feat: Add “Dry-Run Mode” for workflows to safely simulate execution without making changes

[Ablaze005]

What problem does this solve?

OpenShield workflows (scanning, remediation, verification, and background work) often interact with cloud resources or generate findings that may trigger remediation actions. However, there is currently no safe way to simulate a workflow end‑to‑end without making actual changes or producing persistent artifacts.

This makes it difficult for developers and contributors to:

• test workflow logic safely,
• validate agent decisions,
• inspect evidence and findings generation,
• debug remediation proposals,
• and iterate on workflow development without impacting real environments.

A safe simulation mode would significantly improve developer experience and reduce risk during testing.

Describe the solution

I propose adding a dry_run=True mode to the workflow execution engine.

When enabled, this mode would:

• execute the workflow normally,
• generate evidence, findings, and proposals in memory,
• log all agent decisions and steps,
• but not apply any remediation actions,
• and not write any persistent artifacts.

This allows contributors and users to safely test workflows, understand execution flow, and debug agent behavior without modifying cloud resources or producing real findings.

Alternatives considered

• Manually mocking workflow components (too complex and inconsistent).
• Running workflows in isolated test environments (requires cloud setup and is not accessible to all contributors).
• Adding debug logs only (does not prevent real actions from being executed).

A built‑in dry‑run mode is the simplest, safest, and most developer‑friendly solution.

Additional context

I am interested in working on this feature and would like to take ownership of the implementation.
Please let me know if there are any preferred architectural patterns or guidelines I should follow before starting.