@aipt/idp-deploy 0.1.2

package/compose/postgresql.yaml

@@ -0,0 +1,62 @@
+services:
+  postgresql:
+    image: ${IDP_POSTGRES_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgresql-superuser-password
+      POSTGRES_INITDB_ARGS: --encoding=UTF8 --auth-host=scram-sha-256 --auth-local=peer
+    secrets:
+      - postgresql-superuser-password
+    volumes:
+      - ${IDP_DATA_DIR}/postgresql:/var/lib/postgresql/data
+    networks:
+      - idp_backend
+    healthcheck:
+      test: [CMD-SHELL, pg_isready --username postgres --dbname postgres]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    stop_grace_period: 60s
+    shm_size: 256mb
+    security_opt:
+      - no-new-privileges:true
+
+  postgresql-bootstrap:
+    image: ${IDP_POSTGRES_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: "no"
+    user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+    environment:
+      POSTGRES_USER: postgres
+      PGHOST: postgresql
+      PGPASSWORD_FILE: /run/idp-secrets/superuser-password
+      POSTGRES_TECH_PASSWORD_FILE: /run/idp-secrets/tech-password
+      POSTGRES_PORTAL_PASSWORD_FILE: /run/idp-secrets/portal-password
+      POSTGRES_SMARTGO_PASSWORD_FILE: /run/idp-secrets/smartgo-password
+    command: [/docker-entrypoint-initdb.d/010-create-databases.sh]
+    volumes:
+      - ../scripts/postgresql/010-create-databases.sh:/docker-entrypoint-initdb.d/010-create-databases.sh:ro
+      - ${IDP_RENDER_DIR}/postgresql-bootstrap:/run/idp-secrets:ro
+    networks:
+      - idp_backend
+    depends_on:
+      postgresql:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - /tmp:size=32m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+secrets:
+  postgresql-superuser-password:
+    file: ${IDP_CONFIG_DIR}/${IDP_POSTGRES_SUPERUSER_PASSWORD_FILE}
+
+networks:
+  idp_backend:
+    internal: true

package/compose/registry.yaml

@@ -0,0 +1,35 @@
+services:
+  registry:
+    image: ${IDP_REGISTRY_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: unless-stopped
+    user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+    environment:
+      VERDACCIO_PORT: "4873"
+    ports:
+      - target: 4873
+        published: "${IDP_REGISTRY_PORT}"
+        host_ip: ${IDP_REGISTRY_BIND}
+        protocol: tcp
+    volumes:
+      - ${IDP_RENDER_DIR}/registry:/verdaccio/conf:ro
+      - ${IDP_DATA_DIR}/registry:/verdaccio/storage
+    networks:
+      - idp_egress
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:4873/-/ping').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 20s
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    init: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+networks:
+  idp_egress: {}

package/compose/smartgo.yaml

@@ -0,0 +1,271 @@
+x-smartgo-runtime: &smartgo-runtime
+  image: ${IDP_SMARTGO_IMAGE}
+  platform: ${IDP_RUNTIME_PLATFORM}
+  restart: unless-stopped
+  user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+  working_dir: /workspace
+  environment:
+    IDP_COMPONENT_CONFIG_DIR: /run/idp-config
+  volumes:
+    - ${IDP_RENDER_DIR}/smartgo:/run/idp-config:ro
+  networks:
+    - idp_backend
+    - idp_egress
+  read_only: true
+  tmpfs:
+    - /tmp:size=256m,mode=1777
+  init: true
+  cap_drop:
+    - ALL
+  security_opt:
+    - no-new-privileges:true
+
+x-smartgo-health: &smartgo-health
+  interval: 15s
+  timeout: 5s
+  retries: 12
+  start_period: 45s
+
+x-smartgo-component-env: &smartgo-component-env
+  IDP_COMPONENT_CONFIG_DIR: /run/idp-config
+  SMARTGO_FIXTURE_ONLY: "true"
+  SMARTGO_ALLOW_FIXTURE_AUTH: "true"
+
+services:
+  edge:
+    ports:
+      - target: ${IDP_SMARTGO_GOTOLOGY_PORT}
+        published: "${IDP_SMARTGO_GOTOLOGY_PORT}"
+        host_ip: ${IDP_HTTP_BIND}
+        protocol: tcp
+      - target: ${IDP_SMARTGO_OPERATIONS_PORT}
+        published: "${IDP_SMARTGO_OPERATIONS_PORT}"
+        host_ip: ${IDP_HTTP_BIND}
+        protocol: tcp
+      - target: ${IDP_SMARTGO_STUDIO_PORT}
+        published: "${IDP_SMARTGO_STUDIO_PORT}"
+        host_ip: ${IDP_HTTP_BIND}
+        protocol: tcp
+
+  smartgo-object-store:
+    image: ${IDP_SMARTGO_OBJECT_STORE_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: unless-stopped
+    user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+    command: [server, /data, --console-address, :9001]
+    environment:
+      MINIO_ROOT_USER_FILE: /run/idp-config/secrets/minio-root-user
+      MINIO_ROOT_PASSWORD_FILE: /run/idp-config/secrets/minio-root-password
+    volumes:
+      - ${IDP_RENDER_DIR}/smartgo:/run/idp-config:ro
+      - ${IDP_DATA_DIR}/smartgo/object-store:/data
+    expose:
+      - "9000"
+    networks:
+      - idp_backend
+    healthcheck:
+      test: [CMD, curl, --fail, --silent, http://127.0.0.1:9000/minio/health/live]
+      <<: *smartgo-health
+      start_period: 20s
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+  smartgo-object-store-init:
+    image: ${IDP_SMARTGO_OBJECT_STORE_CLIENT_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: "no"
+    user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+    entrypoint: [/bin/sh, -ec]
+    environment:
+      MC_CONFIG_DIR: /tmp/.mc
+    command:
+      - |
+        access_key="$$(tr -d '\r\n' < /run/idp-config/secrets/minio-root-user)"
+        secret_key="$$(tr -d '\r\n' < /run/idp-config/secrets/minio-root-password)"
+        mc alias set local http://smartgo-object-store:9000 "$$access_key" "$$secret_key"
+        mc mb --ignore-existing local/smartgo-artifacts
+        mc anonymous set none local/smartgo-artifacts
+        unset access_key secret_key
+    volumes:
+      - ${IDP_RENDER_DIR}/smartgo:/run/idp-config:ro
+    networks:
+      - idp_backend
+    depends_on:
+      smartgo-object-store:
+        condition: service_healthy
+    read_only: true
+    tmpfs:
+      - /tmp:size=32m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+
+  smartgo-migrate:
+    <<: *smartgo-runtime
+    restart: "no"
+    command:
+      - sh
+      - -c
+      - ./packages/persistence/node_modules/.bin/prisma migrate deploy --schema packages/persistence/prisma/schema.prisma && ./packages/persistence/node_modules/.bin/tsx packages/persistence/prisma/bootstrap-reference-catalog.ts && ./packages/persistence/node_modules/.bin/tsx packages/persistence/prisma/seed-business-data.ts
+    depends_on:
+      postgresql-bootstrap:
+        condition: service_completed_successfully
+      smartgo-object-store-init:
+        condition: service_completed_successfully
+
+  smartgo-api:
+    <<: *smartgo-runtime
+    environment:
+      <<: *smartgo-component-env
+      HOST: 0.0.0.0
+      PORT: "3200"
+      ARTIFACT_DELIVERY_PROVIDER: s3
+      ARTIFACT_DELIVERY_S3_PUBLIC_ENDPOINT: http://${IDP_HTTP_BIND}:${IDP_HTTP_PORT}
+      ARTIFACT_DELIVERY_S3_BUCKET: smartgo-artifacts
+      ARTIFACT_DELIVERY_S3_REGION: us-east-1
+      ARTIFACT_DELIVERY_MAX_TTL_SECONDS: "900"
+    command: [node, services/smartgo-api/dist/index.js]
+    expose:
+      - "3200"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3200/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+    depends_on:
+      smartgo-migrate:
+        condition: service_completed_successfully
+
+  smartgo-agent-runtime:
+    <<: *smartgo-runtime
+    environment:
+      <<: *smartgo-component-env
+      HOST: 0.0.0.0
+      PORT: "3400"
+      SMARTGO_API_BASE_URL: http://smartgo-api:3200
+      AGENT_RUNTIME_FIXTURE_MODE: "true"
+      AGENT_RUNTIME_ALLOW_FIXTURE_AUTH: "true"
+      AGENT_RUNTIME_FIXTURE_TENANT_ID: tenant-bnu-primary
+      AGENT_RUNTIME_FIXTURE_SUBJECT: fixture:principal-zhu
+    command: [node, services/agent-runtime/dist/index.js]
+    expose:
+      - "3400"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3400/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+    depends_on:
+      smartgo-api:
+        condition: service_healthy
+
+  smartgo-worker:
+    <<: *smartgo-runtime
+    environment:
+      <<: *smartgo-component-env
+      HOST: 0.0.0.0
+      PORT: "3300"
+      WORKER_DELEGATE_BASE_URL: http://smartgo-api:3200
+      WORKER_TASK_TYPES: ARTIFACT_RENDER
+      WORKER_ARTIFACT_RENDERER: fixture
+      WORKER_ARTIFACT_FIXTURE_ENABLED: "true"
+      WORKER_ARTIFACT_OBJECT_STORE: s3
+      WORKER_ARTIFACT_S3_ENDPOINT: http://smartgo-object-store:9000
+      WORKER_ARTIFACT_S3_BUCKET: smartgo-artifacts
+      WORKER_ARTIFACT_S3_REGION: us-east-1
+      WORKER_ARTIFACT_RESULT_BASE_URL: http://smartgo-api:3200
+    command: [node, services/worker/dist/index.js]
+    expose:
+      - "3300"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3300/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+    depends_on:
+      smartgo-migrate:
+        condition: service_completed_successfully
+      smartgo-api:
+        condition: service_healthy
+
+  smartgo-gotology:
+    <<: *smartgo-runtime
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+      - /workspace/apps/gotology/.artifacts/standalone/apps/gotology/.next/cache:size=128m,uid=${IDP_CONTAINER_UID},gid=${IDP_CONTAINER_GID},mode=0700
+    environment:
+      <<: *smartgo-component-env
+      HOSTNAME: 0.0.0.0
+      PORT: "3000"
+      SMARTGO_API_BASE_URL: http://smartgo-api:3200
+      SMARTGO_WORKER_API_BASE_URL: http://smartgo-worker:3300
+      SMARTGO_PUBLIC_URL: http://${IDP_HTTP_BIND}:${IDP_SMARTGO_GOTOLOGY_PORT}
+      PLATFORM_IDENTITY_ALLOW_INSECURE_LOCALHOST: "true"
+    command: [node, apps/gotology/.artifacts/standalone/server.js]
+    expose:
+      - "3000"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+    depends_on:
+      smartgo-api:
+        condition: service_healthy
+      smartgo-worker:
+        condition: service_healthy
+
+  smartgo-operations:
+    <<: *smartgo-runtime
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+      - /workspace/apps/operations/.artifacts/standalone/apps/operations/.next/cache:size=128m,uid=${IDP_CONTAINER_UID},gid=${IDP_CONTAINER_GID},mode=0700
+    environment:
+      <<: *smartgo-component-env
+      HOSTNAME: 0.0.0.0
+      PORT: "3101"
+      SMARTGO_API_BASE_URL: http://smartgo-api:3200
+      SMARTGO_PUBLIC_URL: http://${IDP_HTTP_BIND}:${IDP_SMARTGO_OPERATIONS_PORT}
+      PLATFORM_IDENTITY_ALLOW_INSECURE_LOCALHOST: "true"
+    command: [node, apps/operations/.artifacts/standalone/server.js]
+    expose:
+      - "3101"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3101/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+    depends_on:
+      smartgo-api:
+        condition: service_healthy
+
+  smartgo-studio:
+    <<: *smartgo-runtime
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+      - /workspace/apps/studio-poc/.artifacts/standalone/apps/studio-poc/.next/cache:size=256m,uid=${IDP_CONTAINER_UID},gid=${IDP_CONTAINER_GID},mode=0700
+      - /run/smartgo/studio:size=256m,uid=${IDP_CONTAINER_UID},gid=${IDP_CONTAINER_GID},mode=0700
+    environment:
+      <<: *smartgo-component-env
+      HOSTNAME: 0.0.0.0
+      PORT: "3002"
+      SMARTGO_API_BASE_URL: http://smartgo-api:3200
+      SMARTGO_WORKER_API_BASE_URL: http://smartgo-worker:3300
+      AGENT_RUNTIME_BASE_URL: http://smartgo-agent-runtime:3400
+      STUDIO_PUBLIC_URL: http://${IDP_HTTP_BIND}:${IDP_SMARTGO_STUDIO_PORT}
+      SMARTGO_STUDIO_STATE_MODE: ephemeral-fixture
+      SMARTGO_STUDIO_DATA_DIRECTORY: /run/smartgo/studio
+      PLATFORM_IDENTITY_ALLOW_INSECURE_LOCALHOST: "true"
+    command: [node, apps/studio-poc/.artifacts/standalone/server.js]
+    expose:
+      - "3002"
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3002/api/health?ready=1').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      <<: *smartgo-health
+      start_period: 60s
+    depends_on:
+      smartgo-api:
+        condition: service_healthy
+      smartgo-worker:
+        condition: service_healthy
+
+networks:
+  idp_backend:
+    internal: true
+  idp_egress: {}

package/compose/tech.yaml

@@ -0,0 +1,64 @@
+services:
+  tech:
+    image: ${IDP_TECH_IMAGE}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: unless-stopped
+    user: ${IDP_CONTAINER_UID}:${IDP_CONTAINER_GID}
+    environment:
+      IDP_COMPONENT_CONFIG_DIR: /run/idp-config
+    volumes:
+      - ${IDP_RENDER_DIR}/tech:/run/idp-config:ro
+    expose:
+      - "3698"
+    networks:
+      - idp_backend
+      - idp_egress
+    depends_on:
+      postgresql-bootstrap:
+        condition: service_completed_successfully
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3698/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 15s
+      timeout: 5s
+      retries: 12
+      start_period: 45s
+    stop_grace_period: 30s
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    init: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  tech-workbench:
+    image: ${IDP_TECH_WORKBENCH_IMAGE:-idp-tech-workbench:local}
+    platform: ${IDP_RUNTIME_PLATFORM}
+    restart: unless-stopped
+    expose:
+      - "3011"
+    networks:
+      - idp_backend
+    depends_on:
+      tech:
+        condition: service_healthy
+    healthcheck:
+      test: [CMD, node, -e, "fetch('http://127.0.0.1:3011/ready').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 15s
+      timeout: 5s
+      retries: 8
+      start_period: 10s
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m,mode=1777
+    init: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+networks:
+  idp_backend:
+    internal: true
+  idp_egress: {}

package/contracts/active-profile.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://idp.internal/contracts/active-profile.v1.schema.json",
+  "title": "IDP Active Profile State v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "status", "profile", "services", "configDigest", "renderDigest", "updatedAt", "digest"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "status": { "enum": ["active", "stopped"] },
+    "profile": { "enum": ["tech-only", "foundation", "core", "portal", "flow", "registry", "full"] },
+    "services": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["postgresql", "registry", "tech", "flow", "portal", "edge"] } },
+    "configDigest": { "$ref": "#/$defs/digest" },
+    "renderDigest": { "$ref": "#/$defs/digest" },
+    "updatedAt": { "type": "string", "format": "date-time" },
+    "digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": { "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }
+}

package/contracts/asset-lifecycle.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:idp-deploy:asset-lifecycle:v1",
+  "title": "idp-deploy asset lifecycle v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "planId", "version", "approvedAt", "immutable", "archiveRoot", "activeComponents", "receipts", "policy", "digest"],
+  "properties": {
+    "schemaVersion": { "const": "idp-deploy.asset-lifecycle/v1" },
+    "planId": { "const": "idp-deploy.bench-deployment-ownership-reception@1" },
+    "version": { "const": 1 },
+    "approvedAt": { "type": "string", "format": "date" },
+    "immutable": { "const": true },
+    "archiveRoot": { "const": "archive" },
+    "activeComponents": { "type": "array", "uniqueItems": true, "items": { "enum": ["postgresql", "registry", "tech", "flow", "portal", "edge"] } },
+    "receipts": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["sourceProject", "sourceAsset", "sourceEvidence", "decision", "targetCapability", "targetPaths", "evidence", "remainingGates"],
+        "properties": {
+          "sourceProject": { "const": "bench" },
+          "sourceAsset": { "type": "string", "minLength": 1 },
+          "sourceEvidence": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+          "decision": { "enum": ["accepted", "replaced", "selectively-received", "deferred"] },
+          "targetCapability": { "type": "string", "minLength": 1 },
+          "targetPaths": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+          "evidence": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+          "remainingGates": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } }
+        }
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtimeCrossRepositorySourceReads", "archiveIncludedInRuntime", "secretsOnlyFromExternalConfigDir", "unapprovedRemoteResources", "portalWriteProxy"],
+      "properties": {
+        "runtimeCrossRepositorySourceReads": { "const": false },
+        "archiveIncludedInRuntime": { "const": false },
+        "secretsOnlyFromExternalConfigDir": { "const": true },
+        "unapprovedRemoteResources": { "const": false },
+        "portalWriteProxy": { "const": false }
+      }
+    },
+    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/contracts/backup-generation.schema.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://idp.internal/contracts/backup-generation.v1.schema.json",
+  "title": "IDP Backup Generation v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "generationId", "profile", "configDigest", "renderDigest", "expectedDatasets", "techBoundary", "files", "createdAt", "manifestDigest"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "generationId": { "type": "string", "pattern": "^[0-9TZ-]+-[0-9a-f]{12}$" },
+    "profile": { "enum": ["tech-only", "foundation", "core", "portal", "flow", "registry", "full"] },
+    "configDigest": { "$ref": "#/$defs/digest" },
+    "renderDigest": { "$ref": "#/$defs/digest" },
+    "manifestDigest": { "$ref": "#/$defs/digest" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "expectedDatasets": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "enum": ["postgresql:tech", "postgresql:backstage", "registry:packages"] }
+    },
+    "techBoundary": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["contract", "file", "size", "fileDigest", "factsDigest"],
+          "properties": {
+            "contract": { "const": "tech.backup-boundary.v1" },
+            "file": { "const": "tech-backup-boundary.json" },
+            "size": { "type": "integer", "minimum": 1 },
+            "fileDigest": { "$ref": "#/$defs/digest" },
+            "factsDigest": { "$ref": "#/$defs/digest" }
+          }
+        }
+      ]
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["dataset", "kind", "file", "size", "digest"],
+        "properties": {
+          "dataset": { "enum": ["postgresql:tech", "postgresql:backstage", "registry:packages"] },
+          "kind": { "enum": ["postgresql", "registry"] },
+          "database": { "enum": ["tech", "backstage"] },
+          "file": { "type": "string", "pattern": "^[^/]+$" },
+          "size": { "type": "integer", "minimum": 1 },
+          "digest": { "$ref": "#/$defs/digest" }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/contracts/component-runtime.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://idp.internal/contracts/component-runtime.v1.schema.json",
+  "title": "IDP Component Runtime Projection v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "profile", "configDigest", "generatedAt", "files", "digest"],
+  "properties": {
+    "schemaVersion": { "const": 1 },
+    "profile": { "enum": ["tech-only", "foundation", "core", "portal", "flow", "registry", "full"] },
+    "configDigest": { "$ref": "#/$defs/digest" },
+    "generatedAt": { "type": "string", "format": "date-time" },
+    "files": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "mode", "size", "digest"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "mode": { "enum": [256, 292] },
+          "size": { "type": "integer", "minimum": 0 },
+          "digest": { "$ref": "#/$defs/digest" }
+        }
+      }
+    },
+    "digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+  }
+}

package/contracts/config-release.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://idp.internal/contracts/config-release.v1.schema.json",
+  "title": "IDP Config Release v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "application", "environmentRef", "reloadMode", "source", "files", "secretBindingDigests", "createdAt", "digest"],
+  "properties": {
+    "schemaVersion": { "const": "idp.config-release/v1" },
+    "application": { "$ref": "#/$defs/name" },
+    "environmentRef": { "$ref": "#/$defs/environmentRef" },
+    "reloadMode": { "enum": ["restart", "watch", "dynamic-provider"] },
+    "source": {
+      "type": "object", "additionalProperties": false, "required": ["kind", "ref", "digest"],
+      "properties": { "kind": { "enum": ["git", "oci", "config-provider"] }, "ref": { "type": "string", "minLength": 1 }, "digest": { "$ref": "#/$defs/digest" } }
+    },
+    "files": {
+      "type": "array",
+      "items": {
+        "type": "object", "additionalProperties": false, "required": ["path", "digest", "sensitive"],
+        "properties": { "path": { "type": "string", "minLength": 1 }, "digest": { "$ref": "#/$defs/digest" }, "sensitive": { "const": false } }
+      }
+    },
+    "secretBindingDigests": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/digest" } },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "digest": { "$ref": "#/$defs/digest" }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" },
+    "name": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,62}$" },
+    "environmentRef": { "type": "string", "pattern": "^environment:[a-z][a-z0-9-]*(?:\\.[a-z0-9-]+)*@v[1-9][0-9]*$" }
+  }
+}