from openrtc import AgentPool

def to_siem(event):
    siem_client.put(event.to_dict())   # a flat, JSON-serializable record

pool = AgentPool(
    agent=MyAgent,
    deployment_version="v2.0.0",
    audit_sink=to_siem,
)

-- Every deploy and rollback in the last 30 days, newest first.
SELECT timestamp, event, version, actor
FROM audit
WHERE event IN ('deployment.started', 'deployment.completed', 'deployment.rolled_back')
  AND timestamp > now() - interval '30 days'
ORDER BY timestamp DESC;

-- Rollbacks and their stated reason (incident review).
SELECT timestamp, version AS rolled_back_to, from_version AS rolled_back_from, reason, actor
FROM audit
WHERE event = 'deployment.rolled_back';

-- Sequence-gap check: a missing seq means a dropped or reordered event.
SELECT seq
FROM audit
WHERE seq NOT IN (SELECT seq - 1 FROM audit)   -- adapt to your window function
ORDER BY seq;

-- Workers that rejected jobs while draining (expected during a deploy; a spike
-- outside a deploy window is worth an alert).
SELECT timestamp, target AS worker, version
FROM audit
WHERE event = 'worker.rejected';

from openrtc.core.membership import sign_membership, MembershipVerifier

# On the worker, at registration:
token = sign_membership(
    version="v2.0.0", worker_id="w-1", timestamp=now, secret=SECRET,
)

# On the coordinator, before granting traffic:
verifier = MembershipVerifier(secrets=[SECRET], expected_version="v2.0.0")
verifier.verify(token=token, version="v2.0.0", worker_id="w-1", timestamp=now)
# raises MembershipError if the version is wrong, the timestamp is stale or from
# the future (replay protection), or the signature is invalid (constant-time compare).