# Incident Mode

## Module
EvidenceLocker

## Status
IMPLEMENTED

## Description
Incident mode management with state tracking, manager service, and incident notifier for evidence integrity violations.

## Implementation Details
- **Modules**: `src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/Services/`, `src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Core/`
- **Key Classes**:
  - `IncidentModeManager` (`src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.Infrastructure/Services/IncidentModeManager.cs`) - manages incident mode activation, deactivation, and state transitions
  - `EvidenceAuditLogger` (`src/EvidenceLocker/StellaOps.EvidenceLocker/StellaOps.EvidenceLocker.WebService/Audit/EvidenceAuditLogger.cs`) - logs audit events during incident mode
- **Interfaces**: `IIncidentModeState`, `IEvidenceIncidentNotifier`
- **Source**: Feature matrix scan

## E2E Test Plan
- [ ] Activate incident mode via `IncidentModeManager` and verify `IIncidentModeState` reflects the active state
- [ ] Verify `IEvidenceIncidentNotifier` sends notifications when evidence integrity violations are detected
- [ ] Verify incident mode prevents evidence deletion or modification while active
- [ ] Deactivate incident mode and verify normal operations resume
- [ ] Verify `EvidenceAuditLogger` records incident mode activation/deactivation events with timestamps
- [ ] Verify incident mode state persists across service restarts