feat(audit): ParentExecutionId filter in the CLI and ManagementService

tests/ScadaLink.CLI.Tests/Commands/AuditQueryCommandTests.cs

@@ -66,6 +66,7 @@ public class AuditQueryCommandTests
             Actor = "multi-role",
             CorrelationId = "abc-123",
             ExecutionId = "def-456",
+            ParentExecutionId = "ghi-789",
             ErrorsOnly = false,
             PageSize = 250,
         };
@@ -83,6 +84,7 @@ public class AuditQueryCommandTests
         Assert.Equal("multi-role", parsed["actor"]);
         Assert.Equal("abc-123", parsed["correlationId"]);
         Assert.Equal("def-456", parsed["executionId"]);
+        Assert.Equal("ghi-789", parsed["parentExecutionId"]);
         Assert.Equal("250", parsed["pageSize"]);
         Assert.Equal("2026-05-20T11:00:00.0000000+00:00", parsed["fromUtc"]);
         Assert.Equal("2026-05-20T12:00:00.0000000+00:00", parsed["toUtc"]);
@@ -159,6 +161,7 @@ public class AuditQueryCommandTests
         Assert.Null(parsed["fromUtc"]);
         Assert.Null(parsed["correlationId"]);
         Assert.Null(parsed["executionId"]);
+        Assert.Null(parsed["parentExecutionId"]);
         Assert.Equal("100", parsed["pageSize"]);
     }
 
@@ -173,6 +176,17 @@ public class AuditQueryCommandTests
         Assert.Equal("11111111-1111-1111-1111-111111111111", parsed["executionId"]);
     }
 
+    [Fact]
+    public void BuildQueryString_ParentExecutionId_EmitsParentExecutionIdParameter()
+    {
+        // --parent-execution-id is a single-value Guid filter — mirrors --execution-id.
+        var now = DateTimeOffset.UtcNow;
+        var args = new AuditQueryArgs { ParentExecutionId = "22222222-2222-2222-2222-222222222222" };
+        var qs = AuditQueryHelpers.BuildQueryString(args, now, null, null);
+        var parsed = HttpUtility.ParseQueryString(qs.TrimStart('?'));
+        Assert.Equal("22222222-2222-2222-2222-222222222222", parsed["parentExecutionId"]);
+    }
+
     // ---- HTTP execution / paging ------------------------------------------
 
     private sealed class RecordingHandler : HttpMessageHandler
@@ -308,6 +322,18 @@ public class AuditQueryCommandTests
         Assert.Empty(parse.Errors);
     }
 
+    [Fact]
+    public void Query_ParentExecutionIdOption_IsAccepted()
+    {
+        // --parent-execution-id is a single-value option — mirrors --execution-id.
+        var root = AuditCommandTestHarness.BuildRoot();
+        var parse = root.Parse(new[]
+        {
+            "audit", "query", "--parent-execution-id", "22222222-2222-2222-2222-222222222222",
+        });
+        Assert.Empty(parse.Errors);
+    }
+
     // ---- Enum-name validation (fast-fail) ----------------------------------
 
     [Fact]

tests/ScadaLink.ManagementService.Tests/AuditEndpointsTests.cs

@@ -460,6 +460,38 @@ public class AuditEndpointsTests
         Assert.Null(filter.ExecutionId);
     }
 
+    [Fact]
+    public void ParseFilter_ParentExecutionId_ParsesIntoSingleValueGuid()
+    {
+        // parentExecutionId is a single-value Guid? filter — mirrors executionId.
+        var parentExecutionId = Guid.NewGuid();
+        var query = new Microsoft.AspNetCore.Http.QueryCollection(
+            new Dictionary<string, Microsoft.Extensions.Primitives.StringValues>
+            {
+                ["parentExecutionId"] = parentExecutionId.ToString(),
+            });
+
+        var filter = AuditEndpoints.ParseFilter(query);
+
+        Assert.Equal(parentExecutionId, filter.ParentExecutionId);
+    }
+
+    [Fact]
+    public void ParseFilter_UnparseableParentExecutionId_IsDroppedSilently()
+    {
+        // Lax-parse contract: an unparseable parentExecutionId is dropped (no 400) —
+        // mirrors the executionId parse.
+        var query = new Microsoft.AspNetCore.Http.QueryCollection(
+            new Dictionary<string, Microsoft.Extensions.Primitives.StringValues>
+            {
+                ["parentExecutionId"] = "not-a-guid",
+            });
+
+        var filter = AuditEndpoints.ParseFilter(query);
+
+        Assert.Null(filter.ParentExecutionId);
+    }
+
     [Fact]
     public async Task Query_RepeatedChannelParams_ReachRepositoryAsMultiValueFilter()
     {