← All engines · Delivery
Dry-run adapter
stable
v1.0.0 · last updated 2026-06-06 · source: cybercli.delivery.channels.dry_run
§1
What it does
Sink that logs what would-be delivered without actually sending — for smoke tests, new-install validation, and operator dry-runs when adding a new channel and not yet ready to flip it live.
§2
Why you care
The DryRunAdapter is the engine's 'don't actually fire' channel. New installs route every signal here for the first 24 hours so the operator sees what would have fired without paying anyone's pager. Operators ramping a new channel (new Slack webhook, new Pushover destination) point the matrix at dry-run first, watch the audit log, then flip to the real channel when they're confident.
Other AI security tools either ship no dry-run capability (you flip to production blind) or hide the dry-run behind a debug flag (which feels off-label). CyberCLI ships it as a first-class adapter with its own audit-row outcome (`notification_dry_run_logged`) so dry-runs are honestly part of the chain, not invisible.
§3
How it works
On dispatch the adapter does nothing except emit a `notification_dry_run_logged` audit row carrying the would-be channel, the would-be recipient, the full would-be payload, and a marker that this was a dry-run. The dispatcher considers the call a success for purposes of idempotency.
The /delivery matrix supports routing a CYCON to dry-run instead of (or alongside) a real channel. Common pattern: dry-run on all CYCONs for the first day after a new channel is added; gradually replace dry-run with the real channel one CYCON at a time as the operator confirms the format + the destination work.
§4
Configure & observe
Dashboard surfaces
Each CYCON × channel cell offers a 'dry-run' state in addition to enabled/disabled. The matrix-set audit row reflects the choice.
Forensic replay of every would-have-fired notification — useful for tuning the routing matrix before flipping a channel live.
Audit row shape
notification_dry_run_logged parameters.channel: dry_run + parameters.would_be_channel (the real channel this dry-runs for) + the full would-be payload. Treat this as the engine's preview-of-production for the channel matrix.
§5
Status
Stable — the adapter has shipped unchanged since 2026-04-22. The 'dry-run by default for 24h on new install' onboard flow uses it as the safety net so a fresh install never accidentally pages on a misconfigured channel.
How this engine talks to the rest