Baseline capture

--baseline <file> captures the current state of a system as a golden reference and writes it in the exact norm config schema that --cfg consumes, so it round-trips:

delta --baseline golden.json                      # capture known-good state
delta --processes --ports --cfg golden.json --json # later: detect drift

Any deviation — a process now running but not in the baseline, a newly opened port, a changed mount or filesystem type — is reported as a violation. Pass - to write the baseline to stdout. No policy checks run in this mode.

In baseline mode Delta collects all domains (processes, ports, packages, network, mounts; fingerprints when --fingerprint is given) regardless of the per-domain flags, so the reference is complete.

What gets captured

Domain	Captured
Processes	processes[] (name; CPU bounds left permissive — a baseline matches by name).
Ports	ports[] (port, protocol, state for TCP, owning process).
Mounts	file_systems.verify_filesystems[] (fstype + exact root) and paths.allow[].
Files	files[] (image-relative path + csum + mode/uid/ gid/caps), only with --fingerprint.
Packages	packages[] (name + version).
Network	netifs[] (name/promisc/mac/mtu), routes[], neighbors[].

other_*_present are emitted as false: a baseline is strict by construction — only what was observed is allowed, so anything new is drift.

Editing a baseline

The output is an ordinary config and is meant to be hand-edited as policy — for example to relax a too-specific entry, drop a transient process/port, set an other_*_present back to true to enforce only a subset, or pin a single security property (e.g. "promisc": false on every interface). See Configuration.

Notes

• Point-in-time. Transient processes/connections present at capture become part of the allowed set; capture on a quiesced system or prune the result.

• Capturing an image — --baseline honors --root (see Offline image analysis).

• Drift over time and across a fleet build on the same data — see Continuous monitoring and Fleet / cohort analysis.