << 'EOF'
+[mig5]
+name=mig5 Repository
+baseurl=https://rpm.mig5.net/$releasever/rpm/$basearch
+enabled=1
+gpgcheck=1
+repo_gpgcheck=1
+gpgkey=https://mig5.net/static/mig5.asc
+EOF
+
+sudo dnf upgrade --refresh
+sudo dnf install enroll
+```
+
 ## AppImage
 Download it from my Releases page, then:
 
@@ -205,7 +352,7 @@ poetry run enroll --help
 
 ## Found a bug / have a suggestion?
 
-My Forgejo doesn’t currently support federation, so I haven’t opened registration/login for issues.
+My Forgejo doesn't currently support federation, so I haven't opened registration/login for issues.
 
 Instead, email me (see `pyproject.toml`) or contact me on the Fediverse:
 
@@ -227,6 +374,31 @@ enroll harvest --out /tmp/enroll-harvest
 enroll harvest --remote-host myhost.example.com --remote-user myuser --out /tmp/enroll-harvest
 ```
 
+### Remote harvest over SSH, where the SSH configuration is in ~/.ssh/config (e.g a different SSH key)
+
+Note: you must still pass `--remote-host`, but in this case, its value can be the 'Host' alias of an entry in your `~/.ssh/config`.
+
+```bash
+enroll harvest --remote-host myhostalias --remote-ssh-config ~/.ssh/config --out /tmp/enroll-harvest
+```
+
+### Include paths (`--include-path`)
+```bash
+# Add a few dotfiles from /home (still secret-safe unless --dangerous)
+enroll harvest --out /tmp/enroll-harvest --include-path '/home/*/.bashrc' --include-path '/home/*/.profile'
+```
+
+### Exclude paths (`--exclude-path`)
+```bash
+# Skip specific /usr/local/bin entries (or patterns)
+enroll harvest --out /tmp/enroll-harvest --exclude-path '/usr/local/bin/docker-*' --exclude-path '/usr/local/bin/some-tool'
+```
+
+### Regex include
+```bash
+enroll harvest --out /tmp/enroll-harvest --include-path 're:^/home/[^/]+/\.config/myapp/.*$'
+```
+
 ### `--dangerous`
 ```bash
 enroll harvest --out /tmp/enroll-harvest --dangerous
@@ -285,7 +457,7 @@ enroll single-shot --remote-host myhost.example.com --remote-user myuser   --har
 
 ## Diff
 
-### Compare two harvest directories
+### Compare two harvest directories, output in json
 ```bash
 enroll diff --old /path/to/harvestA --new /path/to/harvestB --format json
 ```
@@ -297,6 +469,82 @@ enroll diff   --old /path/to/golden/harvest   --new /path/to/new/harvest   --web
 
 `diff` mode also supports email sending and text or markdown format, as well as `--exit-code` mode to trigger a return code of 2 (useful for crons or CI)
 
+### Ignore a specific directory or file from the diff
+```bash
+enroll diff --old /path/to/harvestA --new /path/to/harvestB --exclude-path /var/anacron
+```
+
+### Ignore package version drift (routine upgrades) but still alert on add/remove
+```bash
+enroll diff --old /path/to/harvestA --new /path/to/harvestB --ignore-package-versions
+```
+
+### Enforce the old harvest state when drift is detected (requires Ansible)
+```bash
+enroll diff --old /path/to/harvestA --new /path/to/harvestB --enforce --ignore-package-versions --exclude-path /var/anacron
+```
+
+---
+
+## Explain
+
+### Explain a harvest
+
+All of these do the same thing:
+
+```bash
+enroll explain /path/to/state.json
+enroll explain /path/to/bundle_dir
+enroll explain /path/to/harvest.tar.gz
+```
+
+### Explain a SOPS-encrypted harvest
+
+```bash
+enroll explain /path/to/harvest.tar.gz.sops --sops
+```
+
+### Explain with JSON output and more examples
+
+```bash
+enroll explain /path/to/state.json --format json --max-examples 25
+```
+
+### Example output
+
+```
+❯ enroll explain /tmp/syrah.harvest
+Enroll explain: /tmp/syrah.harvest
+Host: syrah.mig5.net (os: debian, pkg: dpkg)
+Enroll: 0.2.3
+
+Inventory
+- Packages: 254
+- Why packages were included (observed_via):
+  - user_installed: 248 – Package appears explicitly installed (as opposed to only pulled in as a dependency).
+  - package_role: 232 – Package was referenced by an enroll packages snapshot/role. (e.g. acl, acpid, adduser)
+  - systemd_unit: 22 – Package is associated with a systemd unit that was harvested. (e.g. postfix.service, tor.service, apparmor.service)
+
+Roles collected
+- users: 1 user(s), 1 file(s), 0 excluded
+- services: 19 unit(s), 111 file(s), 6 excluded
+- packages: 232 package snapshot(s), 41 file(s), 0 excluded
+- apt_config: 26 file(s), 7 dir(s), 10 excluded
+- dnf_config: 0 file(s), 0 dir(s), 0 excluded
+- etc_custom: 70 file(s), 20 dir(s), 0 excluded
+- usr_local_custom: 35 file(s), 1 dir(s), 0 excluded
+- extra_paths: 0 file(s), 0 dir(s), 0 excluded
+
+Why files were included (managed_files.reason)
+- custom_unowned (179): A file not owned by any package (often custom/operator-managed).. Examples: /etc/apparmor.d/local/lsb_release, /etc/apparmor.d/local/nvidia_modprobe, /etc/apparmor.d/local/sbin.dhclient
+- usr_local_bin_script (35): Executable scripts under /usr/local/bin (often operator-installed).. Examples: /usr/local/bin/check_firewall, /usr/local/bin/awslogs
+- apt_keyring (13): Repository signing key material used by APT.. Examples: /etc/apt/keyrings/openvpn-repo-public.asc, /etc/apt/trusted.gpg, /etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg
+- modified_conffile (10): A package-managed conffile differs from the packaged/default version.. Examples: /etc/dnsmasq.conf, /etc/ssh/moduli, /etc/tor/torrc
+- logrotate_snippet (9): logrotate snippets/configs referenced in system configuration.. Examples: /etc/logrotate.d/rsyslog, /etc/logrotate.d/tor, /etc/logrotate.d/apt
+- apt_config (7): APT configuration affecting package installation and repository behavior.. Examples: /etc/apt/apt.conf.d/01autoremove, /etc/apt/apt.conf.d/20listchanges, /etc/apt/apt.conf.d/70debconf
+[...]
+```
+
 ---
 
 ## Run Ansible
@@ -310,3 +558,71 @@ ansible-playbook -i "localhost," -c local /tmp/enroll-ansible/playbook.yml
 ```bash
 ansible-playbook /tmp/enroll-ansible/playbooks/"$(hostname -f)".yml
 ```
+
+### Run only specific roles (tags)
+Generated playbooks tag each role as `role_<name>` (e.g. `role_users`, `role_services`), so you can speed up targeted runs:
+```bash
+ansible-playbook -i "localhost," -c local /tmp/enroll-ansible/playbook.yml --tags role_users
+```
+
+## Configuration file
+
+As can be seen above, there are a lot of powerful 'permutations' available to all four subcommands.
+
+Sometimes, it can be easier to store them in a config file so you don't have to remember them!
+
+Enroll supports reading an ini-style file of all the arguments for each subcommand.
+
+### Location of the config file
+
+The path the config file can be specified with `-c` or `--config` on the command-line. Otherwise,
+Enroll will look for `./enroll.ini`, `./.enroll.ini` (in the current working directory),
+`~/.config/enroll/enroll.ini` (or `$XDG_CONFIG_HOME/enroll/enroll.ini`).
+
+You may also pass `--no-config` if you deliberately want to ignore the config file even if it existed.
+
+### Precedence
+
+Highest wins:
+
+ * Explicit CLI flags
+ * INI config ([cmd], [enroll])
+ * argparse defaults
+
+### Example config file
+
+Here is an example.
+
+Whenever an argument on the command-line has a 'hyphen' in it, just be sure to change it to an underscore in the ini file.
+
+```ini
+[enroll]
+# (future global flags may live here)
+
+[harvest]
+dangerous = false
+include_path =
+  /home/*/.bashrc
+  /home/*/.profile
+exclude_path = /usr/local/bin/docker-*, /usr/local/bin/some-tool
+# remote_host = yourserver.example.com
+# remote_user = you
+# remote_port = 2222
+
+[manifest]
+# you can set defaults here too, e.g.
+no_jinjaturtle = true
+sops = 54A91143AE0AB4F7743B01FE888ED1B423A3BC99
+
+[diff]
+# ignore noisy drift
+exclude_path = /var/anacron
+ignore_package_versions = true
+# enforce = true  # requires ansible-playbook on PATH
+
+[single-shot]
+# if you use single-shot, put its defaults here.
+# It does not inherit those of the subsections above, so you
+# may wish to repeat them here.
+include_path = re:^/home/[^/]+/\.config/myapp/.*$
+```

debian/changelog

@@ -1,3 +1,118 @@
+enroll (0.5.0) unstable; urgency=medium
+
+ * Add ssh config support where JinjaTurtle is used
+
+ -- Miguel Jacq <mig@mig5.net>  Tue, 12 May 2026 12:00 +1000
+
+enroll (0.4.4) unstable; urgency=medium
+
+ * Add capability to handle passphrases on encrypted SSH private keys. Prompting can be forced with `--ask-key-passphrase` or automated (e.g for CI) with `--ssh-key-passphrase env SOMEVAR`
+
+ -- Miguel Jacq <mig@mig5.net>  Tue, 17 Feb 2026 11:00 +1100
+
+enroll (0.4.3) unstable; urgency=medium
+
+ *  Add support for AddressFamily and ConnectTimeout in the .ssh/config when using `--remote-ssh-config`.
+
+ -- Miguel Jacq <mig@mig5.net>  Fri, 16 Jan 2026 11:00 +1100
+
+enroll (0.4.2) unstable; urgency=medium
+
+ * Support `--remote-ssh-config [path-to-ssh-config]` as an argument in case extra params are required beyond `--remote-port` or `--remote-user`. Note: `--remote-host` must still be set, but it can be an 'alias' represented by the 'Host' value in the ssh config.
+
+ -- Miguel Jacq <mig@mig5.net>  Tue, 13 Jan 2026 21:55:00 +1100
+
+enroll (0.4.1) unstable; urgency=medium
+ * Add interactive output when 'enroll diff --enforce' is invoking Ansible.
+
+ -- Miguel Jacq <mig@mig5.net>  Sun, 11 Jan 2026 10:00:00 +1100
+
+enroll (0.4.0) unstable; urgency=medium
+ * Introduce `enroll validate` - a tool to validate a harvest against the state schema, or check for missing or orphaned obsolete artifacts in a harvest.
+ * Attempt to generate Jinja2 templates of systemd unit files and Postfix main.cf (now that JinjaTurtle supports it)
+ * Update pynacl dependency to resolve CVE-2025-69277
+ * Add `--exclude-path` to `enroll diff` command, so that you can ignore certain churn from the diff (stuff you still wanted to harvest as a baseline but don't care if it changes day to day)
+ * Add `--ignore-package-versions` to `enroll diff` command, to optionally ignore package upgrades (e.g due to patching) from the diff.
+ * Add tags to the playbook for each role, to allow easier targeting of specific roles during play later.
+ * Add `--enforce` mode to `enroll diff`. If there is diff detected between the two harvests, and it can enforce restoring the state from the older harvest, it will manifest the state and apply it with ansible.
+Only the specific roles that had diffed will be applied (via the new tags capability)
+
+ -- Miguel Jacq <mig@mig5.net>  Sat, 10 Jan 2026 10:30:00 +1100
+
+enroll (0.3.0) unstable; urgency=medium
+
+  * Introduce `enroll explain` - a tool to analyze and explain what's in (or not in) a harvest and why.
+  * Centralise the cron and logrotate stuff into their respective roles, we had a bit of duplication between roles based on harvest discovery.
+  * Capture other files in the user's home directory such as `.bashrc`, `.bash_aliases`, `.profile`, if these files differ from the `/etc/skel` defaults
+  * Ignore files that end with a tilde or - (probably backup files generated by editors or shadow file changes)
+  * Manage certain symlinks e.g for apache2/nginx sites-enabled and so on
+
+ -- Miguel Jacq <mig@mig5.net>  Mon, 05 Jan 2026 17:00:00 +1100
+
+enroll (0.2.3) unstable; urgency=medium
+
+  * Introduce --ask-become-pass or -K to support password-required sudo on remote hosts, just like Ansible. It will also fall back to this prompt if a password is required but the arg wasn't passed in.
+
+ -- Miguel Jacq <mig@mig5.net>  Sun, 04 Jan 2026 20:38:00 +1100
+
+enroll (0.2.2) unstable; urgency=medium
+
+  * Fix stat() of parent directory so that we set directory perms correct on --include paths.
+  * Set pty for remote calls when sudo is required, to help systems with limits on sudo without pty
+
+ -- Miguel Jacq <mig@mig5.net>  Sat, 03 Jan 2026 09:56:00 +1100
+
+enroll (0.2.1) unstable; urgency=medium
+
+  * Don't accidentally add extra_paths role to usr_local_custom list, resulting in extra_paths appearing twice in manifested playbook
+  * Ensure directories in the tree of anything included with --include are defined in the state and manifest so we make dirs before we try to create files
+
+ -- Miguel Jacq <mig@mig5.net>  Fri, 02 Jan 2026 21:30:00 +1100
+
+enroll (0.2.0) unstable; urgency=medium
+
+  * Add version CLI arg
+  * Add ability to enroll RH-style systems (DNF5/DNF/RPM)
+  * Refactor harvest state to track package versions
+
+ -- Miguel Jacq <mig@mig5.net>  Mon, 29 Dec 2025 17:30:00 +1100
+
+enroll (0.1.7) unstable; urgency=medium
+  * Fix an attribution bug for certain files ending up in the wrong package/role.
+
+ -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 18:30:00 +1100
+
+enroll (0.1.6) unstable; urgency=medium
+
+  * DRY up some code logic
+  * More test coverage
+
+ -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 15:30:00 +1100
+
+enroll (0.1.5) unstable; urgency=medium
+
+  * Consolidate logrotate and cron files into their main service/package roles if they exist.
+  * Standardise on MAX_FILES_CAP in one place
+  * Manage apt stuff in its own role, not in etc_custom
+
+ -- Miguel Jacq <mig@mig5.net>  Sun, 28 Dec 2025 10:00:00 +1100
+
+enroll (0.1.4) unstable; urgency=medium
+
+  * Attempt to capture more stuff from /etc that might not be attributable to a specific package. This includes common singletons and systemd timers
+  * Avoid duplicate apt data in package-specific roles.
+
+ -- Miguel Jacq <mig@mig5.net>  Sat, 27 Dec 2025 19:00:00 +1100
+
+enroll (0.1.3) unstable; urgency=medium
+
+  * Allow the user to add extra paths to harvest, or paths to ignore, using `--exclude-path` and `--include-path`
+    arguments.
+  * Add support for an enroll.ini config file to store arguments per subcommand, to avoid having to remember
+    them all for repetitive executions.
+
+ -- Miguel Jacq <mig@mig5.net>  Sat, 20 Dec 2025 18:24:00 +1100
+
 enroll (0.1.2) unstable; urgency=medium
 
   * Include files from `/usr/local/bin` and `/usr/local/etc` in harvest (assuming they aren't binaries or

debian/control

@@ -10,12 +10,13 @@ Build-Depends:
  python3-all,
  python3-yaml,
  python3-poetry-core,
- python3-paramiko
+ python3-paramiko,
+ python3-jsonschema
 Standards-Version: 4.6.2
 Homepage: https://git.mig5.net/mig5/enroll
 
 Package: enroll
 Architecture: all
-Depends: ${misc:Depends}, ${python3:Depends}, python3-yaml, python3-paramiko
+Depends: ${misc:Depends}, ${python3:Depends}, python3-yaml, python3-paramiko, python3-jsonschema
 Description: Harvest a host into Ansible roles
  A tool that inspects a system and emits Ansible roles/playbooks to reproduce it.

enroll/cli.py

@@ -1,18 +1,261 @@
 from __future__ import annotations
 
 import argparse
+import configparser
+import json
 import os
+import sys
 import tarfile
 import tempfile
 from pathlib import Path
 from typing import Optional
 
 from .cache import new_harvest_cache_dir
-from .diff import compare_harvests, format_report, post_webhook, send_email
+from .diff import (
+    compare_harvests,
+    enforce_old_harvest,
+    format_report,
+    has_enforceable_drift,
+    post_webhook,
+    send_email,
+)
+from .explain import explain_state
 from .harvest import harvest
 from .manifest import manifest
-from .remote import remote_harvest
+from .remote import (
+    remote_harvest,
+    RemoteSudoPasswordRequired,
+    RemoteSSHKeyPassphraseRequired,
+)
 from .sopsutil import SopsError, encrypt_file_binary
+from .validate import validate_harvest
+from .version import get_enroll_version
+
+
+def _discover_config_path(argv: list[str]) -> Optional[Path]:
+    """Return the config path to use, if any.
+
+    Precedence:
+      1) --no-config disables loading.
+      2) --config PATH (or -c PATH)
+      3) $ENROLL_CONFIG
+      4) ./enroll.ini, ./.enroll.ini
+      5) $XDG_CONFIG_HOME/enroll/enroll.ini (or ~/.config/enroll/enroll.ini)
+
+    The config file is optional; if no file is found, returns None.
+    """
+
+    # Quick scan for explicit flags without needing to build the full parser.
+    if "--no-config" in argv:
+        return None
+
+    def _value_after(flag: str) -> Optional[str]:
+        try:
+            i = argv.index(flag)
+        except ValueError:
+            return None
+        if i + 1 >= len(argv):
+            return None
+        return argv[i + 1]
+
+    p = _value_after("--config") or _value_after("-c")
+    if p:
+        return Path(p).expanduser()
+
+    envp = os.environ.get("ENROLL_CONFIG")
+    if envp:
+        return Path(envp).expanduser()
+
+    cwd = Path.cwd()
+    for name in ("enroll.ini", ".enroll.ini"):
+        cp = cwd / name
+        if cp.exists() and cp.is_file():
+            return cp
+
+    xdg = os.environ.get("XDG_CONFIG_HOME")
+    if xdg:
+        base = Path(xdg).expanduser()
+    else:
+        base = Path.home() / ".config"
+    cp = base / "enroll" / "enroll.ini"
+    if cp.exists() and cp.is_file():
+        return cp
+
+    return None
+
+
+def _parse_bool(s: str) -> Optional[bool]:
+    v = str(s).strip().lower()
+    if v in {"1", "true", "yes", "y", "on"}:
+        return True
+    if v in {"0", "false", "no", "n", "off"}:
+        return False
+    return None
+
+
+def _action_lookup(p: argparse.ArgumentParser) -> dict[str, argparse.Action]:
+    """Map config keys -> argparse actions for a parser.
+
+    Accepts both dest names and long option names without leading dashes,
+    normalized with '-' -> '_'.
+    """
+
+    m: dict[str, argparse.Action] = {}
+    for a in p._actions:  # noqa: SLF001 (argparse internal)
+        if not getattr(a, "dest", None):
+            continue
+        dest = str(a.dest).strip().lower()
+        if dest:
+            m[dest] = a
+        for opt in getattr(a, "option_strings", []) or []:
+            k = opt.lstrip("-").strip().lower()
+            if k:
+                m[k.replace("-", "_")] = a
+                m[k] = a
+    return m
+
+
+def _choose_flag(a: argparse.Action) -> Optional[str]:
+    # Prefer a long flag if available (e.g. --dangerous over -d)
+    for s in getattr(a, "option_strings", []) or []:
+        if s.startswith("--"):
+            return s
+    for s in getattr(a, "option_strings", []) or []:
+        return s
+    return None
+
+
+def _split_list_value(v: str) -> list[str]:
+    # Support comma-separated and/or multi-line lists.
+    raw = str(v)
+    if "\n" in raw:
+        parts = [p.strip() for p in raw.splitlines()]
+        return [p for p in parts if p]
+    if "," in raw:
+        parts = [p.strip() for p in raw.split(",")]
+        return [p for p in parts if p]
+    raw = raw.strip()
+    return [raw] if raw else []
+
+
+def _section_to_argv(
+    p: argparse.ArgumentParser, cfg: configparser.ConfigParser, section: str
+) -> list[str]:
+    """Translate an INI section into argv tokens for this parser."""
+    if not cfg.has_section(section):
+        return []
+
+    lookup = _action_lookup(p)
+    out: list[str] = []
+
+    for k, v in cfg.items(section):
+        key = str(k).strip().lower().replace("-", "_")
+        # Avoid recursion / confusing self-configuration.
+        if key in {"config", "no_config"}:
+            continue
+
+        a = lookup.get(key)
+        if not a:
+            # Unknown keys are ignored (but we try to be helpful).
+            print(
+                f"warning: config [{section}] contains unknown option '{k}' (ignored)",
+                file=sys.stderr,
+            )
+            continue
+
+        flag = _choose_flag(a)
+        if not flag:
+            continue
+
+        # Boolean flags
+        if isinstance(a, argparse._StoreTrueAction):  # noqa: SLF001
+            b = _parse_bool(v)
+            if b is True:
+                out.append(flag)
+            continue
+        if isinstance(a, argparse._StoreFalseAction):  # noqa: SLF001
+            b = _parse_bool(v)
+            if b is False:
+                out.append(flag)
+            continue
+
+        # Repeated options
+        if isinstance(a, argparse._AppendAction):  # noqa: SLF001
+            for item in _split_list_value(v):
+                out.extend([flag, item])
+            continue
+
+        # Count flags (rare, but easy to support)
+        if isinstance(a, argparse._CountAction):  # noqa: SLF001
+            b = _parse_bool(v)
+            if b is True:
+                out.append(flag)
+            else:
+                try:
+                    n = int(str(v).strip())
+                except ValueError:
+                    n = 0
+                out.extend([flag] * max(0, n))
+            continue
+
+        # Standard scalar options
+        sval = str(v).strip()
+        if sval:
+            out.extend([flag, sval])
+
+    return out
+
+
+def _inject_config_argv(
+    argv: list[str],
+    *,
+    cfg_path: Optional[Path],
+    root_parser: argparse.ArgumentParser,
+    subparsers: dict[str, argparse.ArgumentParser],
+) -> list[str]:
+    """Return argv with config-derived tokens inserted.
+
+    We insert:
+      - [enroll] options before the subcommand
+      - [<subcommand>] options immediately after the subcommand token
+
+    CLI flags always win because they come later in argv.
+    """
+
+    if not cfg_path:
+        return argv
+    cfg_path = Path(cfg_path).expanduser()
+    if not (cfg_path.exists() and cfg_path.is_file()):
+        return argv
+
+    cfg = configparser.ConfigParser()
+    try:
+        cfg.read(cfg_path, encoding="utf-8")
+    except (OSError, configparser.Error) as e:
+        raise SystemExit(f"error: failed to read config file {cfg_path}: {e}")
+
+    global_tokens = _section_to_argv(root_parser, cfg, "enroll")
+
+    # Find the subcommand token position.
+    cmd_pos: Optional[int] = None
+    cmd_name: Optional[str] = None
+    for i, tok in enumerate(argv):
+        if tok in subparsers:
+            cmd_pos = i
+            cmd_name = tok
+            break
+    if cmd_pos is None or cmd_name is None:
+        # No subcommand found (argparse will handle the error); only apply global.
+        return global_tokens + argv
+
+    cmd_tokens = _section_to_argv(subparsers[cmd_name], cfg, cmd_name)
+    # Also accept section names with '_' in place of '-' (e.g. [single_shot])
+    if "-" in cmd_name:
+        alt = cmd_name.replace("-", "_")
+        if alt != cmd_name:
+            cmd_tokens += _section_to_argv(subparsers[cmd_name], cfg, alt)
+
+    return global_tokens + argv[: cmd_pos + 1] + cmd_tokens + argv[cmd_pos + 1 :]
 
 
 def _resolve_sops_out_file(out: Optional[str], *, hint: str) -> Path:
@@ -90,29 +333,100 @@ def _jt_mode(args: argparse.Namespace) -> str:
     return "auto"
 
 
+def _add_config_args(p: argparse.ArgumentParser) -> None:
+    p.add_argument(
+        "-c",
+        "--config",
+        help=(
+            "Path to an INI config file for default options. If omitted, enroll will look for "
+            "./enroll.ini, ./.enroll.ini, or ~/.config/enroll/enroll.ini (or $XDG_CONFIG_HOME/enroll/enroll.ini)."
+        ),
+    )
+    p.add_argument(
+        "--no-config",
+        action="store_true",
+        help="Do not load any INI config file (even if one would be auto-discovered).",
+    )
+
+
 def _add_remote_args(p: argparse.ArgumentParser) -> None:
     p.add_argument(
         "--remote-host",
         help="SSH host to run harvesting on (if set, harvest runs remotely and is pulled locally).",
     )
+    p.add_argument(
+        "--remote-ssh-config",
+        nargs="?",
+        const=str(Path.home() / ".ssh" / "config"),
+        default=None,
+        help=(
+            "Use OpenSSH-style ssh_config settings for --remote-host. "
+            "If provided without a value, defaults to ~/.ssh/config. "
+            "(Applies HostName/User/Port/IdentityFile/ProxyCommand/HostKeyAlias when supported.)"
+        ),
+    )
     p.add_argument(
         "--remote-port",
         type=int,
-        default=22,
-        help="SSH port for --remote-host (default: 22).",
+        default=None,
+        help=(
+            "SSH port for --remote-host. If omitted, defaults to 22, or a value from ssh_config when "
+            "--remote-ssh-config is set."
+        ),
     )
     p.add_argument(
         "--remote-user",
-        default=os.environ.get("USER") or None,
-        help="SSH username for --remote-host (default: local $USER).",
+        default=None,
+        help=(
+            "SSH username for --remote-host. If omitted, defaults to local $USER, or a value from ssh_config when "
+            "--remote-ssh-config is set."
+        ),
+    )
+
+    # Align terminology with Ansible: "become" == sudo.
+    p.add_argument(
+        "--ask-become-pass",
+        "-K",
+        action="store_true",
+        help=(
+            "Prompt for the remote sudo (become) password when using --remote-host "
+            "(similar to ansible --ask-become-pass)."
+        ),
+    )
+
+    keyp = p.add_mutually_exclusive_group()
+    keyp.add_argument(
+        "--ask-key-passphrase",
+        action="store_true",
+        help=(
+            "Prompt for the SSH private key passphrase when using --remote-host. "
+            "If not set, enroll will still prompt on-demand if it detects an encrypted key in an interactive session."
+        ),
+    )
+    keyp.add_argument(
+        "--ssh-key-passphrase-env",
+        metavar="ENV_VAR",
+        help=(
+            "Read the SSH private key passphrase from environment variable ENV_VAR "
+            "(useful for non-interactive runs/CI)."
+        ),
     )
 
 
 def main() -> None:
     ap = argparse.ArgumentParser(prog="enroll")
+    ap.add_argument(
+        "-v",
+        "--version",
+        action="version",
+        version=f"{get_enroll_version()}",
+    )
+    _add_config_args(ap)
     sub = ap.add_subparsers(dest="cmd", required=True)
 
     h = sub.add_parser("harvest", help="Harvest service/package/config state")
+    _add_config_args(h)
+    _add_remote_args(h)
     h.add_argument(
         "--out",
         help=(
@@ -125,6 +439,27 @@ def main() -> None:
         action="store_true",
         help="Collect files more aggressively (may include secrets). Disables secret-avoidance checks.",
     )
+    h.add_argument(
+        "--include-path",
+        action="append",
+        default=[],
+        metavar="PATTERN",
+        help=(
+            "Include extra file paths to harvest (repeatable). Supports globs (including '**') and regex via 're:<regex>'. "
+            "Included files are still filtered by IgnorePolicy unless --dangerous is used."
+        ),
+    )
+    h.add_argument(
+        "--exclude-path",
+        action="append",
+        default=[],
+        metavar="PATTERN",
+        help=(
+            "Exclude file paths from harvesting (repeatable). Supports globs (including '**') and regex via 're:<regex>'. "
+            "Excludes apply to all harvesting, including defaults."
+        ),
+    )
+
     h.add_argument(
         "--sops",
         nargs="+",
@@ -139,9 +474,9 @@ def main() -> None:
         action="store_true",
         help="Don't use sudo on the remote host (when using --remote options). This may result in a limited harvest due to permission restrictions.",
     )
-    _add_remote_args(h)
 
     m = sub.add_parser("manifest", help="Render Ansible roles from a harvest")
+    _add_config_args(m)
     m.add_argument(
         "--harvest",
         required=True,
@@ -174,6 +509,8 @@ def main() -> None:
     s = sub.add_parser(
         "single-shot", help="Harvest state, then manifest Ansible code, in one shot"
     )
+    _add_config_args(s)
+    _add_remote_args(s)
     s.add_argument(
         "--harvest",
         help=(
@@ -186,13 +523,34 @@ def main() -> None:
         action="store_true",
         help="Collect files more aggressively (may include secrets). Disables secret-avoidance checks.",
     )
+    s.add_argument(
+        "--include-path",
+        action="append",
+        default=[],
+        metavar="PATTERN",
+        help=(
+            "Include extra file paths to harvest (repeatable). Supports globs (including '**') and regex via 're:<regex>'. "
+            "Included files are still filtered by IgnorePolicy unless --dangerous is used."
+        ),
+    )
+    s.add_argument(
+        "--exclude-path",
+        action="append",
+        default=[],
+        metavar="PATTERN",
+        help=(
+            "Exclude file paths from harvesting (repeatable). Supports globs (including '**') and regex via 're:<regex>'. "
+            "Excludes apply to all harvesting, including defaults."
+        ),
+    )
+
     s.add_argument(
         "--sops",
         nargs="+",
         metavar="GPG_FINGERPRINT",
         help=(
             "Encrypt the harvest as a SOPS-encrypted tarball, and bundle+encrypt the manifest output in --out "
-            "(same behavior as `harvest --sops` and `manifest --sops`)."
+            "(same behaviour as `harvest --sops` and `manifest --sops`)."
         ),
     )
     s.add_argument(
@@ -210,9 +568,9 @@ def main() -> None:
         ),
     )
     _add_common_manifest_args(s)
-    _add_remote_args(s)
 
     d = sub.add_parser("diff", help="Compare two harvests and report differences")
+    _add_config_args(d)
     d.add_argument(
         "--old",
         required=True,
@@ -238,6 +596,33 @@ def main() -> None:
         default="text",
         help="Report output format (default: text).",
     )
+    d.add_argument(
+        "--exclude-path",
+        action="append",
+        default=[],
+        metavar="PATTERN",
+        help=(
+            "Exclude file paths from the diff report (repeatable). Supports globs (including '**') and regex via 're:<regex>'. "
+            "This affects file drift reporting only (added/removed/changed files), not package/service/user diffs."
+        ),
+    )
+    d.add_argument(
+        "--ignore-package-versions",
+        action="store_true",
+        help=(
+            "Ignore package version changes in the diff report and exit status. "
+            "Package additions/removals are still reported. Useful when routine upgrades would otherwise create noisy drift."
+        ),
+    )
+    d.add_argument(
+        "--enforce",
+        action="store_true",
+        help=(
+            "If differences are detected, attempt to enforce the old harvest state locally by generating a manifest and "
+            "running ansible-playbook. Requires ansible-playbook on PATH. "
+            "Enroll does not attempt to downgrade packages; if the only drift is package version upgrades (or newly installed packages), enforcement is skipped."
+        ),
+    )
     d.add_argument(
         "--out",
         help="Write the report to this file instead of stdout.",
@@ -296,16 +681,109 @@ def main() -> None:
         help="Environment variable containing SMTP password (optional).",
     )
 
-    args = ap.parse_args()
+    e = sub.add_parser("explain", help="Explain a harvest state.json")
+    _add_config_args(e)
+    e.add_argument(
+        "harvest",
+        help=(
+            "Harvest input (directory, a path to state.json, a tarball, or a SOPS-encrypted bundle)."
+        ),
+    )
+    e.add_argument(
+        "--sops",
+        action="store_true",
+        help="Treat the input as a SOPS-encrypted bundle (auto-detected if the filename ends with .sops).",
+    )
+    e.add_argument(
+        "--format",
+        choices=["text", "json"],
+        default="text",
+        help="Output format.",
+    )
+    e.add_argument(
+        "--max-examples",
+        type=int,
+        default=3,
+        help="How many example paths/refs to show per reason.",
+    )
 
-    remote_host: Optional[str] = getattr(args, "remote_host", None)
+    v = sub.add_parser(
+        "validate", help="Validate a harvest bundle (state.json + artifacts)"
+    )
+    _add_config_args(v)
+    v.add_argument(
+        "harvest",
+        help=(
+            "Harvest input (directory, a path to state.json, a tarball, or a SOPS-encrypted bundle)."
+        ),
+    )
+    v.add_argument(
+        "--sops",
+        action="store_true",
+        help="Treat the input as a SOPS-encrypted bundle (auto-detected if the filename ends with .sops).",
+    )
+    v.add_argument(
+        "--schema",
+        help=(
+            "Optional JSON schema source (file path or https:// URL). "
+            "If omitted, uses the schema vendored in the enroll codebase."
+        ),
+    )
+    v.add_argument(
+        "--no-schema",
+        action="store_true",
+        help="Skip JSON schema validation and only perform bundle consistency checks.",
+    )
+    v.add_argument(
+        "--fail-on-warnings",
+        action="store_true",
+        help="Exit non-zero if validation produces warnings.",
+    )
+    v.add_argument(
+        "--format",
+        choices=["text", "json"],
+        default="text",
+        help="Output format.",
+    )
+    v.add_argument(
+        "--out",
+        help="Write the report to this file instead of stdout.",
+    )
+
+    argv = sys.argv[1:]
+    cfg_path = _discover_config_path(argv)
+    argv = _inject_config_argv(
+        argv,
+        cfg_path=cfg_path,
+        root_parser=ap,
+        subparsers={
+            "harvest": h,
+            "manifest": m,
+            "single-shot": s,
+            "diff": d,
+            "explain": e,
+            "validate": v,
+        },
+    )
+    args = ap.parse_args(argv)
+
+    # Preserve historical defaults for remote harvesting unless ssh_config lookup is enabled.
+    # This lets ssh_config values take effect when the user did not explicitly set
+    # --remote-user / --remote-port.
+    if hasattr(args, "remote_host"):
+        rsc = getattr(args, "remote_ssh_config", None)
+        if not rsc:
+            if getattr(args, "remote_port", None) is None:
+                setattr(args, "remote_port", 22)
+            if getattr(args, "remote_user", None) is None:
+                setattr(args, "remote_user", os.environ.get("USER") or None)
 
     try:
         if args.cmd == "harvest":
             sops_fps = getattr(args, "sops", None)
-            if remote_host:
+            if args.remote_host:
                 if sops_fps:
-                    out_file = _resolve_sops_out_file(args.out, hint=remote_host)
+                    out_file = _resolve_sops_out_file(args.out, hint=args.remote_host)
                     with tempfile.TemporaryDirectory(prefix="enroll-harvest-") as td:
                         tmp_bundle = Path(td) / "bundle"
                         tmp_bundle.mkdir(parents=True, exist_ok=True)
@@ -314,12 +792,20 @@ def main() -> None:
                         except OSError:
                             pass
                         remote_harvest(
+                            ask_become_pass=args.ask_become_pass,
+                            ask_key_passphrase=bool(args.ask_key_passphrase),
+                            ssh_key_passphrase_env=getattr(
+                                args, "ssh_key_passphrase_env", None
+                            ),
                             local_out_dir=tmp_bundle,
-                            remote_host=remote_host,
-                            remote_port=int(args.remote_port),
+                            remote_host=args.remote_host,
+                            remote_port=args.remote_port,
                             remote_user=args.remote_user,
+                            remote_ssh_config=args.remote_ssh_config,
                             dangerous=bool(args.dangerous),
                             no_sudo=bool(args.no_sudo),
+                            include_paths=list(getattr(args, "include_path", []) or []),
+                            exclude_paths=list(getattr(args, "exclude_path", []) or []),
                         )
                         _encrypt_harvest_dir_to_sops(
                             tmp_bundle, out_file, list(sops_fps)
@@ -329,15 +815,23 @@ def main() -> None:
                     out_dir = (
                         Path(args.out)
                         if args.out
-                        else new_harvest_cache_dir(hint=remote_host).dir
+                        else new_harvest_cache_dir(hint=args.remote_host).dir
                     )
                     state = remote_harvest(
+                        ask_become_pass=args.ask_become_pass,
+                        ask_key_passphrase=bool(args.ask_key_passphrase),
+                        ssh_key_passphrase_env=getattr(
+                            args, "ssh_key_passphrase_env", None
+                        ),
                         local_out_dir=out_dir,
-                        remote_host=remote_host,
-                        remote_port=int(args.remote_port),
+                        remote_host=args.remote_host,
+                        remote_port=args.remote_port,
                         remote_user=args.remote_user,
+                        remote_ssh_config=args.remote_ssh_config,
                         dangerous=bool(args.dangerous),
                         no_sudo=bool(args.no_sudo),
+                        include_paths=list(getattr(args, "include_path", []) or []),
+                        exclude_paths=list(getattr(args, "exclude_path", []) or []),
                     )
                     print(str(state))
             else:
@@ -350,18 +844,68 @@ def main() -> None:
                             os.chmod(tmp_bundle, 0o700)
                         except OSError:
                             pass
-                        harvest(str(tmp_bundle), dangerous=bool(args.dangerous))
+                        harvest(
+                            str(tmp_bundle),
+                            dangerous=bool(args.dangerous),
+                            include_paths=list(getattr(args, "include_path", []) or []),
+                            exclude_paths=list(getattr(args, "exclude_path", []) or []),
+                        )
                         _encrypt_harvest_dir_to_sops(
                             tmp_bundle, out_file, list(sops_fps)
                         )
                     print(str(out_file))
                 else:
-                    if not args.out:
-                        raise SystemExit(
-                            "error: --out is required unless --remote-host is set"
+                    if args.out:
+                        out_dir = args.out
+                    else:
+                        out_dir = (
+                            Path(args.out)
+                            if args.out
+                            else new_harvest_cache_dir(hint=args.remote_host).dir
                         )
-                    path = harvest(args.out, dangerous=bool(args.dangerous))
+                    path = harvest(
+                        out_dir,
+                        dangerous=bool(args.dangerous),
+                        include_paths=list(getattr(args, "include_path", []) or []),
+                        exclude_paths=list(getattr(args, "exclude_path", []) or []),
+                    )
                     print(path)
+        elif args.cmd == "explain":
+            out = explain_state(
+                args.harvest,
+                sops_mode=bool(getattr(args, "sops", False)),
+                fmt=str(getattr(args, "format", "text")),
+                max_examples=int(getattr(args, "max_examples", 3)),
+            )
+            sys.stdout.write(out)
+
+        elif args.cmd == "validate":
+            res = validate_harvest(
+                args.harvest,
+                sops_mode=bool(getattr(args, "sops", False)),
+                schema=getattr(args, "schema", None),
+                no_schema=bool(getattr(args, "no_schema", False)),
+            )
+
+            fmt = str(getattr(args, "format", "text"))
+            if fmt == "json":
+                txt = json.dumps(res.to_dict(), indent=2, sort_keys=True) + "\n"
+            else:
+                txt = res.to_text()
+
+            out_path = getattr(args, "out", None)
+            if out_path:
+                p = Path(out_path).expanduser()
+                p.parent.mkdir(parents=True, exist_ok=True)
+                p.write_text(txt, encoding="utf-8")
+            else:
+                sys.stdout.write(txt)
+
+            if res.errors:
+                raise SystemExit(1)
+            if res.warnings and bool(getattr(args, "fail_on_warnings", False)):
+                raise SystemExit(1)
+
         elif args.cmd == "manifest":
             out_enc = manifest(
                 args.harvest,
@@ -377,8 +921,47 @@ def main() -> None:
                 args.old,
                 args.new,
                 sops_mode=bool(getattr(args, "sops", False)),
+                exclude_paths=list(getattr(args, "exclude_path", []) or []),
+                ignore_package_versions=bool(
+                    getattr(args, "ignore_package_versions", False)
+                ),
             )
 
+            # Optional enforcement: if drift is detected, attempt to restore the
+            # system to the *old* (baseline) state using ansible-playbook.
+            if bool(getattr(args, "enforce", False)):
+                if has_changes:
+                    if not has_enforceable_drift(report):
+                        report["enforcement"] = {
+                            "requested": True,
+                            "status": "skipped",
+                            "reason": (
+                                "no enforceable drift detected (only additions and/or package version changes); "
+                                "enroll does not attempt to downgrade packages"
+                            ),
+                        }
+                    else:
+                        try:
+                            info = enforce_old_harvest(
+                                args.old,
+                                sops_mode=bool(getattr(args, "sops", False)),
+                                report=report,
+                            )
+                        except Exception as e:
+                            raise SystemExit(
+                                f"error: could not enforce old harvest state: {e}"
+                            ) from e
+                        report["enforcement"] = {
+                            "requested": True,
+                            **(info or {}),
+                        }
+                else:
+                    report["enforcement"] = {
+                        "requested": True,
+                        "status": "skipped",
+                        "reason": "no differences detected",
+                    }
+
             txt = format_report(report, fmt=str(getattr(args, "format", "text")))
             out_path = getattr(args, "out", None)
             if out_path:
@@ -429,9 +1012,11 @@ def main() -> None:
                 raise SystemExit(2)
         elif args.cmd == "single-shot":
             sops_fps = getattr(args, "sops", None)
-            if remote_host:
+            if args.remote_host:
                 if sops_fps:
-                    out_file = _resolve_sops_out_file(args.harvest, hint=remote_host)
+                    out_file = _resolve_sops_out_file(
+                        args.harvest, hint=args.remote_host
+                    )
                     with tempfile.TemporaryDirectory(prefix="enroll-harvest-") as td:
                         tmp_bundle = Path(td) / "bundle"
                         tmp_bundle.mkdir(parents=True, exist_ok=True)
@@ -440,12 +1025,20 @@ def main() -> None:
                         except OSError:
                             pass
                         remote_harvest(
+                            ask_become_pass=args.ask_become_pass,
+                            ask_key_passphrase=bool(args.ask_key_passphrase),
+                            ssh_key_passphrase_env=getattr(
+                                args, "ssh_key_passphrase_env", None
+                            ),
                             local_out_dir=tmp_bundle,
-                            remote_host=remote_host,
-                            remote_port=int(args.remote_port),
+                            remote_host=args.remote_host,
+                            remote_port=args.remote_port,
                             remote_user=args.remote_user,
+                            remote_ssh_config=args.remote_ssh_config,
                             dangerous=bool(args.dangerous),
                             no_sudo=bool(args.no_sudo),
+                            include_paths=list(getattr(args, "include_path", []) or []),
+                            exclude_paths=list(getattr(args, "exclude_path", []) or []),
                         )
                         _encrypt_harvest_dir_to_sops(
                             tmp_bundle, out_file, list(sops_fps)
@@ -464,15 +1057,23 @@ def main() -> None:
                     harvest_dir = (
                         Path(args.harvest)
                         if args.harvest
-                        else new_harvest_cache_dir(hint=remote_host).dir
+                        else new_harvest_cache_dir(hint=args.remote_host).dir
                     )
                     remote_harvest(
+                        ask_become_pass=args.ask_become_pass,
+                        ask_key_passphrase=bool(args.ask_key_passphrase),
+                        ssh_key_passphrase_env=getattr(
+                            args, "ssh_key_passphrase_env", None
+                        ),
                         local_out_dir=harvest_dir,
-                        remote_host=remote_host,
-                        remote_port=int(args.remote_port),
+                        remote_host=args.remote_host,
+                        remote_port=args.remote_port,
                         remote_user=args.remote_user,
+                        remote_ssh_config=args.remote_ssh_config,
                         dangerous=bool(args.dangerous),
                         no_sudo=bool(args.no_sudo),
+                        include_paths=list(getattr(args, "include_path", []) or []),
+                        exclude_paths=list(getattr(args, "exclude_path", []) or []),
                     )
                     manifest(
                         str(harvest_dir),
@@ -493,7 +1094,12 @@ def main() -> None:
                             os.chmod(tmp_bundle, 0o700)
                         except OSError:
                             pass
-                        harvest(str(tmp_bundle), dangerous=bool(args.dangerous))
+                        harvest(
+                            str(tmp_bundle),
+                            dangerous=bool(args.dangerous),
+                            include_paths=list(getattr(args, "include_path", []) or []),
+                            exclude_paths=list(getattr(args, "exclude_path", []) or []),
+                        )
                         _encrypt_harvest_dir_to_sops(
                             tmp_bundle, out_file, list(sops_fps)
                         )
@@ -512,62 +1118,29 @@ def main() -> None:
                         raise SystemExit(
                             "error: --harvest is required unless --remote-host is set"
                         )
-                    harvest(args.harvest, dangerous=bool(args.dangerous))
+                    harvest(
+                        args.harvest,
+                        dangerous=bool(args.dangerous),
+                        include_paths=list(getattr(args, "include_path", []) or []),
+                        exclude_paths=list(getattr(args, "exclude_path", []) or []),
+                    )
                     manifest(
                         args.harvest,
                         args.out,
                         fqdn=args.fqdn,
                         jinjaturtle=_jt_mode(args),
                     )
-        elif args.cmd == "diff":
-            report, has_changes = compare_harvests(
-                args.old, args.new, sops_mode=bool(getattr(args, "sops", False))
-            )
-
-            rendered = format_report(report, fmt=str(args.format))
-            if args.out:
-                Path(args.out).expanduser().write_text(rendered, encoding="utf-8")
-            else:
-                print(rendered, end="")
-
-            do_notify = bool(has_changes or getattr(args, "notify_always", False))
-
-            if do_notify and getattr(args, "webhook", None):
-                wf = str(getattr(args, "webhook_format", "json"))
-                body = format_report(report, fmt=wf).encode("utf-8")
-                headers = {"User-Agent": "enroll"}
-                if wf == "json":
-                    headers["Content-Type"] = "application/json"
-                else:
-                    headers["Content-Type"] = "text/plain; charset=utf-8"
-                for hv in getattr(args, "webhook_header", []) or []:
-                    if ":" not in hv:
-                        raise SystemExit(
-                            "error: --webhook-header must be in the form 'K:V'"
-                        )
-                    k, v = hv.split(":", 1)
-                    headers[k.strip()] = v.strip()
-                status, _ = post_webhook(str(args.webhook), body, headers=headers)
-                if status and status >= 400:
-                    raise SystemExit(f"error: webhook returned HTTP {status}")
-
-            if do_notify and (getattr(args, "email_to", []) or []):
-                subject = getattr(args, "email_subject", None) or "enroll diff report"
-                smtp_password = None
-                pw_env = getattr(args, "smtp_password_env", None)
-                if pw_env:
-                    smtp_password = os.environ.get(str(pw_env))
-                send_email(
-                    to_addrs=list(getattr(args, "email_to", []) or []),
-                    subject=str(subject),
-                    body=rendered,
-                    from_addr=getattr(args, "email_from", None),
-                    smtp=getattr(args, "smtp", None),
-                    smtp_user=getattr(args, "smtp_user", None),
-                    smtp_password=smtp_password,
-                )
-
-            if getattr(args, "exit_code", False) and has_changes:
-                raise SystemExit(2)
+    except RemoteSudoPasswordRequired:
+        raise SystemExit(
+            "error: remote sudo requires a password. Re-run with --ask-become-pass."
+        ) from None
+    except RemoteSSHKeyPassphraseRequired as e:
+        msg = str(e).strip() or (
+            "SSH private key passphrase is required. "
+            "Re-run with --ask-key-passphrase or --ssh-key-passphrase-env VAR."
+        )
+        raise SystemExit(f"error: {msg}") from None
+    except RuntimeError as e:
+        raise SystemExit(f"error: {e}") from None
     except SopsError as e:
-        raise SystemExit(f"error: {e}")
+        raise SystemExit(f"error: {e}") from None

enroll/debian.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import glob
-import hashlib
 import os
 import subprocess  # nosec
 from typing import Dict, List, Optional, Set, Tuple
@@ -64,6 +63,50 @@ def list_manual_packages() -> List[str]:
     return sorted(set(pkgs))
 
 
+def list_installed_packages() -> Dict[str, List[Dict[str, str]]]:
+    """Return mapping of installed package name -> installed instances.
+
+    Uses dpkg-query and is expected to work on Debian/Ubuntu-like systems.
+
+    Output format:
+      {"pkg": [{"version": "...", "arch": "..."}, ...], ...}
+    """
+
+    try:
+        p = subprocess.run(
+            [
+                "dpkg-query",
+                "-W",
+                "-f=${Package}\t${Version}\t${Architecture}\n",
+            ],
+            text=True,
+            capture_output=True,
+            check=False,
+        )  # nosec
+    except Exception:
+        return {}
+
+    out: Dict[str, List[Dict[str, str]]] = {}
+    for raw in (p.stdout or "").splitlines():
+        line = raw.strip("\n")
+        if not line:
+            continue
+        parts = line.split("\t")
+        if len(parts) < 3:
+            continue
+        name, ver, arch = parts[0].strip(), parts[1].strip(), parts[2].strip()
+        if not name:
+            continue
+        out.setdefault(name, []).append({"version": ver, "arch": arch})
+
+    # Stable ordering for deterministic JSON dumps.
+    for k in list(out.keys()):
+        out[k] = sorted(
+            out[k], key=lambda x: (x.get("arch") or "", x.get("version") or "")
+        )
+    return out
+
+
 def build_dpkg_etc_index(
     info_dir: str = "/var/lib/dpkg/info",
 ) -> Tuple[Set[str], Dict[str, str], Dict[str, Set[str]], Dict[str, List[str]]]:
@@ -154,7 +197,9 @@ def parse_status_conffiles(
                 if ":" in line:
                     k, v = line.split(":", 1)
                     key = k
-                    cur[key] = v.lstrip()
+                    # Preserve leading spaces in continuation lines, but strip
+                    # the trailing newline from the initial key line value.
+                    cur[key] = v.lstrip().rstrip("\n")
 
     if cur:
         flush()
@@ -178,28 +223,3 @@ def read_pkg_md5sums(pkg: str) -> Dict[str, str]:
             md5, rel = line.split(None, 1)
             m[rel.strip()] = md5.strip()
     return m
-
-
-def file_md5(path: str) -> str:
-    h = hashlib.md5()  # nosec
-    with open(path, "rb") as f:
-        for chunk in iter(lambda: f.read(1024 * 1024), b""):
-            h.update(chunk)
-    return h.hexdigest()
-
-
-def stat_triplet(path: str) -> Tuple[str, str, str]:
-    st = os.stat(path, follow_symlinks=True)
-    mode = oct(st.st_mode & 0o777)[2:].zfill(4)
-
-    import pwd, grp
-
-    try:
-        owner = pwd.getpwuid(st.st_uid).pw_name
-    except KeyError:
-        owner = str(st.st_uid)
-    try:
-        group = grp.getgrgid(st.st_gid).gr_name
-    except KeyError:
-        group = str(st.st_gid)
-    return owner, group, mode

enroll/diff.py

@@ -3,10 +3,15 @@ from __future__ import annotations
 import hashlib
 import json
 import os
+import re
 import shutil
 import subprocess  # nosec
 import tarfile
 import tempfile
+import sys
+import threading
+import time
+import itertools
 import urllib.request
 from contextlib import ExitStack
 from dataclasses import dataclass
@@ -16,9 +21,73 @@ from pathlib import Path
 from typing import Any, Dict, Iterable, List, Optional, Tuple
 
 from .remote import _safe_extract_tar
+from .pathfilter import PathFilter
 from .sopsutil import decrypt_file_binary_to, require_sops_cmd
 
 
+def _progress_enabled() -> bool:
+    """Return True if we should display interactive progress UI on the CLI.
+
+    We only emit progress when stderr is a TTY, so it won't pollute JSON/text reports
+    captured by systemd, CI, webhooks, etc. Users can also disable this explicitly via
+    ENROLL_NO_PROGRESS=1.
+    """
+    if os.environ.get("ENROLL_NO_PROGRESS", "").strip() in {"1", "true", "yes"}:
+        return False
+    try:
+        return sys.stderr.isatty()
+    except Exception:
+        return False
+
+
+class _Spinner:
+    """A tiny terminal spinner with an elapsed-time counter (stderr-only)."""
+
+    def __init__(self, message: str, *, interval: float = 0.12) -> None:
+        self.message = message.rstrip()
+        self.interval = interval
+        self._stop = threading.Event()
+        self._thread: Optional[threading.Thread] = None
+        self._last_len = 0
+        self._start = 0.0
+
+    def start(self) -> None:
+        if self._thread is not None:
+            return
+        self._start = time.monotonic()
+        self._thread = threading.Thread(
+            target=self._run, name="enroll-spinner", daemon=True
+        )
+        self._thread.start()
+
+    def stop(self, final_line: Optional[str] = None) -> None:
+        self._stop.set()
+        if self._thread is not None:
+            self._thread.join(timeout=1.0)
+
+        # Clear spinner line.
+        try:
+            sys.stderr.write("\r" + (" " * max(self._last_len, 0)) + "\r")
+            if final_line:
+                sys.stderr.write(final_line.rstrip() + "\n")
+            sys.stderr.flush()
+        except Exception:
+            pass  # nosec
+
+    def _run(self) -> None:
+        frames = itertools.cycle("|/-\\")
+        while not self._stop.is_set():
+            elapsed = time.monotonic() - self._start
+            line = f"{self.message} {next(frames)} {elapsed:0.1f}s"
+            try:
+                sys.stderr.write("\r" + line)
+                sys.stderr.flush()
+                self._last_len = max(self._last_len, len(line))
+            except Exception:
+                return
+            self._stop.wait(self.interval)
+
+
 def _utc_now_iso() -> str:
     return datetime.now(tz=timezone.utc).isoformat()
 
@@ -126,18 +195,62 @@ def _load_state(bundle_dir: Path) -> Dict[str, Any]:
         return json.load(f)
 
 
+def _packages_inventory(state: Dict[str, Any]) -> Dict[str, Any]:
+    return (state.get("inventory") or {}).get("packages") or {}
+
+
 def _all_packages(state: Dict[str, Any]) -> List[str]:
-    pkgs = set(state.get("manual_packages", []) or [])
-    pkgs |= set(state.get("manual_packages_skipped", []) or [])
-    for s in state.get("services", []) or []:
-        for p in s.get("packages", []) or []:
-            pkgs.add(p)
-    return sorted(pkgs)
+    return sorted(_packages_inventory(state).keys())
+
+
+def _roles(state: Dict[str, Any]) -> Dict[str, Any]:
+    return state.get("roles") or {}
+
+
+def _pkg_version_key(entry: Dict[str, Any]) -> Optional[str]:
+    """Return a stable string used for version comparison."""
+    installs = entry.get("installations") or []
+    if isinstance(installs, list) and installs:
+        parts: List[str] = []
+        for inst in installs:
+            if not isinstance(inst, dict):
+                continue
+            arch = str(inst.get("arch") or "")
+            ver = str(inst.get("version") or "")
+            if not ver:
+                continue
+            parts.append(f"{arch}:{ver}" if arch else ver)
+        if parts:
+            return "|".join(sorted(parts))
+    v = entry.get("version")
+    if v:
+        return str(v)
+    return None
+
+
+def _pkg_version_display(entry: Dict[str, Any]) -> Optional[str]:
+    v = entry.get("version")
+    if v:
+        return str(v)
+    installs = entry.get("installations") or []
+    if isinstance(installs, list) and installs:
+        parts: List[str] = []
+        for inst in installs:
+            if not isinstance(inst, dict):
+                continue
+            arch = str(inst.get("arch") or "")
+            ver = str(inst.get("version") or "")
+            if not ver:
+                continue
+            parts.append(f"{ver} ({arch})" if arch else ver)
+        if parts:
+            return ", ".join(sorted(parts))
+    return None
 
 
 def _service_units(state: Dict[str, Any]) -> Dict[str, Dict[str, Any]]:
     out: Dict[str, Dict[str, Any]] = {}
-    for s in state.get("services", []) or []:
+    for s in _roles(state).get("services") or []:
         unit = s.get("unit")
         if unit:
             out[str(unit)] = s
@@ -145,7 +258,7 @@ def _service_units(state: Dict[str, Any]) -> Dict[str, Dict[str, Any]]:
 
 
 def _users_by_name(state: Dict[str, Any]) -> Dict[str, Dict[str, Any]]:
-    users = (state.get("users") or {}).get("users") or []
+    users = (_roles(state).get("users") or {}).get("users") or []
     out: Dict[str, Dict[str, Any]] = {}
     for u in users:
         name = u.get("name")
@@ -167,35 +280,47 @@ class FileRec:
 
 def _iter_managed_files(state: Dict[str, Any]) -> Iterable[Tuple[str, Dict[str, Any]]]:
     # Services
-    for s in state.get("services", []) or []:
+    for s in _roles(state).get("services") or []:
         role = s.get("role_name") or "unknown"
         for mf in s.get("managed_files", []) or []:
             yield str(role), mf
 
     # Package roles
-    for p in state.get("package_roles", []) or []:
+    for p in _roles(state).get("packages") or []:
         role = p.get("role_name") or "unknown"
         for mf in p.get("managed_files", []) or []:
             yield str(role), mf
 
     # Users
-    u = state.get("users") or {}
+    u = _roles(state).get("users") or {}
     u_role = u.get("role_name") or "users"
     for mf in u.get("managed_files", []) or []:
         yield str(u_role), mf
 
+    # apt_config
+    ac = _roles(state).get("apt_config") or {}
+    ac_role = ac.get("role_name") or "apt_config"
+    for mf in ac.get("managed_files", []) or []:
+        yield str(ac_role), mf
+
     # etc_custom
-    ec = state.get("etc_custom") or {}
+    ec = _roles(state).get("etc_custom") or {}
     ec_role = ec.get("role_name") or "etc_custom"
     for mf in ec.get("managed_files", []) or []:
         yield str(ec_role), mf
 
     # usr_local_custom
-    ul = state.get("usr_local_custom") or {}
+    ul = _roles(state).get("usr_local_custom") or {}
     ul_role = ul.get("role_name") or "usr_local_custom"
     for mf in ul.get("managed_files", []) or []:
         yield str(ul_role), mf
 
+    # extra_paths
+    xp = _roles(state).get("extra_paths") or {}
+    xp_role = xp.get("role_name") or "extra_paths"
+    for mf in xp.get("managed_files", []) or []:
+        yield str(xp_role), mf
+
 
 def _file_index(bundle_dir: Path, state: Dict[str, Any]) -> Dict[str, FileRec]:
     """Return mapping of absolute path -> FileRec.
@@ -233,6 +358,8 @@ def compare_harvests(
     new_path: str,
     *,
     sops_mode: bool = False,
+    exclude_paths: Optional[List[str]] = None,
+    ignore_package_versions: bool = False,
 ) -> Tuple[Dict[str, Any], bool]:
     """Compare two harvests.
 
@@ -249,12 +376,32 @@ def compare_harvests(
         old_state = _load_state(old_b.dir)
         new_state = _load_state(new_b.dir)
 
-        old_pkgs = set(_all_packages(old_state))
-        new_pkgs = set(_all_packages(new_state))
+        old_inv = _packages_inventory(old_state)
+        new_inv = _packages_inventory(new_state)
+
+        old_pkgs = set(old_inv.keys())
+        new_pkgs = set(new_inv.keys())
 
         pkgs_added = sorted(new_pkgs - old_pkgs)
         pkgs_removed = sorted(old_pkgs - new_pkgs)
 
+        pkgs_version_changed: List[Dict[str, Any]] = []
+        pkgs_version_changed_ignored_count = 0
+        for pkg in sorted(old_pkgs & new_pkgs):
+            a = old_inv.get(pkg) or {}
+            b = new_inv.get(pkg) or {}
+            if _pkg_version_key(a) != _pkg_version_key(b):
+                if ignore_package_versions:
+                    pkgs_version_changed_ignored_count += 1
+                else:
+                    pkgs_version_changed.append(
+                        {
+                            "package": pkg,
+                            "old": _pkg_version_display(a),
+                            "new": _pkg_version_display(b),
+                        }
+                    )
+
         old_units = _service_units(old_state)
         new_units = _service_units(new_state)
         units_added = sorted(set(new_units) - set(old_units))
@@ -315,6 +462,17 @@ def compare_harvests(
 
         old_files = _file_index(old_b.dir, old_state)
         new_files = _file_index(new_b.dir, new_state)
+
+        # Optional user-supplied path exclusions (same semantics as harvest --exclude-path),
+        # applied only to file drift reporting.
+        diff_filter = PathFilter(include=(), exclude=exclude_paths or ())
+        if exclude_paths:
+            old_files = {
+                p: r for p, r in old_files.items() if not diff_filter.is_excluded(p)
+            }
+            new_files = {
+                p: r for p, r in new_files.items() if not diff_filter.is_excluded(p)
+            }
         old_paths_set = set(old_files)
         new_paths_set = set(new_files)
 
@@ -368,6 +526,7 @@ def compare_harvests(
             [
                 pkgs_added,
                 pkgs_removed,
+                pkgs_version_changed,
                 units_added,
                 units_removed,
                 units_changed,
@@ -389,6 +548,10 @@ def compare_harvests(
 
         report: Dict[str, Any] = {
             "generated_at": _utc_now_iso(),
+            "filters": {
+                "exclude_paths": list(exclude_paths or []),
+                "ignore_package_versions": bool(ignore_package_versions),
+            },
             "old": {
                 "input": old_path,
                 "bundle_dir": str(old_b.dir),
@@ -401,7 +564,14 @@ def compare_harvests(
                 "state_mtime": _mtime_iso(new_b.state_path),
                 "host": (new_state.get("host") or {}).get("hostname"),
             },
-            "packages": {"added": pkgs_added, "removed": pkgs_removed},
+            "packages": {
+                "added": pkgs_added,
+                "removed": pkgs_removed,
+                "version_changed": pkgs_version_changed,
+                "version_changed_ignored_count": int(
+                    pkgs_version_changed_ignored_count
+                ),
+            },
             "services": {
                 "enabled_added": units_added,
                 "enabled_removed": units_removed,
@@ -436,6 +606,302 @@ def compare_harvests(
         return report, has_changes
 
 
+def has_enforceable_drift(report: Dict[str, Any]) -> bool:
+    """Return True if the diff report contains drift that is safe/meaningful to enforce.
+
+    Enforce mode is intended to restore *state* (files/users/services) and to
+    reinstall packages that were removed.
+
+    It is deliberately conservative about package drift:
+      - Package *version* changes alone are not enforced (no downgrades).
+      - Newly installed packages are not removed.
+
+    This helper lets the CLI decide whether `--enforce` should actually run.
+    """
+
+    pk = report.get("packages", {}) or {}
+    if pk.get("removed"):
+        return True
+
+    sv = report.get("services", {}) or {}
+    # We do not try to disable newly-enabled services; we only restore units
+    # that were enabled in the baseline but are now missing.
+    if sv.get("enabled_removed") or []:
+        return True
+
+    for ch in sv.get("changed", []) or []:
+        changes = ch.get("changes") or {}
+        # Ignore package set drift for enforceability decisions; package
+        # enforcement is handled via reinstalling removed packages, and we
+        # avoid trying to "undo" upgrades/renames.
+        for k in changes.keys():
+            if k != "packages":
+                return True
+
+    us = report.get("users", {}) or {}
+    # We restore baseline users (missing/changed). We do not remove newly-added users.
+    if (us.get("removed") or []) or (us.get("changed") or []):
+        return True
+
+    fl = report.get("files", {}) or {}
+    # We restore baseline files (missing/changed). We do not delete newly-managed files.
+    if (fl.get("removed") or []) or (fl.get("changed") or []):
+        return True
+
+    return False
+
+
+def _role_tag(role: str) -> str:
+    """Return the Ansible tag name for a role (must match manifest generation)."""
+    r = str(role or "").strip()
+    safe = re.sub(r"[^A-Za-z0-9_-]+", "_", r).strip("_")
+    if not safe:
+        safe = "other"
+    return f"role_{safe}"
+
+
+def _enforcement_plan(
+    report: Dict[str, Any],
+    old_state: Dict[str, Any],
+    old_bundle_dir: Path,
+) -> Dict[str, Any]:
+    """Return a best-effort enforcement plan (roles/tags) for this diff report.
+
+    We only plan for drift that the baseline manifest can safely restore:
+      - packages that were removed (reinstall, no downgrades)
+      - baseline users that were removed/changed
+      - baseline files that were removed/changed
+      - baseline systemd units that were disabled/changed
+
+    We do NOT plan to remove newly-added packages/users/files/services.
+    """
+    roles: set[str] = set()
+
+    # --- Packages (only removals)
+    pk = report.get("packages", {}) or {}
+    removed_pkgs = set(pk.get("removed") or [])
+    if removed_pkgs:
+        pkg_to_roles: Dict[str, set[str]] = {}
+
+        for svc in _roles(old_state).get("services") or []:
+            r = str(svc.get("role_name") or "").strip()
+            for p in svc.get("packages", []) or []:
+                if p:
+                    pkg_to_roles.setdefault(str(p), set()).add(r)
+
+        for pr in _roles(old_state).get("packages") or []:
+            r = str(pr.get("role_name") or "").strip()
+            p = pr.get("package")
+            if p:
+                pkg_to_roles.setdefault(str(p), set()).add(r)
+
+        for p in removed_pkgs:
+            for r in pkg_to_roles.get(str(p), set()):
+                if r:
+                    roles.add(r)
+
+    # --- Users (removed/changed)
+    us = report.get("users", {}) or {}
+    if (us.get("removed") or []) or (us.get("changed") or []):
+        u = _roles(old_state).get("users") or {}
+        u_role = str(u.get("role_name") or "users")
+        if u_role:
+            roles.add(u_role)
+
+    # --- Files (removed/changed)
+    fl = report.get("files", {}) or {}
+    file_paths: List[str] = []
+    for e in fl.get("removed", []) or []:
+        if isinstance(e, dict):
+            p = e.get("path")
+        else:
+            p = e
+        if p:
+            file_paths.append(str(p))
+    for e in fl.get("changed", []) or []:
+        if isinstance(e, dict):
+            p = e.get("path")
+        else:
+            p = e
+        if p:
+            file_paths.append(str(p))
+
+    if file_paths:
+        idx = _file_index(old_bundle_dir, old_state)
+        for p in file_paths:
+            rec = idx.get(p)
+            if rec and rec.role:
+                roles.add(str(rec.role))
+
+    # --- Services (enabled_removed + meaningful changes)
+    sv = report.get("services", {}) or {}
+    units: List[str] = []
+    for u in sv.get("enabled_removed", []) or []:
+        if u:
+            units.append(str(u))
+    for ch in sv.get("changed", []) or []:
+        if not isinstance(ch, dict):
+            continue
+        unit = ch.get("unit")
+        changes = ch.get("changes") or {}
+        if unit and any(k != "packages" for k in changes.keys()):
+            units.append(str(unit))
+
+    if units:
+        old_units = _service_units(old_state)
+        for u in units:
+            snap = old_units.get(u)
+            if snap and snap.get("role_name"):
+                roles.add(str(snap.get("role_name")))
+
+    # Drop empty/unknown roles.
+    roles = {r for r in roles if r and str(r).strip() and str(r).strip() != "unknown"}
+
+    tags = sorted({_role_tag(r) for r in roles})
+    return {
+        "roles": sorted(roles),
+        "tags": tags,
+    }
+
+
+def enforce_old_harvest(
+    old_path: str,
+    *,
+    sops_mode: bool = False,
+    report: Optional[Dict[str, Any]] = None,
+) -> Dict[str, Any]:
+    """Enforce the *old* (baseline) harvest state on the current machine.
+
+    When Ansible is available, this:
+      1) renders a temporary manifest from the old harvest, and
+      2) runs ansible-playbook locally to apply it.
+
+    Returns a dict suitable for attaching to the diff report under
+    report['enforcement'].
+    """
+
+    ansible_playbook = shutil.which("ansible-playbook")
+    if not ansible_playbook:
+        raise RuntimeError(
+            "ansible-playbook not found on PATH (cannot enforce; install Ansible)"
+        )
+
+    # Import lazily to avoid heavy import cost and potential CLI cycles.
+    from .manifest import manifest
+
+    started_at = _utc_now_iso()
+
+    with ExitStack() as stack:
+        old_b = _bundle_from_input(old_path, sops_mode=sops_mode)
+        if old_b.tempdir:
+            stack.callback(old_b.tempdir.cleanup)
+
+        old_state = _load_state(old_b.dir)
+
+        plan: Optional[Dict[str, Any]] = None
+        tags: Optional[List[str]] = None
+        roles: List[str] = []
+        if report is not None:
+            plan = _enforcement_plan(report, old_state, old_b.dir)
+            roles = list(plan.get("roles") or [])
+            t = list(plan.get("tags") or [])
+            tags = t if t else None
+
+        with tempfile.TemporaryDirectory(prefix="enroll-enforce-") as td:
+            td_path = Path(td)
+            try:
+                os.chmod(td_path, 0o700)
+            except OSError:
+                pass
+
+            # 1) Generate a manifest in a temp directory.
+            manifest(str(old_b.dir), str(td_path))
+
+            playbook = td_path / "playbook.yml"
+            if not playbook.exists():
+                raise RuntimeError(
+                    f"manifest did not produce expected playbook.yml at {playbook}"
+                )
+
+            # 2) Apply it locally.
+            env = dict(os.environ)
+            cfg = td_path / "ansible.cfg"
+            if cfg.exists():
+                env["ANSIBLE_CONFIG"] = str(cfg)
+
+            cmd = [
+                ansible_playbook,
+                "-i",
+                "localhost,",
+                "-c",
+                "local",
+                str(playbook),
+            ]
+            if tags:
+                cmd.extend(["--tags", ",".join(tags)])
+
+            spinner: Optional[_Spinner] = None
+            p: Optional[subprocess.CompletedProcess[str]] = None
+            t0 = time.monotonic()
+            if _progress_enabled():
+                if tags:
+                    sys.stderr.write(
+                        f"Enforce: running ansible-playbook (tags: {','.join(tags)})\n",
+                    )
+                else:
+                    sys.stderr.write("Enforce: running ansible-playbook\n")
+                sys.stderr.flush()
+                spinner = _Spinner("  ansible-playbook")
+                spinner.start()
+
+            try:
+                p = subprocess.run(
+                    cmd,
+                    cwd=str(td_path),
+                    env=env,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )  # nosec
+            finally:
+                if spinner:
+                    elapsed = time.monotonic() - t0
+                    rc = p.returncode if p is not None else None
+                    spinner.stop(
+                        final_line=(
+                            f"Enforce: ansible-playbook finished in {elapsed:0.1f}s"
+                            + (f" (rc={rc})" if rc is not None else ""),
+                        ),
+                    )
+
+            finished_at = _utc_now_iso()
+
+            info: Dict[str, Any] = {
+                "status": "applied" if p.returncode == 0 else "failed",
+                "started_at": started_at,
+                "finished_at": finished_at,
+                "ansible_playbook": ansible_playbook,
+                "command": cmd,
+                "returncode": int(p.returncode),
+            }
+
+            # Record tag selection (if we could attribute drift to specific roles).
+            info["roles"] = roles
+            info["tags"] = list(tags or [])
+            if not tags:
+                info["scope"] = "full_playbook"
+
+            if p.returncode != 0:
+                err = (p.stderr or p.stdout or "").strip()
+                raise RuntimeError(
+                    "ansible-playbook failed"
+                    + (f" (rc={p.returncode})" if p.returncode is not None else "")
+                    + (f": {err}" if err else "")
+                )
+
+            return info
+
+
 def format_report(report: Dict[str, Any], *, fmt: str = "text") -> str:
     fmt = (fmt or "text").lower()
     if fmt == "json":
@@ -455,14 +921,66 @@ def _report_text(report: Dict[str, Any]) -> str:
         f"new: {new.get('input')} (host={new.get('host')}, state_mtime={new.get('state_mtime')})"
     )
 
+    filt = report.get("filters", {}) or {}
+    ex_paths = filt.get("exclude_paths", []) or []
+    if ex_paths:
+        lines.append(f"file exclude patterns: {', '.join(str(p) for p in ex_paths)}")
+
+    if filt.get("ignore_package_versions"):
+        ignored = int(
+            (report.get("packages", {}) or {}).get("version_changed_ignored_count") or 0
+        )
+        msg = "package version drift: ignored (--ignore-package-versions)"
+        if ignored:
+            msg += f" (ignored {ignored} change{'s' if ignored != 1 else ''})"
+        lines.append(msg)
+
+    enf = report.get("enforcement") or {}
+    if enf:
+        lines.append("\nEnforcement")
+        status = str(enf.get("status") or "").strip().lower()
+        if status == "applied":
+            extra = ""
+            tags = enf.get("tags") or []
+            scope = enf.get("scope")
+            if tags:
+                extra = f" (tags={','.join(str(t) for t in tags)})"
+            elif scope:
+                extra = f" ({scope})"
+            lines.append(
+                f"  applied old harvest via ansible-playbook (rc={enf.get('returncode')})"
+                + extra
+                + (
+                    f" (finished {enf.get('finished_at')})"
+                    if enf.get("finished_at")
+                    else ""
+                )
+            )
+        elif status == "failed":
+            lines.append(
+                f"  attempted enforcement but ansible-playbook failed (rc={enf.get('returncode')})"
+            )
+        elif status == "skipped":
+            r = enf.get("reason")
+            lines.append("  skipped" + (f": {r}" if r else ""))
+        else:
+            # Best-effort formatting for future fields.
+            lines.append("  " + json.dumps(enf, sort_keys=True))
+
     pk = report.get("packages", {})
     lines.append("\nPackages")
     lines.append(f"  added:   {len(pk.get('added', []) or [])}")
     lines.append(f"  removed: {len(pk.get('removed', []) or [])}")
+    ignored_v = int(pk.get("version_changed_ignored_count") or 0)
+    vc = len(pk.get("version_changed", []) or [])
+    suffix = f" (ignored {ignored_v})" if ignored_v else ""
+    lines.append(f"  version_changed: {vc}{suffix}")
     for p in pk.get("added", []) or []:
         lines.append(f"    + {p}")
     for p in pk.get("removed", []) or []:
         lines.append(f"    - {p}")
+    for ch in pk.get("version_changed", []) or []:
+        lines.append(f"    ~ {ch.get('package')}: {ch.get('old')} -> {ch.get('new')}")
 
     sv = report.get("services", {})
     lines.append("\nServices (enabled systemd units)")
@@ -530,6 +1048,7 @@ def _report_text(report: Dict[str, Any]) -> str:
         [
             (pk.get("added") or []),
             (pk.get("removed") or []),
+            (pk.get("version_changed") or []),
             (sv.get("enabled_added") or []),
             (sv.get("enabled_removed") or []),
             (sv.get("changed") or []),
@@ -557,6 +1076,67 @@ def _report_markdown(report: Dict[str, Any]) -> str:
         f"- **New**: `{new.get('input')}` (host={new.get('host')}, state_mtime={new.get('state_mtime')})\n"
     )
 
+    filt = report.get("filters", {}) or {}
+    ex_paths = filt.get("exclude_paths", []) or []
+    if ex_paths:
+        out.append(
+            "- **File exclude patterns**: "
+            + ", ".join(f"`{p}`" for p in ex_paths)
+            + "\n"
+        )
+
+    if filt.get("ignore_package_versions"):
+        ignored = int(
+            (report.get("packages", {}) or {}).get("version_changed_ignored_count") or 0
+        )
+        msg = "- **Package version drift**: ignored (`--ignore-package-versions`)"
+        if ignored:
+            msg += f" (ignored {ignored} change{'s' if ignored != 1 else ''})"
+        out.append(msg + "\n")
+
+    enf = report.get("enforcement") or {}
+    if enf:
+        out.append("\n## Enforcement\n")
+        status = str(enf.get("status") or "").strip().lower()
+        if status == "applied":
+            extra = ""
+            tags = enf.get("tags") or []
+            scope = enf.get("scope")
+            if tags:
+                extra = " (tags=" + ",".join(str(t) for t in tags) + ")"
+            elif scope:
+                extra = f" ({scope})"
+            out.append(
+                "- ✅ Applied old harvest via ansible-playbook"
+                + extra
+                + (
+                    f" (rc={enf.get('returncode')})"
+                    if enf.get("returncode") is not None
+                    else ""
+                )
+                + (
+                    f" (finished `{enf.get('finished_at')}`)"
+                    if enf.get("finished_at")
+                    else ""
+                )
+                + "\n"
+            )
+        elif status == "failed":
+            out.append(
+                "- ⚠️ Attempted enforcement but ansible-playbook failed"
+                + (
+                    f" (rc={enf.get('returncode')})"
+                    if enf.get("returncode") is not None
+                    else ""
+                )
+                + "\n"
+            )
+        elif status == "skipped":
+            r = enf.get("reason")
+            out.append("- Skipped" + (f": {r}" if r else "") + "\n")
+        else:
+            out.append(f"- {json.dumps(enf, sort_keys=True)}\n")
+
     pk = report.get("packages", {})
     out.append("## Packages\n")
     out.append(f"- Added: {len(pk.get('added', []) or [])}\n")
@@ -566,6 +1146,15 @@ def _report_markdown(report: Dict[str, Any]) -> str:
     for p in pk.get("removed", []) or []:
         out.append(f"  - `- {p}`\n")
 
+    ignored_v = int(pk.get("version_changed_ignored_count") or 0)
+    vc = len(pk.get("version_changed", []) or [])
+    suffix = f" (ignored {ignored_v})" if ignored_v else ""
+    out.append(f"- Version changed: {vc}{suffix}\n")
+    for ch in pk.get("version_changed", []) or []:
+        out.append(
+            f"  - `~ {ch.get('package')}`: `{ch.get('old')}` → `{ch.get('new')}`\n"
+        )
+
     sv = report.get("services", {})
     out.append("## Services (enabled systemd units)\n")
     if sv.get("enabled_added"):
@@ -660,6 +1249,7 @@ def _report_markdown(report: Dict[str, Any]) -> str:
         [
             (pk.get("added") or []),
             (pk.get("removed") or []),
+            (pk.get("version_changed") or []),
             (sv.get("enabled_added") or []),
             (sv.get("enabled_removed") or []),
             (sv.get("changed") or []),

enroll/explain.py

@@ -0,0 +1,578 @@
+from __future__ import annotations
+
+import json
+from collections import Counter, defaultdict
+from dataclasses import dataclass
+from typing import Any, Dict, Iterable, List, Tuple
+
+from .diff import _bundle_from_input, _load_state  # reuse existing bundle handling
+
+
+@dataclass(frozen=True)
+class ReasonInfo:
+    title: str
+    why: str
+
+
+_MANAGED_FILE_REASONS: Dict[str, ReasonInfo] = {
+    # Package manager / repo config
+    "apt_config": ReasonInfo(
+        "APT configuration",
+        "APT configuration affecting package installation and repository behavior.",
+    ),
+    "apt_source": ReasonInfo(
+        "APT repository source",
+        "APT source list entries (e.g. sources.list or sources.list.d).",
+    ),
+    "apt_keyring": ReasonInfo(
+        "APT keyring",
+        "Repository signing key material used by APT.",
+    ),
+    "apt_signed_by_keyring": ReasonInfo(
+        "APT Signed-By keyring",
+        "Keyring referenced via a Signed-By directive in an APT source.",
+    ),
+    "yum_conf": ReasonInfo(
+        "YUM/DNF main config",
+        "Primary YUM configuration (often /etc/yum.conf).",
+    ),
+    "yum_config": ReasonInfo(
+        "YUM/DNF config",
+        "YUM/DNF configuration files (including conf.d).",
+    ),
+    "yum_repo": ReasonInfo(
+        "YUM/DNF repository",
+        "YUM/DNF repository definitions (e.g. yum.repos.d).",
+    ),
+    "dnf_config": ReasonInfo(
+        "DNF configuration",
+        "DNF configuration affecting package installation and repositories.",
+    ),
+    "rpm_gpg_key": ReasonInfo(
+        "RPM GPG key",
+        "Repository signing keys used by RPM/YUM/DNF.",
+    ),
+    # SSH
+    "authorized_keys": ReasonInfo(
+        "SSH authorized keys",
+        "User authorized_keys files (controls who can log in with SSH keys).",
+    ),
+    "ssh_public_key": ReasonInfo(
+        "SSH public key",
+        "SSH host/user public keys relevant to authentication.",
+    ),
+    # System config / security
+    "system_security": ReasonInfo(
+        "Security configuration",
+        "Security-sensitive configuration (SSH, sudoers, PAM, auth, etc.).",
+    ),
+    "system_network": ReasonInfo(
+        "Network configuration",
+        "Network configuration (interfaces, resolv.conf, network managers, etc.).",
+    ),
+    "system_firewall": ReasonInfo(
+        "Firewall configuration",
+        "Firewall rules/configuration (ufw, nftables, iptables, etc.).",
+    ),
+    "system_sysctl": ReasonInfo(
+        "sysctl configuration",
+        "Kernel sysctl tuning (sysctl.conf / sysctl.d).",
+    ),
+    "system_modprobe": ReasonInfo(
+        "modprobe configuration",
+        "Kernel module configuration (modprobe.d).",
+    ),
+    "system_mounts": ReasonInfo(
+        "Mount configuration",
+        "Mount configuration (e.g. /etc/fstab and related).",
+    ),
+    "system_rc": ReasonInfo(
+        "Startup/rc configuration",
+        "Startup scripts / rc configuration that can affect boot behavior.",
+    ),
+    # systemd + timers
+    "systemd_dropin": ReasonInfo(
+        "systemd drop-in",
+        "systemd override/drop-in files that modify a unit's behavior.",
+    ),
+    "systemd_envfile": ReasonInfo(
+        "systemd EnvironmentFile",
+        "Files referenced by systemd units via EnvironmentFile.",
+    ),
+    "related_timer": ReasonInfo(
+        "Related systemd timer",
+        "A systemd timer captured because it is related to a unit/service.",
+    ),
+    # cron / logrotate
+    "system_cron": ReasonInfo(
+        "System cron",
+        "System cron configuration (crontab, cron.d, etc.).",
+    ),
+    "cron_snippet": ReasonInfo(
+        "Cron snippet",
+        "Cron snippets referenced/used by harvested services or configs.",
+    ),
+    "system_logrotate": ReasonInfo(
+        "System logrotate",
+        "System logrotate configuration.",
+    ),
+    "logrotate_snippet": ReasonInfo(
+        "logrotate snippet",
+        "logrotate snippets/configs referenced in system configuration.",
+    ),
+    # Custom paths / drift signals
+    "modified_conffile": ReasonInfo(
+        "Modified package conffile",
+        "A package-managed conffile differs from the packaged/default version.",
+    ),
+    "modified_packaged_file": ReasonInfo(
+        "Modified packaged file",
+        "A file owned by a package differs from the packaged version.",
+    ),
+    "custom_unowned": ReasonInfo(
+        "Unowned custom file",
+        "A file not owned by any package (often custom/operator-managed).",
+    ),
+    "custom_specific_path": ReasonInfo(
+        "Custom specific path",
+        "A specific path included by a custom rule or snapshot.",
+    ),
+    "usr_local_bin_script": ReasonInfo(
+        "/usr/local/bin script",
+        "Executable scripts under /usr/local/bin (often operator-installed).",
+    ),
+    "usr_local_etc_custom": ReasonInfo(
+        "/usr/local/etc custom",
+        "Custom configuration under /usr/local/etc.",
+    ),
+    # User includes
+    "user_include": ReasonInfo(
+        "User-included path",
+        "Included because you specified it via --include-path / include patterns.",
+    ),
+}
+
+_MANAGED_DIR_REASONS: Dict[str, ReasonInfo] = {
+    "parent_of_managed_file": ReasonInfo(
+        "Parent directory",
+        "Included so permissions/ownership can be recreated for managed files.",
+    ),
+    "user_include_dir": ReasonInfo(
+        "User-included directory",
+        "Included because you specified it via --include-path / include patterns.",
+    ),
+}
+
+_EXCLUDED_REASONS: Dict[str, ReasonInfo] = {
+    "user_excluded": ReasonInfo(
+        "User excluded",
+        "Excluded because you explicitly excluded it (e.g. --exclude-path / patterns).",
+    ),
+    "unreadable": ReasonInfo(
+        "Unreadable",
+        "Enroll could not read this path with the permissions it had.",
+    ),
+    "log_file": ReasonInfo(
+        "Log file",
+        "Excluded because it appears to be a log file (usually noisy/large).",
+    ),
+    "denied_path": ReasonInfo(
+        "Denied path",
+        "Excluded because the path is in a denylist for safety.",
+    ),
+    "too_large": ReasonInfo(
+        "Too large",
+        "Excluded because it exceeded the size limit for harvested files.",
+    ),
+    "not_regular_file": ReasonInfo(
+        "Not a regular file",
+        "Excluded because it was not a regular file (device, socket, etc.).",
+    ),
+    "binary_like": ReasonInfo(
+        "Binary-like",
+        "Excluded because it looked like binary content (not useful for config management).",
+    ),
+    "sensitive_content": ReasonInfo(
+        "Sensitive content",
+        "Excluded because it likely contains secrets (e.g. shadow, private keys).",
+    ),
+}
+
+_OBSERVED_VIA: Dict[str, ReasonInfo] = {
+    "user_installed": ReasonInfo(
+        "User-installed",
+        "Package appears explicitly installed (as opposed to only pulled in as a dependency).",
+    ),
+    "systemd_unit": ReasonInfo(
+        "Referenced by systemd unit",
+        "Package is associated with a systemd unit that was harvested.",
+    ),
+    "package_role": ReasonInfo(
+        "Referenced by package role",
+        "Package was referenced by an enroll packages snapshot/role.",
+    ),
+}
+
+
+def _ri(mapping: Dict[str, ReasonInfo], key: str) -> ReasonInfo:
+    return mapping.get(key) or ReasonInfo(key, f"Captured with reason '{key}'")
+
+
+def _role_common_counts(role_obj: Dict[str, Any]) -> Tuple[int, int, int, int]:
+    """Return (managed_files, managed_dirs, excluded, notes) counts for a RoleCommon object."""
+    mf = len(role_obj.get("managed_files") or [])
+    md = len(role_obj.get("managed_dirs") or [])
+    ex = len(role_obj.get("excluded") or [])
+    nt = len(role_obj.get("notes") or [])
+    return mf, md, ex, nt
+
+
+def _summarize_reasons(
+    items: Iterable[Dict[str, Any]],
+    reason_key: str,
+    *,
+    mapping: Dict[str, ReasonInfo],
+    max_examples: int,
+) -> List[Dict[str, Any]]:
+    by_reason: Dict[str, List[str]] = defaultdict(list)
+    counts: Counter[str] = Counter()
+
+    for it in items:
+        if not isinstance(it, dict):
+            continue
+        r = it.get(reason_key)
+        if not r:
+            continue
+        r = str(r)
+        counts[r] += 1
+        p = it.get("path")
+        if (
+            max_examples > 0
+            and isinstance(p, str)
+            and p
+            and len(by_reason[r]) < max_examples
+        ):
+            by_reason[r].append(p)
+
+    out: List[Dict[str, Any]] = []
+    for reason, count in counts.most_common():
+        info = _ri(mapping, reason)
+        out.append(
+            {
+                "reason": reason,
+                "count": count,
+                "title": info.title,
+                "why": info.why,
+                "examples": by_reason.get(reason, []),
+            }
+        )
+    return out
+
+
+def explain_state(
+    harvest: str,
+    *,
+    sops_mode: bool = False,
+    fmt: str = "text",
+    max_examples: int = 3,
+) -> str:
+    """Explain a harvest bundle's state.json.
+
+    `harvest` may be:
+      - a bundle directory
+      - a path to state.json
+      - a tarball (.tar.gz/.tgz)
+      - a SOPS-encrypted bundle (.sops)
+    """
+    bundle = _bundle_from_input(harvest, sops_mode=sops_mode)
+    state = _load_state(bundle.dir)
+
+    host = state.get("host") or {}
+    enroll = state.get("enroll") or {}
+    roles = state.get("roles") or {}
+    inv = state.get("inventory") or {}
+    inv_pkgs = (inv.get("packages") or {}) if isinstance(inv, dict) else {}
+
+    role_summaries: List[Dict[str, Any]] = []
+
+    # Users
+    users_obj = roles.get("users") or {}
+    user_entries = users_obj.get("users") or []
+    mf, md, ex, _nt = (
+        _role_common_counts(users_obj) if isinstance(users_obj, dict) else (0, 0, 0, 0)
+    )
+    role_summaries.append(
+        {
+            "role": "users",
+            "summary": f"{len(user_entries)} user(s), {mf} file(s), {ex} excluded",
+            "notes": users_obj.get("notes") or [],
+        }
+    )
+
+    # Services
+    services_list = roles.get("services") or []
+    if isinstance(services_list, list):
+        total_mf = sum(
+            len((s.get("managed_files") or []))
+            for s in services_list
+            if isinstance(s, dict)
+        )
+        total_ex = sum(
+            len((s.get("excluded") or [])) for s in services_list if isinstance(s, dict)
+        )
+        role_summaries.append(
+            {
+                "role": "services",
+                "summary": f"{len(services_list)} unit(s), {total_mf} file(s), {total_ex} excluded",
+                "units": [
+                    {
+                        "unit": s.get("unit"),
+                        "active_state": s.get("active_state"),
+                        "sub_state": s.get("sub_state"),
+                        "unit_file_state": s.get("unit_file_state"),
+                        "condition_result": s.get("condition_result"),
+                    }
+                    for s in services_list
+                    if isinstance(s, dict)
+                ],
+            }
+        )
+
+    # Package snapshots
+    pkgs_list = roles.get("packages") or []
+    if isinstance(pkgs_list, list):
+        total_mf = sum(
+            len((p.get("managed_files") or []))
+            for p in pkgs_list
+            if isinstance(p, dict)
+        )
+        total_ex = sum(
+            len((p.get("excluded") or [])) for p in pkgs_list if isinstance(p, dict)
+        )
+        role_summaries.append(
+            {
+                "role": "packages",
+                "summary": f"{len(pkgs_list)} package snapshot(s), {total_mf} file(s), {total_ex} excluded",
+                "packages": [
+                    p.get("package") for p in pkgs_list if isinstance(p, dict)
+                ],
+            }
+        )
+
+    # Single snapshots
+    for rname in [
+        "apt_config",
+        "dnf_config",
+        "etc_custom",
+        "usr_local_custom",
+        "extra_paths",
+    ]:
+        robj = roles.get(rname) or {}
+        if not isinstance(robj, dict):
+            continue
+        mf, md, ex, _nt = _role_common_counts(robj)
+        extra: Dict[str, Any] = {}
+        if rname == "extra_paths":
+            extra = {
+                "include_patterns": robj.get("include_patterns") or [],
+                "exclude_patterns": robj.get("exclude_patterns") or [],
+            }
+        role_summaries.append(
+            {
+                "role": rname,
+                "summary": f"{mf} file(s), {md} dir(s), {ex} excluded",
+                "notes": robj.get("notes") or [],
+                **extra,
+            }
+        )
+
+    # Flatten managed/excluded across roles
+    all_managed_files: List[Dict[str, Any]] = []
+    all_managed_dirs: List[Dict[str, Any]] = []
+    all_excluded: List[Dict[str, Any]] = []
+
+    def _consume_role(role_obj: Dict[str, Any]) -> None:
+        for f in role_obj.get("managed_files") or []:
+            if isinstance(f, dict):
+                all_managed_files.append(f)
+        for d in role_obj.get("managed_dirs") or []:
+            if isinstance(d, dict):
+                all_managed_dirs.append(d)
+        for e in role_obj.get("excluded") or []:
+            if isinstance(e, dict):
+                all_excluded.append(e)
+
+    if isinstance(users_obj, dict):
+        _consume_role(users_obj)
+    if isinstance(services_list, list):
+        for s in services_list:
+            if isinstance(s, dict):
+                _consume_role(s)
+    if isinstance(pkgs_list, list):
+        for p in pkgs_list:
+            if isinstance(p, dict):
+                _consume_role(p)
+    for rname in [
+        "apt_config",
+        "dnf_config",
+        "etc_custom",
+        "usr_local_custom",
+        "extra_paths",
+    ]:
+        robj = roles.get(rname)
+        if isinstance(robj, dict):
+            _consume_role(robj)
+
+    managed_file_reasons = _summarize_reasons(
+        all_managed_files,
+        "reason",
+        mapping=_MANAGED_FILE_REASONS,
+        max_examples=max_examples,
+    )
+    managed_dir_reasons = _summarize_reasons(
+        all_managed_dirs,
+        "reason",
+        mapping=_MANAGED_DIR_REASONS,
+        max_examples=max_examples,
+    )
+    excluded_reasons = _summarize_reasons(
+        all_excluded,
+        "reason",
+        mapping=_EXCLUDED_REASONS,
+        max_examples=max_examples,
+    )
+
+    # Inventory observed_via breakdown (count packages that contain at least one entry for that kind)
+    observed_kinds: Counter[str] = Counter()
+    observed_refs: Dict[str, Counter[str]] = defaultdict(Counter)
+    for _pkg, entry in inv_pkgs.items():
+        if not isinstance(entry, dict):
+            continue
+        seen_kinds = set()
+        for ov in entry.get("observed_via") or []:
+            if not isinstance(ov, dict):
+                continue
+            kind = ov.get("kind")
+            if not kind:
+                continue
+            kind = str(kind)
+            seen_kinds.add(kind)
+            ref = ov.get("ref")
+            if isinstance(ref, str) and ref:
+                observed_refs[kind][ref] += 1
+        for k in seen_kinds:
+            observed_kinds[k] += 1
+
+    observed_via_summary: List[Dict[str, Any]] = []
+    for kind, cnt in observed_kinds.most_common():
+        info = _ri(_OBSERVED_VIA, kind)
+        top_refs = [
+            r for r, _ in observed_refs.get(kind, Counter()).most_common(max_examples)
+        ]
+        observed_via_summary.append(
+            {
+                "kind": kind,
+                "count": cnt,
+                "title": info.title,
+                "why": info.why,
+                "top_refs": top_refs,
+            }
+        )
+
+    report: Dict[str, Any] = {
+        "bundle_dir": str(bundle.dir),
+        "host": host,
+        "enroll": enroll,
+        "inventory": {
+            "package_count": len(inv_pkgs),
+            "observed_via": observed_via_summary,
+        },
+        "roles": role_summaries,
+        "reasons": {
+            "managed_files": managed_file_reasons,
+            "managed_dirs": managed_dir_reasons,
+            "excluded": excluded_reasons,
+        },
+    }
+
+    if fmt == "json":
+        return json.dumps(report, indent=2, sort_keys=True)
+
+    # Text rendering
+    out: List[str] = []
+    out.append(f"Enroll explained: {harvest}")
+    hn = host.get("hostname") or "(unknown host)"
+    os_family = host.get("os") or "unknown"
+    pkg_backend = host.get("pkg_backend") or "?"
+    ver = enroll.get("version") or "?"
+    out.append(f"Host: {hn} (os: {os_family}, pkg: {pkg_backend})")
+    out.append(f"Enroll: {ver}")
+    out.append("")
+
+    out.append("Inventory")
+    out.append(f"- Packages: {len(inv_pkgs)}")
+    if observed_via_summary:
+        out.append("- Why packages were included (observed_via):")
+        for ov in observed_via_summary:
+            extra = ""
+            if ov.get("top_refs"):
+                extra = f" (e.g. {', '.join(ov['top_refs'])})"
+            out.append(f"  - {ov['kind']}: {ov['count']} – {ov['why']}{extra}")
+    out.append("")
+
+    out.append("Roles collected")
+    for rs in role_summaries:
+        out.append(f"- {rs['role']}: {rs['summary']}")
+        if rs["role"] == "extra_paths":
+            inc = rs.get("include_patterns") or []
+            exc = rs.get("exclude_patterns") or []
+            if inc:
+                suffix = "…" if len(inc) > max_examples else ""
+                out.append(
+                    f"    include_patterns: {', '.join(map(str, inc[:max_examples]))}{suffix}"
+                )
+            if exc:
+                suffix = "…" if len(exc) > max_examples else ""
+                out.append(
+                    f"    exclude_patterns: {', '.join(map(str, exc[:max_examples]))}{suffix}"
+                )
+        notes = rs.get("notes") or []
+        if notes:
+            for n in notes[:max_examples]:
+                out.append(f"    note: {n}")
+            if len(notes) > max_examples:
+                out.append(
+                    f"    note: (+{len(notes) - max_examples} more. Use --format json to see them all)"
+                )
+    out.append("")
+
+    out.append("Why files were included (managed_files.reason)")
+    if managed_file_reasons:
+        for r in managed_file_reasons[:15]:
+            exs = r.get("examples") or []
+            ex_txt = f" Examples: {', '.join(exs)}" if exs else ""
+            out.append(f"- {r['reason']} ({r['count']}): {r['why']}.{ex_txt}")
+        if len(managed_file_reasons) > 15:
+            out.append(
+                f"- (+{len(managed_file_reasons) - 15} more reasons. Use --format json to see them all)"
+            )
+    else:
+        out.append("- (no managed files)")
+
+    if managed_dir_reasons:
+        out.append("")
+        out.append("Why directories were included (managed_dirs.reason)")
+        for r in managed_dir_reasons:
+            out.append(f"- {r['reason']} ({r['count']}): {r['why']}")
+
+    out.append("")
+    out.append("Why paths were excluded")
+    if excluded_reasons:
+        for r in excluded_reasons:
+            exs = r.get("examples") or []
+            ex_txt = f" Examples: {', '.join(exs)}" if exs else ""
+            out.append(f"- {r['reason']} ({r['count']}): {r['why']}.{ex_txt}")
+    else:
+        out.append("- (no excluded paths)")
+
+    return "\n".join(out) + "\n"

enroll/fsutil.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+import hashlib
+import os
+from typing import Tuple
+
+
+def file_md5(path: str) -> str:
+    """Return hex MD5 of a file.
+
+    Used for Debian dpkg baseline comparisons.
+    """
+    h = hashlib.md5()  # nosec
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1024 * 1024), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def stat_triplet(path: str) -> Tuple[str, str, str]:
+    """Return (owner, group, mode) for a path.
+
+    owner/group are usernames/group names when resolvable, otherwise numeric ids.
+    mode is a zero-padded octal string (e.g. "0644").
+    """
+    st = os.stat(path, follow_symlinks=True)
+    mode = oct(st.st_mode & 0o7777)[2:].zfill(4)
+
+    import grp
+    import pwd
+
+    try:
+        owner = pwd.getpwuid(st.st_uid).pw_name
+    except KeyError:
+        owner = str(st.st_uid)
+    try:
+        group = grp.getgrgid(st.st_gid).gr_name
+    except KeyError:
+        group = str(st.st_gid)
+    return owner, group, mode

enroll/ignore.py

@@ -30,6 +30,22 @@ DEFAULT_DENY_GLOBS = [
     "/usr/local/etc/letsencrypt/*",
 ]
 
+
+# Allow a small set of binary config artifacts that are commonly required to
+# reproduce system configuration (notably APT keyrings). These are still subject
+# to size and readability limits, but are exempt from the "binary_like" denial.
+DEFAULT_ALLOW_BINARY_GLOBS = [
+    "/etc/apt/trusted.gpg",
+    "/etc/apt/trusted.gpg.d/*.gpg",
+    "/etc/apt/keyrings/*.gpg",
+    "/etc/apt/keyrings/*.pgp",
+    "/etc/apt/keyrings/*.asc",
+    "/usr/share/keyrings/*.gpg",
+    "/usr/share/keyrings/*.pgp",
+    "/usr/share/keyrings/*.asc",
+    "/etc/pki/rpm-gpg/*",
+]
+
 SENSITIVE_CONTENT_PATTERNS = [
     re.compile(rb"-----BEGIN (RSA |EC |OPENSSH |)PRIVATE KEY-----"),
     re.compile(rb"(?i)\bpassword\s*="),
@@ -44,6 +60,7 @@ BLOCK_END = b"*/"
 @dataclass
 class IgnorePolicy:
     deny_globs: Optional[list[str]] = None
+    allow_binary_globs: Optional[list[str]] = None
     max_file_bytes: int = 256_000
     sample_bytes: int = 64_000
     # If True, be much less conservative about collecting potentially
@@ -54,6 +71,8 @@ class IgnorePolicy:
     def __post_init__(self) -> None:
         if self.deny_globs is None:
             self.deny_globs = list(DEFAULT_DENY_GLOBS)
+        if self.allow_binary_globs is None:
+            self.allow_binary_globs = list(DEFAULT_ALLOW_BINARY_GLOBS)
 
     def iter_effective_lines(self, content: bytes):
         in_block = False
@@ -81,6 +100,12 @@ class IgnorePolicy:
         # Always ignore plain *.log files (rarely useful as config, often noisy).
         if path.endswith(".log"):
             return "log_file"
+        # Ignore editor/backup files that end with a trailing tilde.
+        if path.endswith("~"):
+            return "backup_file"
+        # Ignore backup shadow files
+        if path.startswith("/etc/") and path.endswith("-"):
+            return "backup_file"
 
         if not self.dangerous:
             for g in self.deny_globs or []:
@@ -105,6 +130,10 @@ class IgnorePolicy:
             return "unreadable"
 
         if b"\x00" in data:
+            for g in self.allow_binary_globs or []:
+                if fnmatch.fnmatch(path, g):
+                    # Binary is acceptable for explicitly-allowed paths.
+                    return None
             return "binary_like"
 
         if not self.dangerous:
@@ -114,3 +143,75 @@ class IgnorePolicy:
                         return "sensitive_content"
 
         return None
+
+    def deny_reason_dir(self, path: str) -> Optional[str]:
+        """Directory-specific deny logic.
+
+        deny_reason() is file-oriented (it rejects directories as "not_regular_file").
+        For directory metadata capture (so roles can recreate directory trees), we need
+        a lighter-weight check:
+          - apply deny_globs (unless dangerous)
+          - require the path to be a real directory (no symlink)
+          - ensure it's stat'able/readable
+
+        No size checks or content scanning are performed for directories.
+        """
+        if not self.dangerous:
+            for g in self.deny_globs or []:
+                if fnmatch.fnmatch(path, g):
+                    return "denied_path"
+
+        try:
+            os.stat(path, follow_symlinks=True)
+        except OSError:
+            return "unreadable"
+
+        if os.path.islink(path):
+            return "symlink"
+
+        if not os.path.isdir(path):
+            return "not_directory"
+
+        return None
+
+    def deny_reason_link(self, path: str) -> Optional[str]:
+        """Symlink-specific deny logic.
+
+        Symlinks are meaningful configuration state (e.g. Debian-style
+        *-enabled directories). deny_reason() is file-oriented and rejects
+        symlinks as "not_regular_file".
+
+        For symlinks we:
+          - apply the usual deny_globs (unless dangerous)
+          - ensure the path is a symlink and we can readlink() it
+
+        No size checks or content scanning are performed for symlinks.
+        """
+
+        # Keep the same fast-path filename ignores as deny_reason().
+        if path.endswith(".log"):
+            return "log_file"
+        if path.endswith("~"):
+            return "backup_file"
+        if path.startswith("/etc/") and path.endswith("-"):
+            return "backup_file"
+
+        if not self.dangerous:
+            for g in self.deny_globs or []:
+                if fnmatch.fnmatch(path, g):
+                    return "denied_path"
+
+        try:
+            os.lstat(path)
+        except OSError:
+            return "unreadable"
+
+        if not os.path.islink(path):
+            return "not_symlink"
+
+        try:
+            os.readlink(path)
+        except OSError:
+            return "unreadable"
+
+        return None

enroll/jinjaturtle.py

@@ -8,7 +8,51 @@ from pathlib import Path
 from typing import Optional
 
 
-SUPPORTED_EXTS = {".ini", ".json", ".toml", ".yaml", ".yml", ".xml"}
+SYSTEMD_SUFFIXES = {
+    ".service",
+    ".socket",
+    ".target",
+    ".timer",
+    ".path",
+    ".mount",
+    ".automount",
+    ".slice",
+    ".swap",
+    ".scope",
+    ".link",
+    ".netdev",
+    ".network",
+}
+
+SUPPORTED_SUFFIXES = {
+    ".ini",
+    ".cfg",
+    ".json",
+    ".toml",
+    ".yaml",
+    ".yml",
+    ".xml",
+    ".repo",
+} | SYSTEMD_SUFFIXES
+
+
+def infer_other_formats(dest_path: str) -> Optional[str]:
+    p = Path(dest_path)
+    name = p.name.lower()
+    suffix = p.suffix.lower()
+    # postfix
+    if name == "main.cf":
+        return "postfix"
+    # systemd units
+    if suffix in SYSTEMD_SUFFIXES:
+        return "systemd"
+    # OpenSSH system config files and snippets
+    parts = {part.lower() for part in p.parts}
+    if name in {"sshd_config", "ssh_config"}:
+        return "ssh"
+    if suffix == ".conf" and {"sshd_config.d", "ssh_config.d"} & parts:
+        return "ssh"
+    return None
 
 
 @dataclass(frozen=True)
@@ -22,9 +66,15 @@ def find_jinjaturtle_cmd() -> Optional[str]:
     return shutil.which("jinjaturtle")
 
 
-def can_jinjify_path(path: str) -> bool:
-    p = Path(path)
-    return p.suffix.lower() in SUPPORTED_EXTS
+def can_jinjify_path(dest_path: str) -> bool:
+    p = Path(dest_path)
+    suffix = p.suffix.lower()
+    if infer_other_formats(dest_path):
+        return True
+    # allow unambiguous structured formats
+    if suffix in SUPPORTED_SUFFIXES:
+        return True
+    return False
 
 
 def run_jinjaturtle(

enroll/manifest.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shutil
 import stat
 import tarfile
@@ -10,8 +11,9 @@ from pathlib import Path
 from typing import Any, Dict, List, Optional, Set, Tuple
 
 from .jinjaturtle import (
-    find_jinjaturtle_cmd,
     can_jinjify_path,
+    find_jinjaturtle_cmd,
+    infer_other_formats,
     run_jinjaturtle,
 )
 
@@ -138,7 +140,6 @@ def _copy_artifacts(
 
             # If a file was successfully templatised by JinjaTurtle, do NOT
             # also materialise the raw copy in the destination files dir.
-            # (This keeps the output minimal and avoids redundant "raw" files.)
             if exclude_rels and rel in exclude_rels:
                 try:
                     if os.path.isfile(dst):
@@ -162,16 +163,31 @@ def _write_role_scaffold(role_dir: str) -> None:
     os.makedirs(os.path.join(role_dir, "templates"), exist_ok=True)
 
 
+def _role_tag(role: str) -> str:
+    """Return a stable Ansible tag name for a role.
+
+    Used by `enroll diff --enforce` to run only the roles needed to repair drift.
+    """
+    r = str(role or "").strip()
+    # Ansible tag charset is fairly permissive, but keep it portable and consistent.
+    safe = re.sub(r"[^A-Za-z0-9_-]+", "_", r).strip("_")
+    if not safe:
+        safe = "other"
+    return f"role_{safe}"
+
+
 def _write_playbook_all(path: str, roles: List[str]) -> None:
     pb_lines = [
         "---",
-        "- name: Apply all roles on host",
+        "- name: Apply all roles on all hosts",
+        "  gather_facts: true",
         "  hosts: all",
         "  become: true",
         "  roles:",
     ]
     for r in roles:
-        pb_lines.append(f"    - {r}")
+        pb_lines.append(f"    - role: {r}")
+        pb_lines.append(f"      tags: [{_role_tag(r)}]")
     with open(path, "w", encoding="utf-8") as f:
         f.write("\n".join(pb_lines) + "\n")
 
@@ -179,13 +195,15 @@ def _write_playbook_all(path: str, roles: List[str]) -> None:
 def _write_playbook_host(path: str, fqdn: str, roles: List[str]) -> None:
     pb_lines = [
         "---",
-        f"- name: Apply enroll roles on {fqdn}",
+        f"- name: Apply all roles on {fqdn}",
         f"  hosts: {fqdn}",
+        "  gather_facts: true",
         "  become: true",
         "  roles:",
     ]
     for r in roles:
-        pb_lines.append(f"    - {r}")
+        pb_lines.append(f"    - role: {r}")
+        pb_lines.append(f"      tags: [{_role_tag(r)}]")
     with open(path, "w", encoding="utf-8") as f:
         f.write("\n".join(pb_lines) + "\n")
 
@@ -269,9 +287,7 @@ def _write_hostvars(site_root: str, fqdn: str, role: str, data: Dict[str, Any])
 
     merged = _merge_mappings_overwrite(existing_map, data)
 
-    out = "# Generated by enroll (host-specific vars)\n---\n" + _yaml_dump_mapping(
-        merged, sort_keys=True
-    )
+    out = "---\n" + _yaml_dump_mapping(merged, sort_keys=True)
     with open(path, "w", encoding="utf-8") as f:
         f.write(out)
 
@@ -309,7 +325,10 @@ def _jinjify_managed_files(
             continue
 
         try:
-            res = run_jinjaturtle(jt_exe, artifact_path, role_name=role)
+            force_fmt = infer_other_formats(dest_path)
+            res = run_jinjaturtle(
+                jt_exe, artifact_path, role_name=role, force_format=force_fmt
+            )
         except Exception:
             # If jinjaturtle cannot process a file for any reason, skip silently.
             # (Enroll's core promise is to be optimistic and non-interactive.)
@@ -344,6 +363,29 @@ def _write_role_defaults(role_dir: str, mapping: Dict[str, Any]) -> None:
         f.write(out)
 
 
+def _build_managed_dirs_var(
+    managed_dirs: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Convert enroll managed_dirs into an Ansible-friendly list of dicts.
+
+    Each dict drives a role task loop and is safe across hosts.
+    """
+    out: List[Dict[str, Any]] = []
+    for d in managed_dirs:
+        dest = d.get("path") or ""
+        if not dest:
+            continue
+        out.append(
+            {
+                "dest": dest,
+                "owner": d.get("owner") or "root",
+                "group": d.get("group") or "root",
+                "mode": d.get("mode") or "0755",
+            }
+        )
+    return out
+
+
 def _build_managed_files_var(
     managed_files: List[Dict[str, Any]],
     templated_src_rels: Set[str],
@@ -383,6 +425,20 @@ def _build_managed_files_var(
     return out
 
 
+def _build_managed_links_var(
+    managed_links: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Convert enroll managed_links into an Ansible-friendly list of dicts."""
+    out: List[Dict[str, Any]] = []
+    for ml in managed_links or []:
+        dest = ml.get("path") or ""
+        src = ml.get("target") or ""
+        if not dest or not src:
+            continue
+        out.append({"dest": dest, "src": src})
+    return out
+
+
 def _render_generic_files_tasks(
     var_prefix: str, *, include_restart_notify: bool
 ) -> str:
@@ -390,9 +446,16 @@ def _render_generic_files_tasks(
     # Using first_found makes roles work in both modes:
     # - site-mode: inventory/host_vars/<host>/<role>/.files/...
     # - non-site: roles/<role>/files/...
-    return f"""# Generated by enroll (data-driven tasks)
+    return f"""- name: Ensure managed directories exist (preserve owner/group/mode)
+  ansible.builtin.file:
+    path: "{{{{ item.dest }}}}"
+    state: directory
+    owner: "{{{{ item.owner }}}}"
+    group: "{{{{ item.group }}}}"
+    mode: "{{{{ item.mode }}}}"
+  loop: "{{{{ {var_prefix}_managed_dirs | default([]) }}}}"
 
-- name: Deploy systemd unit files (templates)
+- name: Deploy any systemd unit files (templates)
   ansible.builtin.template:
     src: "{{{{ item.src_rel }}}}.j2"
     dest: "{{{{ item.dest }}}}"
@@ -406,7 +469,7 @@ def _render_generic_files_tasks(
       | list }}}}
   notify: "{{{{ item.notify | default([]) }}}}"
 
-- name: Deploy systemd unit files (copies)
+- name: Deploy any systemd unit files (raw files)
   vars:
     _enroll_ff:
       files:
@@ -433,7 +496,7 @@ def _render_generic_files_tasks(
       | list
       | length) > 0
 
-- name: Deploy other managed files (templates)
+- name: Deploy any other managed files (templates)
   ansible.builtin.template:
     src: "{{{{ item.src_rel }}}}.j2"
     dest: "{{{{ item.dest }}}}"
@@ -447,7 +510,7 @@ def _render_generic_files_tasks(
       | list }}}}
   notify: "{{{{ item.notify | default([]) }}}}"
 
-- name: Deploy other managed files (copies)
+- name: Deploy any other managed files (raw files)
   vars:
     _enroll_ff:
       files:
@@ -465,6 +528,57 @@ def _render_generic_files_tasks(
       | selectattr('kind', 'equalto', 'copy')
       | list }}}}
   notify: "{{{{ item.notify | default([]) }}}}"
+
+- name: Ensure managed symlinks exist
+  ansible.builtin.file:
+    src: "{{{{ item.src }}}}"
+    dest: "{{{{ item.dest }}}}"
+    state: link
+    force: true
+  loop: "{{{{ {var_prefix}_managed_links | default([]) }}}}"
+"""
+
+
+def _render_install_packages_tasks(role: str, var_prefix: str) -> str:
+    """Render cross-distro package installation tasks.
+
+    We generate conditional tasks for apt/dnf/yum, falling back to the
+    generic `package` module. This keeps generated roles usable on both
+    Debian-like and RPM-like systems.
+    """
+    return f"""- name: Install packages for {role} (APT)
+  ansible.builtin.apt:
+    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
+    state: present
+    update_cache: true
+  when:
+    - ({var_prefix}_packages | default([])) | length > 0
+    - ansible_facts.pkg_mgr | default('') == 'apt'
+
+- name: Install packages for {role} (DNF5)
+  ansible.builtin.dnf5:
+    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
+    state: present
+  when:
+    - ({var_prefix}_packages | default([])) | length > 0
+    - ansible_facts.pkg_mgr | default('') == 'dnf5'
+
+- name: Install packages for {role} (DNF/YUM)
+  ansible.builtin.dnf:
+    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
+    state: present
+  when:
+    - ({var_prefix}_packages | default([])) | length > 0
+    - ansible_facts.pkg_mgr | default('') in ['dnf', 'yum']
+
+- name: Install packages for {role} (generic fallback)
+  ansible.builtin.package:
+    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
+    state: present
+  when:
+    - ({var_prefix}_packages | default([])) | length > 0
+    - ansible_facts.pkg_mgr | default('') not in ['apt', 'dnf', 'dnf5', 'yum']
+
 """
 
 
@@ -625,11 +739,16 @@ def _manifest_from_bundle_dir(
     with open(state_path, "r", encoding="utf-8") as f:
         state = json.load(f)
 
-    services: List[Dict[str, Any]] = state.get("services", [])
-    package_roles: List[Dict[str, Any]] = state.get("package_roles", [])
-    users_snapshot: Dict[str, Any] = state.get("users", {})
-    etc_custom_snapshot: Dict[str, Any] = state.get("etc_custom", {})
-    usr_local_custom_snapshot: Dict[str, Any] = state.get("usr_local_custom", {})
+    roles: Dict[str, Any] = state.get("roles") or {}
+
+    services: List[Dict[str, Any]] = roles.get("services", [])
+    package_roles: List[Dict[str, Any]] = roles.get("packages", [])
+    users_snapshot: Dict[str, Any] = roles.get("users", {})
+    apt_config_snapshot: Dict[str, Any] = roles.get("apt_config", {})
+    dnf_config_snapshot: Dict[str, Any] = roles.get("dnf_config", {})
+    etc_custom_snapshot: Dict[str, Any] = roles.get("etc_custom", {})
+    usr_local_custom_snapshot: Dict[str, Any] = roles.get("usr_local_custom", {})
+    extra_paths_snapshot: Dict[str, Any] = roles.get("extra_paths", {})
 
     site_mode = fqdn is not None and fqdn != ""
 
@@ -661,16 +780,14 @@ def _manifest_from_bundle_dir(
         _ensure_ansible_cfg(os.path.join(out_dir, "ansible.cfg"))
 
     manifested_users_roles: List[str] = []
+    manifested_apt_config_roles: List[str] = []
+    manifested_dnf_config_roles: List[str] = []
     manifested_etc_custom_roles: List[str] = []
     manifested_usr_local_custom_roles: List[str] = []
+    manifested_extra_paths_roles: List[str] = []
     manifested_service_roles: List[str] = []
     manifested_pkg_roles: List[str] = []
 
-    # In site_mode, raw harvested files are stored under host-specific inventory
-    # to avoid cross-host clobber while still sharing a role definition.
-
-    # -------------------------
-
     # -------------------------
     # Users role (non-system users)
     # -------------------------
@@ -743,7 +860,12 @@ def _manifest_from_bundle_dir(
                     group = str(u.get("primary_group") or owner)
                     break
 
-            mode = "0600" if mf.get("reason") == "authorized_keys" else "0644"
+            # Prefer the harvested file mode so we preserve any deliberate
+            # permissions (e.g. 0600 for certain dotfiles). For authorized_keys,
+            # enforce 0600 regardless.
+            mode = mf.get("mode") or "0644"
+            if mf.get("reason") == "authorized_keys":
+                mode = "0600"
             ssh_files.append(
                 {
                     "dest": dest,
@@ -791,7 +913,6 @@ def _manifest_from_bundle_dir(
 
         # tasks (data-driven)
         users_tasks = """---
-# Generated by enroll (data-driven tasks)
 
 - name: Ensure groups exist
   ansible.builtin.group:
@@ -892,6 +1013,324 @@ Generated non-system user accounts and SSH public material.
         manifested_users_roles.append(role)
 
     # -------------------------
+    # apt_config role (APT sources, pinning, and keyrings)
+    # -------------------------
+    if apt_config_snapshot and apt_config_snapshot.get("managed_files"):
+        role = apt_config_snapshot.get("role_name", "apt_config")
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+
+        var_prefix = role
+
+        managed_files = apt_config_snapshot.get("managed_files", [])
+        managed_dirs = apt_config_snapshot.get("managed_dirs", []) or []
+        excluded = apt_config_snapshot.get("excluded", [])
+        notes = apt_config_snapshot.get("notes", [])
+
+        templated, jt_vars = _jinjify_managed_files(
+            bundle_dir,
+            role,
+            role_dir,
+            managed_files,
+            jt_exe=jt_exe,
+            jt_enabled=jt_enabled,
+            overwrite_templates=not site_mode,
+        )
+
+        # Copy only the non-templated artifacts (templates live in the role).
+        if site_mode:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                _host_role_files_dir(out_dir, fqdn or "", role),
+                exclude_rels=templated,
+            )
+        else:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                os.path.join(role_dir, "files"),
+                exclude_rels=templated,
+            )
+
+        files_var = _build_managed_files_var(
+            managed_files,
+            templated,
+            notify_other=None,
+            notify_systemd=None,
+        )
+
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
+        jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
+        vars_map: Dict[str, Any] = {
+            f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+        }
+        vars_map = _merge_mappings_overwrite(vars_map, jt_map)
+
+        if site_mode:
+            _write_role_defaults(
+                role_dir,
+                {f"{var_prefix}_managed_files": [], f"{var_prefix}_managed_dirs": []},
+            )
+            _write_hostvars(out_dir, fqdn or "", role, vars_map)
+        else:
+            _write_role_defaults(role_dir, vars_map)
+
+        tasks = "---\n" + _render_generic_files_tasks(
+            var_prefix, include_restart_notify=False
+        )
+        with open(
+            os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write(tasks.rstrip() + "\n")
+
+        with open(
+            os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write("---\ndependencies: []\n")
+
+        # README: summarise repos and keyrings
+        source_paths: List[str] = []
+        keyring_paths: List[str] = []
+        repo_hosts: Set[str] = set()
+
+        url_re = re.compile(r"(?:https?|ftp)://([^/\s]+)", re.IGNORECASE)
+
+        for mf in managed_files:
+            p = str(mf.get("path") or "")
+            src_rel = str(mf.get("src_rel") or "")
+            if not p or not src_rel:
+                continue
+
+            if p == "/etc/apt/sources.list" or p.startswith("/etc/apt/sources.list.d/"):
+                source_paths.append(p)
+                art_path = os.path.join(bundle_dir, "artifacts", role, src_rel)
+                try:
+                    with open(art_path, "r", encoding="utf-8", errors="replace") as sf:
+                        for line in sf:
+                            line = line.strip()
+                            if not line or line.startswith("#"):
+                                continue
+                            for m in url_re.finditer(line):
+                                repo_hosts.add(m.group(1))
+                except OSError:
+                    pass  # nosec
+
+            if (
+                p.startswith("/etc/apt/trusted.gpg")
+                or p.startswith("/etc/apt/keyrings/")
+                or p.startswith("/usr/share/keyrings/")
+            ):
+                keyring_paths.append(p)
+
+        source_paths = sorted(set(source_paths))
+        keyring_paths = sorted(set(keyring_paths))
+        repos = sorted(repo_hosts)
+
+        readme = (
+            """# apt_config
+
+APT configuration harvested from the system (sources, pinning, and keyrings).
+
+## Repository hosts
+"""
+            + ("\n".join([f"- {h}" for h in repos]) or "- (none)")
+            + """\n
+## Source files
+"""
+            + ("\n".join([f"- {p}" for p in source_paths]) or "- (none)")
+            + """\n
+## Keyrings
+"""
+            + ("\n".join([f"- {p}" for p in keyring_paths]) or "- (none)")
+            + """\n
+## Managed files
+"""
+            + (
+                "\n".join(
+                    [f"- {mf.get('path')} ({mf.get('reason')})" for mf in managed_files]
+                )
+                or "- (none)"
+            )
+            + """\n
+## Excluded
+"""
+            + (
+                "\n".join([f"- {e.get('path')} ({e.get('reason')})" for e in excluded])
+                or "- (none)"
+            )
+            + """\n
+## Notes
+"""
+            + ("\n".join([f"- {n}" for n in notes]) or "- (none)")
+            + """\n"""
+        )
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_apt_config_roles.append(role)
+
+    # -------------------------
+    # dnf_config role (DNF/YUM repos, config, and RPM GPG keys)
+    # -------------------------
+    if dnf_config_snapshot and dnf_config_snapshot.get("managed_files"):
+        role = dnf_config_snapshot.get("role_name", "dnf_config")
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+
+        var_prefix = role
+
+        managed_files = dnf_config_snapshot.get("managed_files", [])
+        managed_dirs = dnf_config_snapshot.get("managed_dirs", []) or []
+        excluded = dnf_config_snapshot.get("excluded", [])
+        notes = dnf_config_snapshot.get("notes", [])
+
+        templated, jt_vars = _jinjify_managed_files(
+            bundle_dir,
+            role,
+            role_dir,
+            managed_files,
+            jt_exe=jt_exe,
+            jt_enabled=jt_enabled,
+            overwrite_templates=not site_mode,
+        )
+
+        if site_mode:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                _host_role_files_dir(out_dir, fqdn or "", role),
+                exclude_rels=templated,
+            )
+        else:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                os.path.join(role_dir, "files"),
+                exclude_rels=templated,
+            )
+
+        files_var = _build_managed_files_var(
+            managed_files,
+            templated,
+            notify_other=None,
+            notify_systemd=None,
+        )
+
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
+        jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
+        vars_map: Dict[str, Any] = {
+            f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+        }
+        vars_map = _merge_mappings_overwrite(vars_map, jt_map)
+
+        if site_mode:
+            _write_role_defaults(
+                role_dir,
+                {f"{var_prefix}_managed_files": [], f"{var_prefix}_managed_dirs": []},
+            )
+            _write_hostvars(out_dir, fqdn or "", role, vars_map)
+        else:
+            _write_role_defaults(role_dir, vars_map)
+
+        tasks = "---\n" + _render_generic_files_tasks(
+            var_prefix, include_restart_notify=False
+        )
+        with open(
+            os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write(tasks.rstrip() + "\n")
+
+        with open(
+            os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write("---\ndependencies: []\n")
+
+        # README: summarise repos and GPG key material
+        repo_paths: List[str] = []
+        key_paths: List[str] = []
+        repo_hosts: Set[str] = set()
+
+        url_re = re.compile(r"(?:https?|ftp)://([^/\s]+)", re.IGNORECASE)
+        file_url_re = re.compile(r"file://(/[^\s]+)")
+
+        for mf in managed_files:
+            p = str(mf.get("path") or "")
+            src_rel = str(mf.get("src_rel") or "")
+            if not p or not src_rel:
+                continue
+
+            if p.startswith("/etc/yum.repos.d/") and p.endswith(".repo"):
+                repo_paths.append(p)
+                art_path = os.path.join(bundle_dir, "artifacts", role, src_rel)
+                try:
+                    with open(art_path, "r", encoding="utf-8", errors="replace") as rf:
+                        for line in rf:
+                            s = line.strip()
+                            if not s or s.startswith("#") or s.startswith(";"):
+                                continue
+                            # Collect hostnames from URLs (baseurl, mirrorlist, metalink, gpgkey...)
+                            for m in url_re.finditer(s):
+                                repo_hosts.add(m.group(1))
+                            # Collect local gpgkey file paths referenced as file:///...
+                            for m in file_url_re.finditer(s):
+                                key_paths.append(m.group(1))
+                except OSError:
+                    pass  # nosec
+
+            if p.startswith("/etc/pki/rpm-gpg/"):
+                key_paths.append(p)
+
+        repo_paths = sorted(set(repo_paths))
+        key_paths = sorted(set(key_paths))
+        repos = sorted(repo_hosts)
+
+        readme = (
+            """# dnf_config
+
+DNF/YUM configuration harvested from the system (repos, config files, and RPM GPG keys).
+
+## Repository hosts
+"""
+            + ("\n".join([f"- {h}" for h in repos]) or "- (none)")
+            + """\n
+## Repo files
+"""
+            + ("\n".join([f"- {p}" for p in repo_paths]) or "- (none)")
+            + """\n
+## GPG keys
+"""
+            + ("\n".join([f"- {p}" for p in key_paths]) or "- (none)")
+            + """\n
+## Managed files
+"""
+            + (
+                "\n".join(
+                    [f"- {mf.get('path')} ({mf.get('reason')})" for mf in managed_files]
+                )
+                or "- (none)"
+            )
+            + """\n
+## Excluded
+"""
+            + (
+                "\n".join([f"- {e.get('path')} ({e.get('reason')})" for e in excluded])
+                or "- (none)"
+            )
+            + """\n
+## Notes
+"""
+            + ("\n".join([f"- {n}" for n in notes]) or "- (none)")
+            + """\n"""
+        )
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_dnf_config_roles.append(role)
 
     # -------------------------
     # etc_custom role (unowned /etc not already attributed)
@@ -904,6 +1343,7 @@ Generated non-system user accounts and SSH public material.
         var_prefix = role
 
         managed_files = etc_custom_snapshot.get("managed_files", [])
+        managed_dirs = etc_custom_snapshot.get("managed_dirs", []) or []
         excluded = etc_custom_snapshot.get("excluded", [])
         notes = etc_custom_snapshot.get("notes", [])
 
@@ -940,17 +1380,25 @@ Generated non-system user accounts and SSH public material.
             notify_systemd="Run systemd daemon-reload",
         )
 
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
         jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
-        vars_map: Dict[str, Any] = {f"{var_prefix}_managed_files": files_var}
+        vars_map: Dict[str, Any] = {
+            f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+        }
         vars_map = _merge_mappings_overwrite(vars_map, jt_map)
 
         if site_mode:
-            _write_role_defaults(role_dir, {f"{var_prefix}_managed_files": []})
+            _write_role_defaults(
+                role_dir,
+                {f"{var_prefix}_managed_files": [], f"{var_prefix}_managed_dirs": []},
+            )
             _write_hostvars(out_dir, fqdn or "", role, vars_map)
         else:
             _write_role_defaults(role_dir, vars_map)
 
-        tasks = """---\n""" + _render_generic_files_tasks(
+        tasks = "---\n" + _render_generic_files_tasks(
             var_prefix, include_restart_notify=False
         )
         with open(
@@ -1014,6 +1462,7 @@ Unowned /etc config files not attributed to packages or services.
         var_prefix = role
 
         managed_files = usr_local_custom_snapshot.get("managed_files", [])
+        managed_dirs = usr_local_custom_snapshot.get("managed_dirs", []) or []
         excluded = usr_local_custom_snapshot.get("excluded", [])
         notes = usr_local_custom_snapshot.get("notes", [])
 
@@ -1050,12 +1499,20 @@ Unowned /etc config files not attributed to packages or services.
             notify_systemd=None,
         )
 
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
         jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
-        vars_map: Dict[str, Any] = {f"{var_prefix}_managed_files": files_var}
+        vars_map: Dict[str, Any] = {
+            f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+        }
         vars_map = _merge_mappings_overwrite(vars_map, jt_map)
 
         if site_mode:
-            _write_role_defaults(role_dir, {f"{var_prefix}_managed_files": []})
+            _write_role_defaults(
+                role_dir,
+                {f"{var_prefix}_managed_files": [], f"{var_prefix}_managed_dirs": []},
+            )
             _write_hostvars(out_dir, fqdn or "", role, vars_map)
         else:
             _write_role_defaults(role_dir, vars_map)
@@ -1099,6 +1556,133 @@ Unowned /etc config files not attributed to packages or services.
         manifested_usr_local_custom_roles.append(role)
 
     # -------------------------
+    # extra_paths role (user-requested includes)
+    # -------------------------
+    if extra_paths_snapshot and (
+        extra_paths_snapshot.get("managed_files")
+        or extra_paths_snapshot.get("managed_dirs")
+    ):
+        role = extra_paths_snapshot.get("role_name", "extra_paths")
+        role_dir = os.path.join(roles_root, role)
+        _write_role_scaffold(role_dir)
+
+        var_prefix = role
+
+        managed_dirs = extra_paths_snapshot.get("managed_dirs", []) or []
+        managed_files = extra_paths_snapshot.get("managed_files", [])
+        excluded = extra_paths_snapshot.get("excluded", [])
+        notes = extra_paths_snapshot.get("notes", [])
+        include_pats = extra_paths_snapshot.get("include_patterns", []) or []
+        exclude_pats = extra_paths_snapshot.get("exclude_patterns", []) or []
+
+        templated, jt_vars = _jinjify_managed_files(
+            bundle_dir,
+            role,
+            role_dir,
+            managed_files,
+            jt_exe=jt_exe,
+            jt_enabled=jt_enabled,
+            overwrite_templates=not site_mode,
+        )
+
+        if site_mode:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                _host_role_files_dir(out_dir, fqdn or "", role),
+                exclude_rels=templated,
+            )
+        else:
+            _copy_artifacts(
+                bundle_dir,
+                role,
+                os.path.join(role_dir, "files"),
+                exclude_rels=templated,
+            )
+
+        files_var = _build_managed_files_var(
+            managed_files,
+            templated,
+            notify_other=None,
+            notify_systemd=None,
+        )
+
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
+        jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
+        vars_map: Dict[str, Any] = {
+            f"{var_prefix}_managed_dirs": dirs_var,
+            f"{var_prefix}_managed_files": files_var,
+        }
+        vars_map = _merge_mappings_overwrite(vars_map, jt_map)
+
+        if site_mode:
+            _write_role_defaults(
+                role_dir,
+                {
+                    f"{var_prefix}_managed_dirs": [],
+                    f"{var_prefix}_managed_files": [],
+                },
+            )
+            _write_hostvars(out_dir, fqdn or "", role, vars_map)
+        else:
+            _write_role_defaults(role_dir, vars_map)
+
+        tasks = "---\n" + _render_generic_files_tasks(
+            var_prefix, include_restart_notify=False
+        )
+        with open(
+            os.path.join(role_dir, "tasks", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write(tasks.rstrip() + "\n")
+
+        with open(
+            os.path.join(role_dir, "handlers", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write("---\n")
+
+        with open(
+            os.path.join(role_dir, "meta", "main.yml"), "w", encoding="utf-8"
+        ) as f:
+            f.write("---\ndependencies: []\n")
+
+        readme = (
+            f"""# {role}
+
+User-requested extra file harvesting.
+
+## Include patterns
+"""
+            + ("\n".join([f"- {p}" for p in include_pats]) or "- (none)")
+            + """\n
+## Exclude patterns
+"""
+            + ("\n".join([f"- {p}" for p in exclude_pats]) or "- (none)")
+            + """\n
+## Managed directories
+"""
+            + ("\n".join([f"- {d.get('path')}" for d in managed_dirs]) or "- (none)")
+            + """\n
+## Managed files
+"""
+            + ("\n".join([f"- {mf.get('path')}" for mf in managed_files]) or "- (none)")
+            + """\n
+## Excluded
+"""
+            + (
+                "\n".join([f"- {e.get('path')} ({e.get('reason')})" for e in excluded])
+                or "- (none)"
+            )
+            + """\n
+## Notes
+"""
+            + ("\n".join([f"- {n}" for n in notes]) or "- (none)")
+            + """\n"""
+        )
+        with open(os.path.join(role_dir, "README.md"), "w", encoding="utf-8") as f:
+            f.write(readme)
+
+        manifested_extra_paths_roles.append(role)
 
     # -------------------------
     # Service roles
@@ -1108,6 +1692,8 @@ Unowned /etc config files not attributed to packages or services.
         unit = svc["unit"]
         pkgs = svc.get("packages", []) or []
         managed_files = svc.get("managed_files", []) or []
+        managed_dirs = svc.get("managed_dirs", []) or []
+        managed_links = svc.get("managed_links", []) or []
 
         role_dir = os.path.join(roles_root, role)
         _write_role_scaffold(role_dir)
@@ -1152,11 +1738,17 @@ Unowned /etc config files not attributed to packages or services.
             notify_systemd="Run systemd daemon-reload",
         )
 
+        links_var = _build_managed_links_var(managed_links)
+
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
         jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
         base_vars: Dict[str, Any] = {
             f"{var_prefix}_unit_name": unit,
             f"{var_prefix}_packages": pkgs,
             f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+            f"{var_prefix}_managed_links": links_var,
             f"{var_prefix}_manage_unit": True,
             f"{var_prefix}_systemd_enabled": bool(enabled_at_harvest),
             f"{var_prefix}_systemd_state": desired_state,
@@ -1171,6 +1763,8 @@ Unowned /etc config files not attributed to packages or services.
                     f"{var_prefix}_unit_name": unit,
                     f"{var_prefix}_packages": [],
                     f"{var_prefix}_managed_files": [],
+                    f"{var_prefix}_managed_dirs": [],
+                    f"{var_prefix}_managed_links": [],
                     f"{var_prefix}_manage_unit": False,
                     f"{var_prefix}_systemd_enabled": False,
                     f"{var_prefix}_systemd_state": "stopped",
@@ -1199,27 +1793,14 @@ Unowned /etc config files not attributed to packages or services.
             f.write(handlers)
 
         task_parts: List[str] = []
-        task_parts.append(
-            f"""---
-# Generated by enroll (data-driven tasks)
-
-- name: Install packages for {role}
-  ansible.builtin.apt:
-    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
-    state: present
-    update_cache: true
-  when: ({var_prefix}_packages | default([])) | length > 0
-
-"""
-        )
+        task_parts.append("---\n" + _render_install_packages_tasks(role, var_prefix))
 
         task_parts.append(
             _render_generic_files_tasks(var_prefix, include_restart_notify=True)
         )
 
         task_parts.append(
-            f"""
-- name: Probe whether systemd unit exists and is manageable
+            f"""- name: Probe whether systemd unit exists and is manageable
   ansible.builtin.systemd:
     name: "{{{{ {var_prefix}_unit_name }}}}"
   check_mode: true
@@ -1269,6 +1850,9 @@ Generated from `{unit}`.
 ## Managed files
 {os.linesep.join("- " + mf["path"] + " (" + mf["reason"] + ")" for mf in managed_files) or "- (none)"}
 
+## Managed symlinks
+{os.linesep.join("- " + ml["path"] + " -> " + ml["target"] + " (" + ml.get("reason", "") + ")" for ml in managed_links) or "- (none)"}
+
 ## Excluded (possible secrets / unsafe)
 {os.linesep.join("- " + e["path"] + " (" + e["reason"] + ")" for e in excluded) or "- (none)"}
 
@@ -1287,6 +1871,8 @@ Generated from `{unit}`.
         role = pr["role_name"]
         pkg = pr.get("package") or ""
         managed_files = pr.get("managed_files", []) or []
+        managed_dirs = pr.get("managed_dirs", []) or []
+        managed_links = pr.get("managed_links", []) or []
 
         role_dir = os.path.join(roles_root, role)
         _write_role_scaffold(role_dir)
@@ -1328,10 +1914,16 @@ Generated from `{unit}`.
             notify_systemd="Run systemd daemon-reload",
         )
 
+        links_var = _build_managed_links_var(managed_links)
+
+        dirs_var = _build_managed_dirs_var(managed_dirs)
+
         jt_map = _yaml_load_mapping(jt_vars) if jt_vars.strip() else {}
         base_vars: Dict[str, Any] = {
             f"{var_prefix}_packages": pkgs,
             f"{var_prefix}_managed_files": files_var,
+            f"{var_prefix}_managed_dirs": dirs_var,
+            f"{var_prefix}_managed_links": links_var,
         }
         base_vars = _merge_mappings_overwrite(base_vars, jt_map)
 
@@ -1341,6 +1933,8 @@ Generated from `{unit}`.
                 {
                     f"{var_prefix}_packages": [],
                     f"{var_prefix}_managed_files": [],
+                    f"{var_prefix}_managed_dirs": [],
+                    f"{var_prefix}_managed_links": [],
                 },
             )
             _write_hostvars(out_dir, fqdn or "", role, base_vars)
@@ -1358,19 +1952,7 @@ Generated from `{unit}`.
             f.write(handlers)
 
         task_parts: List[str] = []
-        task_parts.append(
-            f"""---
-# Generated by enroll (data-driven tasks)
-
-- name: Install packages for {role}
-  ansible.builtin.apt:
-    name: "{{{{ {var_prefix}_packages | default([]) }}}}"
-    state: present
-    update_cache: true
-  when: ({var_prefix}_packages | default([])) | length > 0
-
-"""
-        )
+        task_parts.append("---\n" + _render_install_packages_tasks(role, var_prefix))
         task_parts.append(
             _render_generic_files_tasks(var_prefix, include_restart_notify=False)
         )
@@ -1395,6 +1977,9 @@ Generated for package `{pkg}`.
 ## Managed files
 {os.linesep.join("- " + mf["path"] + " (" + mf["reason"] + ")" for mf in managed_files) or "- (none)"}
 
+## Managed symlinks
+{os.linesep.join("- " + ml["path"] + " -> " + ml["target"] + " (" + ml.get("reason", "") + ")" for ml in managed_links) or "- (none)"}
+
 ## Excluded (possible secrets / unsafe)
 {os.linesep.join("- " + e["path"] + " (" + e["reason"] + ")" for e in excluded) or "- (none)"}
 
@@ -1407,12 +1992,26 @@ Generated for package `{pkg}`.
             f.write(readme)
 
         manifested_pkg_roles.append(role)
+    # Place cron/logrotate at the end of the playbook so:
+    #   - users exist before we restore per-user crontabs in /var/spool
+    #   - most packages/services are installed/configured first
+    tail_roles: List[str] = []
+    for r in ("cron", "logrotate"):
+        if r in manifested_pkg_roles:
+            tail_roles.append(r)
+
+    main_pkg_roles = [r for r in manifested_pkg_roles if r not in set(tail_roles)]
+
     all_roles = (
-        manifested_pkg_roles
+        manifested_apt_config_roles
+        + manifested_dnf_config_roles
+        + main_pkg_roles
         + manifested_service_roles
         + manifested_etc_custom_roles
         + manifested_usr_local_custom_roles
+        + manifested_extra_paths_roles
         + manifested_users_roles
+        + tail_roles
     )
 
     if site_mode:

enroll/pathfilter.py

@@ -0,0 +1,293 @@
+from __future__ import annotations
+
+import glob
+import os
+import re
+from dataclasses import dataclass
+from pathlib import PurePosixPath
+from typing import List, Optional, Sequence, Set, Tuple
+
+
+_REGEX_PREFIXES = ("re:", "regex:")
+
+
+def _has_glob_chars(s: str) -> bool:
+    return any(ch in s for ch in "*?[")
+
+
+def _norm_abs(p: str) -> str:
+    """Normalise a path-ish string to an absolute POSIX path.
+
+    We treat inputs that don't start with '/' as being relative to '/'.
+    """
+
+    p = p.strip()
+    if not p:
+        return "/"
+    if not p.startswith("/"):
+        p = "/" + p
+    # `normpath` keeps a leading '/' for absolute paths.
+    return os.path.normpath(p)
+
+
+def _posix_match(path: str, pattern: str) -> bool:
+    """Path matching with glob semantics.
+
+    Uses PurePosixPath.match which:
+      - treats '/' as a segment separator
+      - supports '**' for recursive matching
+
+    Both `path` and `pattern` are treated as absolute paths.
+    """
+
+    # PurePosixPath.match is anchored and works best on relative strings.
+    p = path.lstrip("/")
+    pat = pattern.lstrip("/")
+    try:
+        return PurePosixPath(p).match(pat)
+    except Exception:
+        # If the pattern is somehow invalid, fail closed.
+        return False
+
+
+def _regex_literal_prefix(regex: str) -> str:
+    """Best-effort literal prefix extraction for a regex.
+
+    This lets us pick a starting directory to walk when expanding regex-based
+    include patterns.
+    """
+
+    s = regex
+    if s.startswith("^"):
+        s = s[1:]
+    out: List[str] = []
+    escaped = False
+    meta = set(".^$*+?{}[]\\|()")
+    for ch in s:
+        if escaped:
+            out.append(ch)
+            escaped = False
+            continue
+        if ch == "\\":
+            escaped = True
+            continue
+        if ch in meta:
+            break
+        out.append(ch)
+    return "".join(out)
+
+
+@dataclass(frozen=True)
+class CompiledPathPattern:
+    raw: str
+    kind: str  # 'prefix' | 'glob' | 'regex'
+    value: str
+    regex: Optional[re.Pattern[str]] = None
+
+    def matches(self, path: str) -> bool:
+        p = _norm_abs(path)
+
+        if self.kind == "regex":
+            if not self.regex:
+                return False
+            # Search (not match) so users can write unanchored patterns.
+            return self.regex.search(p) is not None
+
+        if self.kind == "glob":
+            return _posix_match(p, self.value)
+
+        # prefix
+        pref = self.value.rstrip("/")
+        return p == pref or p.startswith(pref + "/")
+
+
+def compile_path_pattern(raw: str) -> CompiledPathPattern:
+    s = raw.strip()
+    for pre in _REGEX_PREFIXES:
+        if s.startswith(pre):
+            rex = s[len(pre) :].strip()
+            try:
+                return CompiledPathPattern(
+                    raw=raw, kind="regex", value=rex, regex=re.compile(rex)
+                )
+            except re.error:
+                # Treat invalid regexes as non-matching.
+                return CompiledPathPattern(raw=raw, kind="regex", value=rex, regex=None)
+
+    # If the user explicitly says glob:, honour it.
+    if s.startswith("glob:"):
+        pat = s[len("glob:") :].strip()
+        return CompiledPathPattern(raw=raw, kind="glob", value=_norm_abs(pat))
+
+    # Heuristic: if it contains glob metacharacters, treat as a glob.
+    if _has_glob_chars(s) or "**" in s:
+        return CompiledPathPattern(raw=raw, kind="glob", value=_norm_abs(s))
+
+    # Otherwise treat as an exact path-or-prefix (dir subtree).
+    return CompiledPathPattern(raw=raw, kind="prefix", value=_norm_abs(s))
+
+
+@dataclass
+class PathFilter:
+    """User-provided path filters.
+
+    Semantics:
+      - exclude patterns always win
+      - include patterns are used only to expand *additional* files to harvest
+        (they do not restrict the default harvest set)
+
+    Patterns:
+      - By default: glob-like (supports '**')
+      - Regex: prefix with 're:' or 'regex:'
+      - Force glob: prefix with 'glob:'
+      - A plain path without wildcards matches that path and everything under it
+        (directory-prefix behaviour).
+
+    Examples:
+      --exclude-path /usr/local/bin/docker-*
+      --include-path /home/*/.bashrc
+      --include-path 're:^/home/[^/]+/.config/myapp/.*$'
+    """
+
+    include: Sequence[str] = ()
+    exclude: Sequence[str] = ()
+
+    def __post_init__(self) -> None:
+        self._include = [
+            compile_path_pattern(p) for p in self.include if str(p).strip()
+        ]
+        self._exclude = [
+            compile_path_pattern(p) for p in self.exclude if str(p).strip()
+        ]
+
+    def is_excluded(self, path: str) -> bool:
+        for pat in self._exclude:
+            if pat.matches(path):
+                return True
+        return False
+
+    def iter_include_patterns(self) -> List[CompiledPathPattern]:
+        return list(self._include)
+
+
+def expand_includes(
+    patterns: Sequence[CompiledPathPattern],
+    *,
+    exclude: Optional[PathFilter] = None,
+    max_files: int,
+) -> Tuple[List[str], List[str]]:
+    """Expand include patterns into concrete file paths.
+
+    Returns (paths, notes). The returned paths are absolute paths.
+
+    This function is intentionally conservative:
+      - symlinks are ignored (both dirs and files)
+      - the number of collected files is capped
+
+    Regex patterns are expanded by walking a best-effort inferred root.
+    """
+
+    out: List[str] = []
+    notes: List[str] = []
+    seen: Set[str] = set()
+
+    def _maybe_add_file(p: str) -> None:
+        if len(out) >= max_files:
+            return
+        p = _norm_abs(p)
+        if exclude and exclude.is_excluded(p):
+            return
+        if p in seen:
+            return
+        if not os.path.isfile(p) or os.path.islink(p):
+            return
+        seen.add(p)
+        out.append(p)
+
+    def _walk_dir(root: str, match: Optional[CompiledPathPattern] = None) -> None:
+        root = _norm_abs(root)
+        if not os.path.isdir(root) or os.path.islink(root):
+            return
+        for dirpath, dirnames, filenames in os.walk(root, followlinks=False):
+            # Prune excluded directories early.
+            if exclude:
+                dirnames[:] = [
+                    d
+                    for d in dirnames
+                    if not exclude.is_excluded(os.path.join(dirpath, d))
+                    and not os.path.islink(os.path.join(dirpath, d))
+                ]
+            for fn in filenames:
+                if len(out) >= max_files:
+                    return
+                p = os.path.join(dirpath, fn)
+                if os.path.islink(p) or not os.path.isfile(p):
+                    continue
+                if exclude and exclude.is_excluded(p):
+                    continue
+                if match is not None and not match.matches(p):
+                    continue
+                if p in seen:
+                    continue
+                seen.add(p)
+                out.append(_norm_abs(p))
+
+    for pat in patterns:
+        if len(out) >= max_files:
+            notes.append(
+                f"Include cap reached ({max_files}); some includes were not expanded."
+            )
+            break
+
+        matched_any = False
+
+        if pat.kind == "prefix":
+            p = pat.value
+            if os.path.isfile(p) and not os.path.islink(p):
+                _maybe_add_file(p)
+                matched_any = True
+            elif os.path.isdir(p) and not os.path.islink(p):
+                before = len(out)
+                _walk_dir(p)
+                matched_any = len(out) > before
+            else:
+                # Still allow prefix patterns that don't exist now (e.g. remote different)
+                # by matching nothing rather than erroring.
+                matched_any = False
+
+        elif pat.kind == "glob":
+            # Use glob for expansion; also walk directories that match.
+            gpat = pat.value
+            hits = glob.glob(gpat, recursive=True)
+            for h in hits:
+                if len(out) >= max_files:
+                    break
+                h = _norm_abs(h)
+                if exclude and exclude.is_excluded(h):
+                    continue
+                if os.path.isdir(h) and not os.path.islink(h):
+                    before = len(out)
+                    _walk_dir(h)
+                    if len(out) > before:
+                        matched_any = True
+                elif os.path.isfile(h) and not os.path.islink(h):
+                    _maybe_add_file(h)
+                    matched_any = True
+
+        else:  # regex
+            rex = pat.value
+            prefix = _regex_literal_prefix(rex)
+            # Determine a walk root. If we can infer an absolute prefix, use its
+            # directory; otherwise fall back to '/'.
+            if prefix.startswith("/"):
+                root = os.path.dirname(prefix) or "/"
+            else:
+                root = "/"
+            before = len(out)
+            _walk_dir(root, match=pat)
+            matched_any = len(out) > before
+
+        if not matched_any:
+            notes.append(f"Include pattern matched no files: {pat.raw!r}")
+
+    return out, notes

enroll/platform.py

@@ -0,0 +1,282 @@
+from __future__ import annotations
+
+import shutil
+from dataclasses import dataclass
+from typing import Dict, List, Optional, Set, Tuple
+
+from .fsutil import file_md5
+
+
+def _read_os_release(path: str = "/etc/os-release") -> Dict[str, str]:
+    out: Dict[str, str] = {}
+    try:
+        with open(path, "r", encoding="utf-8", errors="replace") as f:
+            for raw in f:
+                line = raw.strip()
+                if not line or line.startswith("#") or "=" not in line:
+                    continue
+                k, v = line.split("=", 1)
+                k = k.strip()
+                v = v.strip().strip('"')
+                out[k] = v
+    except OSError:
+        return {}
+    return out
+
+
+@dataclass
+class PlatformInfo:
+    os_family: str  # debian|redhat|unknown
+    pkg_backend: str  # dpkg|rpm|unknown
+    os_release: Dict[str, str]
+
+
+def detect_platform() -> PlatformInfo:
+    """Detect platform family and package backend.
+
+    Uses /etc/os-release when available, with a conservative fallback to
+    checking for dpkg/rpm binaries.
+    """
+
+    osr = _read_os_release()
+    os_id = (osr.get("ID") or "").strip().lower()
+    likes = (osr.get("ID_LIKE") or "").strip().lower().split()
+
+    deb_ids = {"debian", "ubuntu", "linuxmint", "raspbian", "kali"}
+    rhel_ids = {
+        "fedora",
+        "rhel",
+        "centos",
+        "rocky",
+        "almalinux",
+        "ol",
+        "oracle",
+        "scientific",
+    }
+
+    if os_id in deb_ids or "debian" in likes:
+        return PlatformInfo(os_family="debian", pkg_backend="dpkg", os_release=osr)
+    if os_id in rhel_ids or any(
+        x in likes for x in ("rhel", "fedora", "centos", "redhat")
+    ):
+        return PlatformInfo(os_family="redhat", pkg_backend="rpm", os_release=osr)
+
+    # Fallback heuristics.
+    if shutil.which("dpkg"):
+        return PlatformInfo(os_family="debian", pkg_backend="dpkg", os_release=osr)
+    if shutil.which("rpm"):
+        return PlatformInfo(os_family="redhat", pkg_backend="rpm", os_release=osr)
+    return PlatformInfo(os_family="unknown", pkg_backend="unknown", os_release=osr)
+
+
+class PackageBackend:
+    """Backend abstraction for package ownership, config detection, and manual package lists."""
+
+    name: str
+    pkg_config_prefixes: Tuple[str, ...]
+
+    def owner_of_path(self, path: str) -> Optional[str]:  # pragma: no cover
+        raise NotImplementedError
+
+    def list_manual_packages(self) -> List[str]:  # pragma: no cover
+        raise NotImplementedError
+
+    def installed_packages(self) -> Dict[str, List[Dict[str, str]]]:  # pragma: no cover
+        """Return mapping of package name -> installed instances.
+
+        Each instance is a dict with at least:
+          - version: package version string
+          - arch: architecture string
+
+        Backends should be best-effort and return an empty mapping on failure.
+        """
+        raise NotImplementedError
+
+    def build_etc_index(
+        self,
+    ) -> Tuple[
+        Set[str], Dict[str, str], Dict[str, Set[str]], Dict[str, List[str]]
+    ]:  # pragma: no cover
+        raise NotImplementedError
+
+    def specific_paths_for_hints(self, hints: Set[str]) -> List[str]:
+        return []
+
+    def is_pkg_config_path(self, path: str) -> bool:
+        for pfx in self.pkg_config_prefixes:
+            if path == pfx or path.startswith(pfx):
+                return True
+        return False
+
+    def modified_paths(self, pkg: str, etc_paths: List[str]) -> Dict[str, str]:
+        """Return a mapping of modified file paths -> reason label."""
+        return {}
+
+
+class DpkgBackend(PackageBackend):
+    name = "dpkg"
+    pkg_config_prefixes = ("/etc/apt/",)
+
+    def __init__(self) -> None:
+        from .debian import parse_status_conffiles
+
+        self._conffiles_by_pkg = parse_status_conffiles()
+
+    def owner_of_path(self, path: str) -> Optional[str]:
+        from .debian import dpkg_owner
+
+        return dpkg_owner(path)
+
+    def list_manual_packages(self) -> List[str]:
+        from .debian import list_manual_packages
+
+        return list_manual_packages()
+
+    def installed_packages(self) -> Dict[str, List[Dict[str, str]]]:
+        from .debian import list_installed_packages
+
+        return list_installed_packages()
+
+    def build_etc_index(self):
+        from .debian import build_dpkg_etc_index
+
+        return build_dpkg_etc_index()
+
+    def specific_paths_for_hints(self, hints: Set[str]) -> List[str]:
+        paths: List[str] = []
+        for h in hints:
+            paths.extend(
+                [
+                    f"/etc/default/{h}",
+                    f"/etc/init.d/{h}",
+                    f"/etc/sysctl.d/{h}.conf",
+                ]
+            )
+        return paths
+
+    def modified_paths(self, pkg: str, etc_paths: List[str]) -> Dict[str, str]:
+        from .debian import read_pkg_md5sums
+
+        out: Dict[str, str] = {}
+        conff = self._conffiles_by_pkg.get(pkg, {})
+        md5sums = read_pkg_md5sums(pkg)
+
+        for path in etc_paths:
+            if not path.startswith("/etc/"):
+                continue
+            if self.is_pkg_config_path(path):
+                continue
+            if path in conff:
+                try:
+                    current = file_md5(path)
+                except OSError:
+                    continue
+                if current != conff[path]:
+                    out[path] = "modified_conffile"
+                continue
+
+            rel = path.lstrip("/")
+            baseline = md5sums.get(rel)
+            if baseline:
+                try:
+                    current = file_md5(path)
+                except OSError:
+                    continue
+                if current != baseline:
+                    out[path] = "modified_packaged_file"
+        return out
+
+
+class RpmBackend(PackageBackend):
+    name = "rpm"
+    pkg_config_prefixes = (
+        "/etc/dnf/",
+        "/etc/yum/",
+        "/etc/yum.repos.d/",
+        "/etc/yum.conf",
+    )
+
+    def __init__(self) -> None:
+        self._modified_cache: Dict[str, Set[str]] = {}
+        self._config_cache: Dict[str, Set[str]] = {}
+
+    def owner_of_path(self, path: str) -> Optional[str]:
+        from .rpm import rpm_owner
+
+        return rpm_owner(path)
+
+    def list_manual_packages(self) -> List[str]:
+        from .rpm import list_manual_packages
+
+        return list_manual_packages()
+
+    def installed_packages(self) -> Dict[str, List[Dict[str, str]]]:
+        from .rpm import list_installed_packages
+
+        return list_installed_packages()
+
+    def build_etc_index(self):
+        from .rpm import build_rpm_etc_index
+
+        return build_rpm_etc_index()
+
+    def specific_paths_for_hints(self, hints: Set[str]) -> List[str]:
+        paths: List[str] = []
+        for h in hints:
+            paths.extend(
+                [
+                    f"/etc/sysconfig/{h}",
+                    f"/etc/sysconfig/{h}.conf",
+                    f"/etc/sysctl.d/{h}.conf",
+                ]
+            )
+        return paths
+
+    def _config_files(self, pkg: str) -> Set[str]:
+        if pkg in self._config_cache:
+            return self._config_cache[pkg]
+        from .rpm import rpm_config_files
+
+        s = rpm_config_files(pkg)
+        self._config_cache[pkg] = s
+        return s
+
+    def _modified_files(self, pkg: str) -> Set[str]:
+        if pkg in self._modified_cache:
+            return self._modified_cache[pkg]
+        from .rpm import rpm_modified_files
+
+        s = rpm_modified_files(pkg)
+        self._modified_cache[pkg] = s
+        return s
+
+    def modified_paths(self, pkg: str, etc_paths: List[str]) -> Dict[str, str]:
+        out: Dict[str, str] = {}
+        modified = self._modified_files(pkg)
+        if not modified:
+            return out
+        config = self._config_files(pkg)
+
+        for path in etc_paths:
+            if not path.startswith("/etc/"):
+                continue
+            if self.is_pkg_config_path(path):
+                continue
+            if path not in modified:
+                continue
+            out[path] = (
+                "modified_conffile" if path in config else "modified_packaged_file"
+            )
+        return out
+
+
+def get_backend(info: Optional[PlatformInfo] = None) -> PackageBackend:
+    info = info or detect_platform()
+    if info.pkg_backend == "dpkg":
+        return DpkgBackend()
+    if info.pkg_backend == "rpm":
+        return RpmBackend()
+    # Unknown: be conservative and use an rpm backend if rpm exists, otherwise dpkg.
+    if shutil.which("rpm"):
+        return RpmBackend()
+    return DpkgBackend()

enroll/remote.py

@@ -1,13 +1,183 @@
 from __future__ import annotations
 
+import getpass
 import os
+import shlex
 import shutil
+import sys
+import time
 import tarfile
 import tempfile
 import zipapp
 from pathlib import Path
 from pathlib import PurePosixPath
-from typing import Optional
+from typing import Optional, Callable, TextIO
+
+
+class RemoteSudoPasswordRequired(RuntimeError):
+    """Raised when sudo requires a password but none was provided."""
+
+
+class RemoteSSHKeyPassphraseRequired(RuntimeError):
+    """Raised when SSH private key decryption needs a passphrase."""
+
+
+def _sudo_password_required(out: str, err: str) -> bool:
+    """Return True if sudo output indicates it needs a password/TTY."""
+    blob = (out + "\n" + err).lower()
+    patterns = (
+        "a password is required",
+        "password is required",
+        "a terminal is required to read the password",
+        "no tty present and no askpass program specified",
+        "must have a tty to run sudo",
+        "sudo: sorry, you must have a tty",
+        "askpass",
+    )
+    return any(p in blob for p in patterns)
+
+
+def _sudo_not_permitted(out: str, err: str) -> bool:
+    """Return True if sudo output indicates the user cannot sudo at all."""
+    blob = (out + "\n" + err).lower()
+    patterns = (
+        "is not in the sudoers file",
+        "not allowed to execute",
+        "may not run sudo",
+        "sorry, user",
+    )
+    return any(p in blob for p in patterns)
+
+
+def _sudo_tty_required(out: str, err: str) -> bool:
+    """Return True if sudo output indicates it requires a TTY (sudoers requiretty)."""
+    blob = (out + "\n" + err).lower()
+    patterns = (
+        "must have a tty",
+        "sorry, you must have a tty",
+        "sudo: sorry, you must have a tty",
+        "must have a tty to run sudo",
+    )
+    return any(p in blob for p in patterns)
+
+
+def _resolve_become_password(
+    ask_become_pass: bool,
+    *,
+    prompt: str = "sudo password: ",
+    getpass_fn: Callable[[str], str] = getpass.getpass,
+) -> Optional[str]:
+    if ask_become_pass:
+        return getpass_fn(prompt)
+    return None
+
+
+def _resolve_ssh_key_passphrase(
+    ask_key_passphrase: bool,
+    *,
+    env_var: Optional[str] = None,
+    prompt: str = "SSH key passphrase: ",
+    getpass_fn: Callable[[str], str] = getpass.getpass,
+) -> Optional[str]:
+    """Resolve SSH private-key passphrase from env and/or prompt.
+
+    Precedence:
+      1) --ssh-key-passphrase-env style input (env_var)
+      2) --ask-key-passphrase style interactive prompt
+      3) None
+    """
+    if env_var:
+        val = os.environ.get(str(env_var))
+        if val is None:
+            raise RuntimeError(
+                "SSH key passphrase environment variable is not set: " f"{env_var}"
+            )
+        return val
+
+    if ask_key_passphrase:
+        return getpass_fn(prompt)
+
+    return None
+
+
+def remote_harvest(
+    *,
+    ask_become_pass: bool = False,
+    ask_key_passphrase: bool = False,
+    ssh_key_passphrase_env: Optional[str] = None,
+    no_sudo: bool = False,
+    prompt: str = "sudo password: ",
+    key_prompt: str = "SSH key passphrase: ",
+    getpass_fn: Optional[Callable[[str], str]] = None,
+    stdin: Optional[TextIO] = None,
+    **kwargs,
+):
+    """Call _remote_harvest, with a safe sudo password fallback.
+
+    Behavior:
+      - Run without a password unless --ask-become-pass is set.
+      - If the remote sudo policy requires a password and none was provided,
+        prompt and retry when running interactively.
+    """
+
+    # Resolve defaults at call time (easier to test/monkeypatch, and avoids capturing
+    # sys.stdin / getpass.getpass at import time).
+    if getpass_fn is None:
+        getpass_fn = getpass.getpass
+    if stdin is None:
+        stdin = sys.stdin
+
+    sudo_password = _resolve_become_password(
+        ask_become_pass and not no_sudo,
+        prompt=prompt,
+        getpass_fn=getpass_fn,
+    )
+    ssh_key_passphrase = _resolve_ssh_key_passphrase(
+        ask_key_passphrase,
+        env_var=ssh_key_passphrase_env,
+        prompt=key_prompt,
+        getpass_fn=getpass_fn,
+    )
+
+    while True:
+        try:
+            return _remote_harvest(
+                sudo_password=sudo_password,
+                no_sudo=no_sudo,
+                ssh_key_passphrase=ssh_key_passphrase,
+                **kwargs,
+            )
+        except RemoteSSHKeyPassphraseRequired:
+            # Already tried a passphrase and still failed.
+            if ssh_key_passphrase is not None:
+                raise RemoteSSHKeyPassphraseRequired(
+                    "SSH private key could not be decrypted with the supplied "
+                    "passphrase."
+                ) from None
+
+            # Fallback prompt if interactive.
+            if stdin is not None and getattr(stdin, "isatty", lambda: False)():
+                ssh_key_passphrase = getpass_fn(key_prompt)
+                continue
+
+            raise RemoteSSHKeyPassphraseRequired(
+                "SSH private key is encrypted and needs a passphrase. "
+                "Re-run with --ask-key-passphrase or "
+                "--ssh-key-passphrase-env VAR."
+            )
+
+        except RemoteSudoPasswordRequired:
+            if sudo_password is not None:
+                raise
+
+            # Fallback prompt if interactive.
+            if stdin is not None and getattr(stdin, "isatty", lambda: False)():
+                sudo_password = getpass_fn(prompt)
+                continue
+
+            raise RemoteSudoPasswordRequired(
+                "Remote sudo requires a password. Re-run with --ask-become-pass."
+            )
 
 
 def _safe_extract_tar(tar: tarfile.TarFile, dest: Path) -> None:
@@ -15,7 +185,6 @@ def _safe_extract_tar(tar: tarfile.TarFile, dest: Path) -> None:
 
     Protects against path traversal (e.g. entries containing ../).
     """
-
     # Note: tar member names use POSIX separators regardless of platform.
     dest = dest.resolve()
 
@@ -79,30 +248,169 @@ def _build_enroll_pyz(tmpdir: Path) -> Path:
     return pyz_path
 
 
-def _ssh_run(ssh, cmd: str) -> tuple[int, str, str]:
-    """Run a command over a Paramiko SSHClient."""
-    _stdin, stdout, stderr = ssh.exec_command(cmd)
-    out = stdout.read().decode("utf-8", errors="replace")
-    err = stderr.read().decode("utf-8", errors="replace")
-    rc = stdout.channel.recv_exit_status()
+def _ssh_run(
+    ssh,
+    cmd: str,
+    *,
+    get_pty: bool = False,
+    stdin_text: Optional[str] = None,
+    close_stdin: bool = False,
+) -> tuple[int, str, str]:
+    """Run a command over a Paramiko SSHClient.
+
+    Paramiko's exec_command runs commands without a TTY by default.
+    Some hosts have sudoers "requiretty" enabled, which causes sudo to
+    fail even when passwordless sudo is configured. For those commands,
+    request a PTY.
+
+    We do not request a PTY for commands that stream binary data
+    (e.g. tar/gzip output), as a PTY can corrupt the byte stream.
+    """
+    stdin, stdout, stderr = ssh.exec_command(cmd, get_pty=get_pty)
+    # All three file-like objects share the same underlying Channel.
+    chan = stdout.channel
+
+    if stdin_text is not None and stdin is not None:
+        try:
+            stdin.write(stdin_text)
+            stdin.flush()
+        except Exception:
+            # If the remote side closed stdin early, ignore.
+            pass  # nosec
+        finally:
+            if close_stdin:
+                # For sudo -S, a wrong password causes sudo to re-prompt and wait
+                # forever for more input. We try hard to deliver EOF so sudo can
+                # fail fast.
+                try:
+                    chan.shutdown_write()  # sends EOF to the remote process
+                except Exception:
+                    pass  # nosec
+                try:
+                    stdin.close()
+                except Exception:
+                    pass  # nosec
+
+    # Read incrementally to avoid blocking forever on stdout.read()/stderr.read()
+    # if the remote process is waiting for more input (e.g. sudo password retry).
+    out_chunks: list[bytes] = []
+    err_chunks: list[bytes] = []
+    # Keep a small tail of stderr to detect sudo retry messages without
+    # repeatedly joining potentially large buffers.
+    err_tail = b""
+
+    while True:
+        progressed = False
+        if chan.recv_ready():
+            out_chunks.append(chan.recv(1024 * 64))
+            progressed = True
+        if chan.recv_stderr_ready():
+            chunk = chan.recv_stderr(1024 * 64)
+            err_chunks.append(chunk)
+            err_tail = (err_tail + chunk)[-4096:]
+            progressed = True
+
+        # If we just attempted sudo -S with a single password line and sudo is
+        # asking again, detect it and stop waiting.
+        if close_stdin and stdin_text is not None:
+            blob = err_tail.lower()
+            if b"sorry, try again" in blob or b"incorrect password" in blob:
+                try:
+                    chan.close()
+                except Exception:
+                    pass  # nosec
+                break
+
+        # Exit once the process has exited and we have drained the buffers.
+        if (
+            chan.exit_status_ready()
+            and not chan.recv_ready()
+            and not chan.recv_stderr_ready()
+        ):
+            break
+
+        if not progressed:
+            time.sleep(0.05)
+
+    out = b"".join(out_chunks).decode("utf-8", errors="replace")
+    err = b"".join(err_chunks).decode("utf-8", errors="replace")
+    rc = chan.recv_exit_status() if chan.exit_status_ready() else 1
     return rc, out, err
 
 
-def remote_harvest(
+def _ssh_run_sudo(
+    ssh,
+    cmd: str,
+    *,
+    sudo_password: Optional[str] = None,
+    get_pty: bool = True,
+) -> tuple[int, str, str]:
+    """Run cmd via sudo with a safe non-interactive-first strategy.
+
+    Strategy:
+      1) Try `sudo -n`.
+      2) If sudo reports a password is required and we have one, retry with
+         `sudo -S` and feed it via stdin.
+      3) If sudo reports a password is required and we *don't* have one, raise
+         RemoteSudoPasswordRequired.
+
+    We avoid requesting a PTY unless the remote sudo policy requires it.
+    This makes sudo -S behavior more reliable (wrong passwords fail fast
+    instead of blocking on a PTY).
+    """
+    cmd_n = f"sudo -n -p '' -- {cmd}"
+
+    # First try: never prompt, and prefer no PTY.
+    rc, out, err = _ssh_run(ssh, cmd_n, get_pty=False)
+    need_pty = False
+
+    # Some sudoers configurations require a TTY even for passwordless sudo.
+    if get_pty and rc != 0 and _sudo_tty_required(out, err):
+        need_pty = True
+        rc, out, err = _ssh_run(ssh, cmd_n, get_pty=True)
+
+    if rc == 0:
+        return rc, out, err
+
+    if _sudo_not_permitted(out, err):
+        return rc, out, err
+
+    if _sudo_password_required(out, err):
+        if sudo_password is None:
+            raise RemoteSudoPasswordRequired(
+                "Remote sudo requires a password, but none was provided."
+            )
+        cmd_s = f"sudo -S -p '' -- {cmd}"
+        return _ssh_run(
+            ssh,
+            cmd_s,
+            get_pty=need_pty,
+            stdin_text=str(sudo_password) + "\n",
+            close_stdin=True,
+        )
+
+    return rc, out, err
+
+
+def _remote_harvest(
     *,
     local_out_dir: Path,
     remote_host: str,
-    remote_port: int = 22,
+    remote_port: Optional[int] = None,
     remote_user: Optional[str] = None,
+    remote_ssh_config: Optional[str] = None,
     remote_python: str = "python3",
     dangerous: bool = False,
     no_sudo: bool = False,
+    sudo_password: Optional[str] = None,
+    ssh_key_passphrase: Optional[str] = None,
+    include_paths: Optional[list[str]] = None,
+    exclude_paths: Optional[list[str]] = None,
 ) -> Path:
     """Run enroll harvest on a remote host via SSH and pull the bundle locally.
 
     Returns the local path to state.json inside local_out_dir.
     """
-
     try:
         import paramiko  # type: ignore
     except Exception as e:
@@ -130,13 +438,120 @@ def remote_harvest(
         # Users should add the key to known_hosts.
         ssh.set_missing_host_key_policy(paramiko.RejectPolicy())
 
-        ssh.connect(
-            hostname=remote_host,
-            port=int(remote_port),
-            username=remote_user,
-            allow_agent=True,
-            look_for_keys=True,
-        )
+        # Resolve SSH connection parameters.
+        connect_host = remote_host
+        connect_port = int(remote_port) if remote_port is not None else 22
+        connect_user = remote_user
+        key_filename = None
+        sock = None
+        hostkey_name = connect_host
+
+        # Timeouts derived from ssh_config if set (ConnectTimeout).
+        # Used both for socket connect (when we create one) and Paramiko handshake/auth.
+        connect_timeout: Optional[float] = None
+
+        if remote_ssh_config:
+            from paramiko.config import SSHConfig  # type: ignore
+            from paramiko.proxy import ProxyCommand  # type: ignore
+            import socket as _socket
+
+            cfg_path = Path(str(remote_ssh_config)).expanduser()
+            if not cfg_path.exists():
+                raise RuntimeError(f"SSH config file not found: {cfg_path}")
+
+            cfg = SSHConfig()
+            with cfg_path.open("r", encoding="utf-8") as _fp:
+                cfg.parse(_fp)
+            hcfg = cfg.lookup(remote_host)
+
+            connect_host = str(hcfg.get("hostname") or remote_host)
+            hostkey_name = str(hcfg.get("hostkeyalias") or connect_host)
+
+            if remote_port is None and hcfg.get("port"):
+                try:
+                    connect_port = int(str(hcfg.get("port")))
+                except ValueError:
+                    pass
+            if connect_user is None and hcfg.get("user"):
+                connect_user = str(hcfg.get("user"))
+
+            ident = hcfg.get("identityfile")
+            if ident:
+                if isinstance(ident, (list, tuple)):
+                    key_filename = [str(Path(p).expanduser()) for p in ident]
+                else:
+                    key_filename = str(Path(str(ident)).expanduser())
+
+            # Honour OpenSSH ConnectTimeout (seconds) if present.
+            if hcfg.get("connecttimeout"):
+                try:
+                    connect_timeout = float(str(hcfg.get("connecttimeout")))
+                except (TypeError, ValueError):
+                    connect_timeout = None
+
+            proxycmd = hcfg.get("proxycommand")
+
+            # AddressFamily support: inet (IPv4 only), inet6 (IPv6 only), any (default).
+            addrfam = str(hcfg.get("addressfamily") or "any").strip().lower()
+            family: Optional[int] = None
+            if addrfam == "inet":
+                family = _socket.AF_INET
+            elif addrfam == "inet6":
+                family = _socket.AF_INET6
+
+            if proxycmd:
+                # ProxyCommand provides the transport; AddressFamily doesn't apply here.
+                sock = ProxyCommand(str(proxycmd))
+            elif family is not None:
+                # Enforce the requested address family by pre-connecting the socket and
+                # passing it into Paramiko via sock=.
+                last_err: Optional[OSError] = None
+                infos = _socket.getaddrinfo(
+                    connect_host, connect_port, family, _socket.SOCK_STREAM
+                )
+                for af, socktype, proto, _, sa in infos:
+                    s = _socket.socket(af, socktype, proto)
+                    if connect_timeout is not None:
+                        s.settimeout(connect_timeout)
+                    try:
+                        s.connect(sa)
+                        sock = s
+                        break
+                    except OSError as e:
+                        last_err = e
+                        try:
+                            s.close()
+                        except Exception:
+                            pass  # nosec
+                if sock is None and last_err is not None:
+                    raise last_err
+            elif hostkey_name != connect_host:
+                # If HostKeyAlias is used, connect to HostName via a socket but
+                # use HostKeyAlias for known_hosts lookups.
+                sock = _socket.create_connection(
+                    (connect_host, connect_port), timeout=connect_timeout
+                )
+
+        # If we created a socket (sock!=None), pass hostkey_name as hostname so
+        # known_hosts lookup uses HostKeyAlias (or whatever hostkey_name resolved to).
+        try:
+            ssh.connect(
+                hostname=hostkey_name if sock is not None else connect_host,
+                port=connect_port,
+                username=connect_user,
+                key_filename=key_filename,
+                sock=sock,
+                allow_agent=True,
+                look_for_keys=True,
+                timeout=connect_timeout,
+                banner_timeout=connect_timeout,
+                auth_timeout=connect_timeout,
+                passphrase=ssh_key_passphrase,
+            )
+        except paramiko.PasswordRequiredException as e:  # type: ignore[attr-defined]
+            raise RemoteSSHKeyPassphraseRequired(
+                "SSH private key is encrypted and no passphrase was provided."
+            ) from e
 
         # If no username was explicitly provided, SSH may have selected a default.
         # We need a concrete username for the (sudo) chown step below.
@@ -165,36 +580,59 @@ def remote_harvest(
             sftp.put(str(pyz), rapp)
 
             # Run remote harvest.
-            _cmd = f"{remote_python} {rapp} harvest --out {rbundle}"
+            argv: list[str] = [
+                remote_python,
+                rapp,
+                "harvest",
+                "--out",
+                rbundle,
+            ]
+            if dangerous:
+                argv.append("--dangerous")
+            for p in include_paths or []:
+                argv.extend(["--include-path", str(p)])
+            for p in exclude_paths or []:
+                argv.extend(["--exclude-path", str(p)])
+
+            _cmd = " ".join(map(shlex.quote, argv))
             if not no_sudo:
+                # Prefer non-interactive sudo first; retry with -S only when needed.
+                rc, out, err = _ssh_run_sudo(
+                    ssh, _cmd, sudo_password=sudo_password, get_pty=True
+                )
                 cmd = f"sudo {_cmd}"
             else:
                 cmd = _cmd
-            if dangerous:
-                cmd += " --dangerous"
-            rc, out, err = _ssh_run(ssh, cmd)
+                rc, out, err = _ssh_run(ssh, cmd, get_pty=False)
             if rc != 0:
                 raise RuntimeError(
                     "Remote harvest failed.\n"
                     f"Command: {cmd}\n"
                     f"Exit code: {rc}\n"
+                    f"Stdout: {out.strip()}\n"
                     f"Stderr: {err.strip()}"
                 )
 
             if not no_sudo:
-                # Ensure user can read the files, before we tar it
+                # Ensure user can read the files, before we tar it.
                 if not resolved_user:
                     raise RuntimeError(
                         "Unable to determine remote username for chown. "
                         "Pass --remote-user explicitly or use --no-sudo."
                     )
-                cmd = f"sudo chown -R {resolved_user} {rbundle}"
-                rc, out, err = _ssh_run(ssh, cmd)
+                chown_cmd = f"chown -R {resolved_user} {rbundle}"
+                rc, out, err = _ssh_run_sudo(
+                    ssh,
+                    chown_cmd,
+                    sudo_password=sudo_password,
+                    get_pty=True,
+                )
                 if rc != 0:
                     raise RuntimeError(
                         "chown of harvest failed.\n"
-                        f"Command: {cmd}\n"
+                        f"Command: sudo {chown_cmd}\n"
                         f"Exit code: {rc}\n"
+                        f"Stdout: {out.strip()}\n"
                         f"Stderr: {err.strip()}"
                     )
 

enroll/rpm.py

@@ -0,0 +1,323 @@
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess  # nosec
+from typing import Dict, List, Optional, Set, Tuple
+
+
+def _run(
+    cmd: list[str], *, allow_fail: bool = False, merge_err: bool = False
+) -> tuple[int, str]:
+    """Run a command and return (rc, stdout).
+
+    If merge_err is True, stderr is merged into stdout to preserve ordering.
+    """
+    p = subprocess.run(
+        cmd,
+        check=False,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=(subprocess.STDOUT if merge_err else subprocess.PIPE),
+    )  # nosec
+    out = p.stdout or ""
+    if (not allow_fail) and p.returncode != 0:
+        err = "" if merge_err else (p.stderr or "")
+        raise RuntimeError(f"Command failed: {cmd}\n{err}{out}")
+    return p.returncode, out
+
+
+def rpm_owner(path: str) -> Optional[str]:
+    """Return owning package name for a path, or None if unowned."""
+    if not path:
+        return None
+    rc, out = _run(
+        ["rpm", "-qf", "--qf", "%{NAME}\n", path], allow_fail=True, merge_err=True
+    )
+    if rc != 0:
+        return None
+    for line in out.splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        if "is not owned" in line:
+            return None
+        # With --qf we expect just the package name.
+        if re.match(r"^[A-Za-z0-9_.+:-]+$", line):
+            # Strip any accidental epoch/name-version-release output.
+            return line.split(":", 1)[-1].strip() if line else None
+    return None
+
+
+_ARCH_SUFFIXES = {
+    "noarch",
+    "x86_64",
+    "i686",
+    "aarch64",
+    "armv7hl",
+    "ppc64le",
+    "s390x",
+    "riscv64",
+}
+
+
+def _strip_arch(token: str) -> str:
+    """Strip a trailing .ARCH from a yum/dnf package token."""
+    t = token.strip()
+    if "." not in t:
+        return t
+    head, tail = t.rsplit(".", 1)
+    if tail in _ARCH_SUFFIXES:
+        return head
+    return t
+
+
+def list_manual_packages() -> List[str]:
+    """Return packages considered "user-installed" on RPM-based systems.
+
+    Best-effort:
+      1) dnf repoquery --userinstalled
+      2) dnf history userinstalled
+      3) yum history userinstalled
+
+    If none are available, returns an empty list.
+    """
+
+    def _dedupe(pkgs: List[str]) -> List[str]:
+        return sorted({p for p in (pkgs or []) if p})
+
+    if shutil.which("dnf"):
+        # Prefer a machine-friendly output.
+        for cmd in (
+            ["dnf", "-q", "repoquery", "--userinstalled", "--qf", "%{name}\n"],
+            ["dnf", "-q", "repoquery", "--userinstalled"],
+        ):
+            rc, out = _run(cmd, allow_fail=True, merge_err=True)
+            if rc == 0 and out.strip():
+                pkgs = []
+                for line in out.splitlines():
+                    line = line.strip()
+                    if not line or line.startswith("Loaded plugins"):
+                        continue
+                    pkgs.append(_strip_arch(line.split()[0]))
+                if pkgs:
+                    return _dedupe(pkgs)
+
+        # Fallback
+        rc, out = _run(
+            ["dnf", "-q", "history", "userinstalled"], allow_fail=True, merge_err=True
+        )
+        if rc == 0 and out.strip():
+            pkgs = []
+            for line in out.splitlines():
+                line = line.strip()
+                if not line or line.startswith("Installed") or line.startswith("Last"):
+                    continue
+                # Often: "vim-enhanced.x86_64"
+                tok = line.split()[0]
+                pkgs.append(_strip_arch(tok))
+            if pkgs:
+                return _dedupe(pkgs)
+
+    if shutil.which("yum"):
+        rc, out = _run(
+            ["yum", "-q", "history", "userinstalled"], allow_fail=True, merge_err=True
+        )
+        if rc == 0 and out.strip():
+            pkgs = []
+            for line in out.splitlines():
+                line = line.strip()
+                if (
+                    not line
+                    or line.startswith("Installed")
+                    or line.startswith("Loaded")
+                ):
+                    continue
+                tok = line.split()[0]
+                pkgs.append(_strip_arch(tok))
+            if pkgs:
+                return _dedupe(pkgs)
+
+    return []
+
+
+def list_installed_packages() -> Dict[str, List[Dict[str, str]]]:
+    """Return mapping of installed package name -> installed instances.
+
+    Uses `rpm -qa` and is expected to work on RHEL/Fedora-like systems.
+
+    Output format:
+      {"pkg": [{"version": "...", "arch": "..."}, ...], ...}
+
+    The version string is formatted as:
+      - "<version>-<release>" for typical packages
+      - "<epoch>:<version>-<release>" if a non-zero epoch is present
+    """
+
+    try:
+        _, out = _run(
+            [
+                "rpm",
+                "-qa",
+                "--qf",
+                "%{NAME}\t%{EPOCHNUM}\t%{VERSION}\t%{RELEASE}\t%{ARCH}\n",
+            ],
+            allow_fail=False,
+            merge_err=True,
+        )
+    except Exception:
+        return {}
+
+    pkgs: Dict[str, List[Dict[str, str]]] = {}
+    for raw in (out or "").splitlines():
+        line = raw.strip("\n")
+        if not line:
+            continue
+        parts = line.split("\t")
+        if len(parts) < 5:
+            continue
+        name, epoch, ver, rel, arch = [p.strip() for p in parts[:5]]
+        if not name or not ver:
+            continue
+
+        # Normalise epoch.
+        epoch = epoch.strip()
+        if epoch.lower() in ("(none)", "none", ""):
+            epoch = "0"
+
+        v = f"{ver}-{rel}" if rel else ver
+        if epoch and epoch.isdigit() and epoch != "0":
+            v = f"{epoch}:{v}"
+
+        pkgs.setdefault(name, []).append({"version": v, "arch": arch})
+
+    for k in list(pkgs.keys()):
+        pkgs[k] = sorted(
+            pkgs[k], key=lambda x: (x.get("arch") or "", x.get("version") or "")
+        )
+    return pkgs
+
+
+def _walk_etc_files() -> List[str]:
+    out: List[str] = []
+    for dirpath, _, filenames in os.walk("/etc"):
+        for fn in filenames:
+            p = os.path.join(dirpath, fn)
+            if os.path.islink(p) or not os.path.isfile(p):
+                continue
+            out.append(p)
+    return out
+
+
+def build_rpm_etc_index() -> (
+    Tuple[Set[str], Dict[str, str], Dict[str, Set[str]], Dict[str, List[str]]]
+):
+    """Best-effort equivalent of build_dpkg_etc_index for RPM systems.
+
+    This builds indexes by walking the live /etc tree and querying RPM ownership
+    for each file.
+
+    Returns:
+      owned_etc_paths: set of /etc paths owned by rpm
+      etc_owner_map: /etc/path -> pkg
+      topdir_to_pkgs: "nginx" -> {"nginx", ...} based on /etc/<topdir>/...
+      pkg_to_etc_paths: pkg -> list of owned /etc paths
+    """
+
+    owned: Set[str] = set()
+    owner: Dict[str, str] = {}
+    topdir_to_pkgs: Dict[str, Set[str]] = {}
+    pkg_to_etc: Dict[str, List[str]] = {}
+
+    paths = _walk_etc_files()
+
+    # Query in chunks to avoid excessive process spawns.
+    chunk_size = 250
+
+    not_owned_re = re.compile(
+        r"^file\s+(?P<path>.+?)\s+is\s+not\s+owned\s+by\s+any\s+package", re.IGNORECASE
+    )
+
+    for i in range(0, len(paths), chunk_size):
+        chunk = paths[i : i + chunk_size]
+        rc, out = _run(
+            ["rpm", "-qf", "--qf", "%{NAME}\n", *chunk],
+            allow_fail=True,
+            merge_err=True,
+        )
+
+        lines = [ln.strip() for ln in out.splitlines() if ln.strip()]
+        # Heuristic: rpm prints one output line per input path. If that isn't
+        # true (warnings/errors), fall back to per-file queries for this chunk.
+        if len(lines) != len(chunk):
+            for p in chunk:
+                pkg = rpm_owner(p)
+                if not pkg:
+                    continue
+                owned.add(p)
+                owner.setdefault(p, pkg)
+                pkg_to_etc.setdefault(pkg, []).append(p)
+                parts = p.split("/", 3)
+                if len(parts) >= 3 and parts[2]:
+                    topdir_to_pkgs.setdefault(parts[2], set()).add(pkg)
+            continue
+
+        for pth, line in zip(chunk, lines):
+            if not line:
+                continue
+            if not_owned_re.match(line) or "is not owned" in line:
+                continue
+            pkg = line.split()[0].strip()
+            if not pkg:
+                continue
+            owned.add(pth)
+            owner.setdefault(pth, pkg)
+            pkg_to_etc.setdefault(pkg, []).append(pth)
+            parts = pth.split("/", 3)
+            if len(parts) >= 3 and parts[2]:
+                topdir_to_pkgs.setdefault(parts[2], set()).add(pkg)
+
+    for k, v in list(pkg_to_etc.items()):
+        pkg_to_etc[k] = sorted(set(v))
+
+    return owned, owner, topdir_to_pkgs, pkg_to_etc
+
+
+def rpm_config_files(pkg: str) -> Set[str]:
+    """Return config files for a package (rpm -qc)."""
+    rc, out = _run(["rpm", "-qc", pkg], allow_fail=True, merge_err=True)
+    if rc != 0:
+        return set()
+    files: Set[str] = set()
+    for line in out.splitlines():
+        line = line.strip()
+        if line.startswith("/"):
+            files.add(line)
+    return files
+
+
+def rpm_modified_files(pkg: str) -> Set[str]:
+    """Return files reported as modified by rpm verification (rpm -V).
+
+    rpm -V only prints lines for differences/missing files.
+    """
+    rc, out = _run(["rpm", "-V", pkg], allow_fail=True, merge_err=True)
+    # rc is non-zero when there are differences; we still want the output.
+    files: Set[str] = set()
+    for raw in out.splitlines():
+        line = raw.strip()
+        if not line:
+            continue
+        # Typical forms:
+        #   S.5....T.  c /etc/foo.conf
+        #   missing   /etc/bar
+        m = re.search(r"\s(/\S+)$", line)
+        if m:
+            files.add(m.group(1))
+            continue
+        if line.startswith("missing"):
+            parts = line.split()
+            if parts and parts[-1].startswith("/"):
+                files.add(parts[-1])
+    return files

enroll/schema/__init__.py

@@ -0,0 +1,4 @@
+"""Vendored JSON schemas.
+
+These are used by `enroll validate` so validation can run offline.
+"""

enroll/schema/state.schema.json

@@ -0,0 +1,712 @@
+{
+  "$defs": {
+    "AptConfigSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "role_name": {
+              "const": "apt_config"
+            }
+          },
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "DnfConfigSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "role_name": {
+              "const": "dnf_config"
+            }
+          },
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "EtcCustomSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "role_name": {
+              "const": "etc_custom"
+            }
+          },
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "ExcludedFile": {
+      "additionalProperties": false,
+      "properties": {
+        "path": {
+          "minLength": 1,
+          "pattern": "^/.*",
+          "type": "string"
+        },
+        "reason": {
+          "enum": [
+            "user_excluded",
+            "unreadable",
+	    "backup_file",
+            "log_file",
+            "denied_path",
+            "too_large",
+            "not_regular_file",
+            "not_symlink",
+            "binary_like",
+            "sensitive_content"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "reason"
+      ],
+      "type": "object"
+    },
+    "ExtraPathsSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "exclude_patterns": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "include_patterns": {
+              "items": {
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "role_name": {
+              "const": "extra_paths"
+            }
+          },
+          "required": [
+            "include_patterns",
+            "exclude_patterns"
+          ],
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "InstalledPackageInstance": {
+      "additionalProperties": false,
+      "properties": {
+        "arch": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "version": {
+          "minLength": 1,
+          "type": "string"
+        }
+      },
+      "required": [
+        "version",
+        "arch"
+      ],
+      "type": "object"
+    },
+    "ManagedDir": {
+      "additionalProperties": false,
+      "properties": {
+        "group": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "mode": {
+          "pattern": "^[0-7]{4}$",
+          "type": "string"
+        },
+        "owner": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "path": {
+          "minLength": 1,
+          "pattern": "^/.*",
+          "type": "string"
+        },
+        "reason": {
+          "enum": [
+            "parent_of_managed_file",
+            "user_include_dir"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "owner",
+        "group",
+        "mode",
+        "reason"
+      ],
+      "type": "object"
+    },
+    "ManagedFile": {
+      "additionalProperties": false,
+      "properties": {
+        "group": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "mode": {
+          "pattern": "^[0-7]{4}$",
+          "type": "string"
+        },
+        "owner": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "path": {
+          "minLength": 1,
+          "pattern": "^/.*",
+          "type": "string"
+        },
+        "reason": {
+          "enum": [
+            "apt_config",
+            "apt_keyring",
+            "apt_signed_by_keyring",
+            "apt_source",
+            "authorized_keys",
+            "cron_snippet",
+            "custom_specific_path",
+            "custom_unowned",
+            "dnf_config",
+            "logrotate_snippet",
+            "modified_conffile",
+            "modified_packaged_file",
+            "related_timer",
+            "rpm_gpg_key",
+            "ssh_public_key",
+            "system_cron",
+            "system_firewall",
+            "system_logrotate",
+            "system_modprobe",
+            "system_mounts",
+            "system_network",
+            "system_rc",
+            "system_security",
+            "system_sysctl",
+            "systemd_dropin",
+            "systemd_envfile",
+            "user_include",
+            "user_profile",
+            "user_shell_aliases",
+            "user_shell_logout",
+            "user_shell_rc",
+            "usr_local_bin_script",
+            "usr_local_etc_custom",
+            "yum_conf",
+            "yum_config",
+            "yum_repo"
+          ],
+          "type": "string"
+        },
+        "src_rel": {
+          "minLength": 1,
+          "pattern": "^[^/].*",
+          "type": "string"
+        }
+      },
+      "required": [
+        "path",
+        "src_rel",
+        "owner",
+        "group",
+        "mode",
+        "reason"
+      ],
+      "type": "object"
+    },
+    "ManagedLink": {
+      "additionalProperties": false,
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^/.*"
+        },
+        "target": {
+          "type": "string",
+          "minLength": 1
+        },
+        "reason": {
+          "type": "string",
+          "enum": [
+            "enabled_symlink"
+          ]
+        }
+      },
+      "required": [
+        "path",
+        "target",
+        "reason"
+      ]
+    },
+    "ObservedVia": {
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "user_installed"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "systemd_unit"
+            },
+            "ref": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "ref"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "package_role"
+            },
+            "ref": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "ref"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "PackageInventoryEntry": {
+      "additionalProperties": false,
+      "properties": {
+        "arches": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "installations": {
+          "items": {
+            "$ref": "#/$defs/InstalledPackageInstance"
+          },
+          "type": "array"
+        },
+        "observed_via": {
+          "items": {
+            "$ref": "#/$defs/ObservedVia"
+          },
+          "type": "array"
+        },
+        "roles": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "version": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "version",
+        "arches",
+        "installations",
+        "observed_via",
+        "roles"
+      ],
+      "type": "object"
+    },
+    "PackageSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "package": {
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          "required": [
+            "package"
+          ],
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "RoleCommon": {
+      "properties": {
+        "excluded": {
+          "items": {
+            "$ref": "#/$defs/ExcludedFile"
+          },
+          "type": "array"
+        },
+        "managed_dirs": {
+          "items": {
+            "$ref": "#/$defs/ManagedDir"
+          },
+          "type": "array"
+        },
+        "managed_files": {
+          "items": {
+            "$ref": "#/$defs/ManagedFile"
+          },
+          "type": "array"
+        },
+        "managed_links": {
+          "items": {
+            "$ref": "#/$defs/ManagedLink"
+          },
+          "type": "array"
+        },
+        "notes": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "role_name": {
+          "minLength": 1,
+          "pattern": "^[A-Za-z0-9_]+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "role_name",
+        "managed_dirs",
+        "managed_files",
+        "excluded",
+        "notes"
+      ],
+      "type": "object"
+    },
+    "ServiceSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "active_state": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "condition_result": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "packages": {
+              "items": {
+                "minLength": 1,
+                "type": "string"
+              },
+              "type": "array"
+            },
+            "role_name": {
+              "minLength": 1,
+              "pattern": "^[a-z_][a-z0-9_]*$",
+              "type": "string"
+            },
+            "sub_state": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "unit": {
+              "minLength": 1,
+              "type": "string"
+            },
+            "unit_file_state": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          },
+          "required": [
+            "unit",
+            "packages",
+            "active_state",
+            "sub_state",
+            "unit_file_state",
+            "condition_result"
+          ],
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "UserEntry": {
+      "additionalProperties": false,
+      "properties": {
+        "gecos": {
+          "type": "string"
+        },
+        "gid": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "home": {
+          "type": "string"
+        },
+        "name": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "primary_group": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "shell": {
+          "type": "string"
+        },
+        "supplementary_groups": {
+          "items": {
+            "minLength": 1,
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "uid": {
+          "minimum": 0,
+          "type": "integer"
+        }
+      },
+      "required": [
+        "name",
+        "uid",
+        "gid",
+        "gecos",
+        "home",
+        "shell",
+        "primary_group",
+        "supplementary_groups"
+      ],
+      "type": "object"
+    },
+    "UsersSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "role_name": {
+              "const": "users"
+            },
+            "users": {
+              "items": {
+                "$ref": "#/$defs/UserEntry"
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "users"
+          ],
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    },
+    "UsrLocalCustomSnapshot": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/RoleCommon"
+        },
+        {
+          "properties": {
+            "role_name": {
+              "const": "usr_local_custom"
+            }
+          },
+          "type": "object"
+        }
+      ],
+      "unevaluatedProperties": false
+    }
+  },
+  "$id": "https://enroll.sh/schema/state.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "properties": {
+    "enroll": {
+      "additionalProperties": false,
+      "properties": {
+        "harvest_time": {
+          "minimum": 0,
+          "type": "integer"
+        },
+        "version": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "version",
+        "harvest_time"
+      ],
+      "type": "object"
+    },
+    "host": {
+      "additionalProperties": false,
+      "properties": {
+        "hostname": {
+          "minLength": 1,
+          "type": "string"
+        },
+        "os": {
+          "enum": [
+            "debian",
+            "redhat",
+            "unknown"
+          ],
+          "type": "string"
+        },
+        "os_release": {
+          "additionalProperties": {
+            "type": "string"
+          },
+          "type": "object"
+        },
+        "pkg_backend": {
+          "enum": [
+            "dpkg",
+            "rpm"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "hostname",
+        "os",
+        "pkg_backend",