@b00dea/cockpit 0.0.0-stage → 0.1.1

package/dist/registry-resolve/registry.js

@@ -0,0 +1,292 @@
+import { requiresOperatorGate } from '../schema.js';
+// Deliberately wider than the two registries in hand: a `declare -a`/`readonly` prefix, a
+// digit in the array name, and a trailing comment are all ordinary bash that the first
+// version silently failed to recognise — and failing to recognise the opening line produced
+// a clean empty success, which is the worst outcome this module can return.
+const ARRAY_RE = /^\s*(?:(?:declare|readonly|local|export)\s+(?:-\w+\s+)?)?[A-Z][A-Z0-9_]*_SIBLINGS=\(\s*(?:#.*)?$/;
+const ROW_RE = /^\s*"([^"]+)"\s*(?:#.*)?$/;
+const IGNORABLE_RE = /^\s*(?:#.*)?$/;
+// The vocabularies are closed. A word outside them is reported, never mapped to a default:
+// `mount: 'none'` means "the stack never binds this", so quietly choosing it for an
+// unrecognised lane removes a repository from every bring-up — and the old code then stamped
+// that invented value `from: 'read'`, which is the exact inversion of this module's contract.
+const LANE_MOUNT = { app: 'always', host: 'host' };
+const TIER_ACQUIRE = { required: 'auto', auto: 'auto', manual: 'manual', local: 'none' };
+/**
+ * Parse a `*_SIBLINGS=( "a|b|c" ... )` block out of an `env/lib/instance.sh`.
+ *
+ * The dialect is decided by field count, the one signal that is unambiguous. The lane
+ * dialect writes six fields (`slug|dir|remote|lane|var|purpose`); the tier dialect writes
+ * seven, adding `branch` and replacing the fourth-position `lane` with a fifth-position
+ * `tier`. A row of any other width is recorded as skipped rather than bent into shape.
+ */
+export function parseRegistry(source) {
+    const lines = source.split('\n');
+    const rows = [];
+    const unparsed = [];
+    let inside = false;
+    let found = false;
+    let openingLine;
+    let declarationCount = 0;
+    let duplicateOpeningLine;
+    for (const [index, line] of lines.entries()) {
+        if (!inside) {
+            if (ARRAY_RE.test(line)) {
+                inside = true;
+                found = true;
+                openingLine = index + 1;
+                declarationCount += 1;
+                if (declarationCount === 2)
+                    duplicateOpeningLine = index + 1;
+            }
+            continue;
+        }
+        if (/^\s*\)\s*(?:#.*)?$/.test(line)) {
+            inside = false;
+            continue;
+        }
+        const m = ROW_RE.exec(line);
+        if (m && !/[$`\\]/.test(m[1]))
+            rows.push({ line: m[1], sourceLine: index + 1 });
+        else if (!IGNORABLE_RE.test(line)) {
+            const unsupportedShellSyntax = /^\s*"/.test(line) && /[$`\\]/.test(line);
+            unparsed.push({
+                sourceLine: index + 1,
+                reason: unsupportedShellSyntax
+                    ? 'unsupported shell expansion, substitution, or escape in double-quoted row'
+                    : 'not a double-quoted row; single-quoted rows are valid Bash but unsupported',
+            });
+        }
+    }
+    const skipped = [];
+    skipped.push(...unparsed);
+    if (inside) {
+        skipped.push({ sourceLine: openingLine, reason: 'unterminated sibling registry array' });
+        return { found: true, dialect: null, siblings: [], skipped };
+    }
+    if (duplicateOpeningLine !== undefined) {
+        skipped.push({
+            sourceLine: duplicateOpeningLine,
+            reason: 'multiple sibling registry arrays are ambiguous',
+            code: 'REGISTRY_AMBIGUOUS',
+        });
+        return { found: true, dialect: null, siblings: [], skipped };
+    }
+    const parsed = [];
+    for (const { line, sourceLine } of rows) {
+        const fields = line.split('|');
+        if (fields.length === 6 || fields.length === 7)
+            parsed.push({ fields, sourceLine });
+        else
+            skipped.push({ sourceLine, reason: `${fields.length} fields; expected 6 (lane) or 7 (tier)` });
+    }
+    // No opening line at all is a different fact from an empty registry, and both are
+    // different from "every row was malformed". `found` preserves that distinction while
+    // `dialect` remains null until at least one usable row establishes a width.
+    if (!found)
+        return { found: false, dialect: null, siblings: [], skipped };
+    if (parsed.length === 0)
+        return { found: true, dialect: null, siblings: [], skipped };
+    // A registry is written in one dialect. Mixed widths mean the file was hand-edited into
+    // an inconsistent state, and the minority rows are reported rather than reinterpreted.
+    // Plain mode over the widths. A tie is NOT resolved by picking one: with equal counts
+    // there is no minority, and silently discarding half the registry into `skipped` is the
+    // fail-open this module exists to prevent.
+    const counts = new Map();
+    for (const { fields } of parsed)
+        counts.set(fields.length, (counts.get(fields.length) ?? 0) + 1);
+    const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+    if (ranked.length > 1 && ranked[0][1] === ranked[1][1]) {
+        for (const { sourceLine } of parsed) {
+            skipped.push({
+                sourceLine,
+                reason: `ambiguous registry: ${ranked[0][1]} rows of ${ranked[0][0]} fields and ${ranked[1][1]} of ${ranked[1][0]} — no majority dialect`,
+                code: 'REGISTRY_AMBIGUOUS',
+            });
+        }
+        return { found: true, dialect: null, siblings: [], skipped };
+    }
+    const dialectWidth = ranked[0][0];
+    const dialect = dialectWidth === 7 ? 'tier' : 'lane';
+    const siblings = [];
+    const seen = {
+        slug: new Map(),
+        dir: new Map(),
+        var: new Map(),
+    };
+    for (const { fields, sourceLine } of parsed) {
+        if (fields.length !== dialectWidth) {
+            skipped.push({ sourceLine, reason: `${fields.length} fields in a ${dialectWidth}-field registry` });
+            continue;
+        }
+        const row = dialect === 'lane' ? fromLane(fields) : fromTier(fields);
+        if ('reason' in row)
+            skipped.push({ sourceLine, ...row });
+        else {
+            const reason = sourceValidationReason(row);
+            if (reason)
+                skipped.push({ sourceLine, reason });
+            else {
+                const duplicate = ['slug', 'dir', 'var']
+                    .map((field) => ({ field, firstLine: seen[field].get(row[field]) }))
+                    .find(({ firstLine }) => firstLine !== undefined);
+                if (duplicate) {
+                    skipped.push({
+                        sourceLine,
+                        reason: `duplicate ${duplicate.field}; first declared on source line ${duplicate.firstLine}`,
+                    });
+                    continue;
+                }
+                siblings.push(row);
+                for (const field of ['slug', 'dir', 'var'])
+                    seen[field].set(row[field], sourceLine);
+            }
+        }
+    }
+    return { found: true, dialect, siblings, skipped };
+}
+function sourceValidationReason(row) {
+    if (row.acquire.value === 'none' && row.remote !== undefined) {
+        return 'acquire "none" means nothing is ever cloned — remove `remote`';
+    }
+    if (row.acquire.value !== 'none' && !row.remote) {
+        return 'acquire "auto" or "manual" needs a `remote` to clone from';
+    }
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(row.slug)) {
+        return 'invalid slug; expected lowercase letters, digits, and hyphens';
+    }
+    if (!row.dir)
+        return 'invalid dir; expected a non-empty value';
+    if (row.branch !== undefined && !row.branch)
+        return 'invalid branch; expected a non-empty value';
+    if (!/^[A-Z][A-Z0-9_]*$/.test(row.var)) {
+        return 'invalid var; expected an exported shell variable name';
+    }
+    if (!row.purpose)
+        return 'invalid purpose; expected a non-empty value';
+    return undefined;
+}
+/** Lane dialect: `slug|dir|remote|lane|var|purpose`. Both axes read without inference. */
+function fromLane(f) {
+    const [slug, dir, remote, lane, varName, purpose] = f.map((s) => s.trim());
+    const mount = /^profile:[a-z0-9-]+$/.test(lane) ? lane : LANE_MOUNT[lane];
+    if (!mount)
+        return { reason: `unknown lane "${lane}" — expected app, host or profile:<name>` };
+    return {
+        slug,
+        dir,
+        remote,
+        mount: { value: mount, from: 'read' },
+        // Every row in a lane-dialect registry is cloned by setup from its recorded remote;
+        // the dialect has no way to say otherwise, so this is the dialect's meaning, not a guess.
+        acquire: { value: 'auto', from: 'read' },
+        var: varName,
+        purpose,
+    };
+}
+/**
+ * Tier dialect: `slug|dir|remote|branch|tier|var|purpose`.
+ *
+ * `acquire` maps straight off `tier`. `mount` does not exist in this dialect and must be
+ * inferred — a tier says how a checkout arrives, never whether the stack binds it. The
+ * purpose column carries the answer in practice, because a registry that cannot state the
+ * mount tends to write the activating command into the prose instead
+ * (`EXTRA_PROFILES=<name> …`, `make <target> — …`). That is a real signal, but it is prose,
+ * so every value here is marked inferred and printed for confirmation.
+ */
+function fromTier(f) {
+    const [slug, dir, remote, branch, tier, varName, purpose] = f.map((s) => s.trim());
+    const acquire = TIER_ACQUIRE[tier];
+    // Without this the old code mapped a typo to `none`, retained the remote, and the schema
+    // then rejected the row naming `remote` — sending the operator to fix the wrong field.
+    if (!acquire)
+        return { reason: `unknown tier "${tier}" — expected required, auto, manual or local` };
+    const assignments = [...purpose.matchAll(/(?:^|[\s;(])EXTRA_PROFILES=([^\s;)]*)/gi)].map((match) => match[1].toLowerCase());
+    if (assignments.some((assignment) => !/^[a-z0-9-]+$/.test(assignment))) {
+        return {
+            reason: 'ambiguous purpose; EXTRA_PROFILES assignment does not name exactly one profile',
+            code: 'REGISTRY_AMBIGUOUS',
+        };
+    }
+    const profiles = assignments;
+    const uniqueProfiles = [...new Set(profiles)];
+    if (uniqueProfiles.length > 1) {
+        return {
+            reason: 'ambiguous purpose; multiple EXTRA_PROFILES assignments',
+            code: 'REGISTRY_AMBIGUOUS',
+        };
+    }
+    let mount;
+    const profile = uniqueProfiles[0];
+    // Anchored: an unanchored \bmake\b matched ordinary English ("utilities to make sure
+    // the fixtures stay in sync" inferred a host lane on target "sure"), and a false host
+    // lane removes a repository from every bring-up.
+    const makeTarget = /^make\s+([a-z0-9-]+)\b/.exec(purpose);
+    if (tier === 'required') {
+        mount = { value: 'always', from: 'inferred', because: 'tier "required" — the stack bind-mounts it or preflight fails' };
+    }
+    else if (profile) {
+        mount = { value: `profile:${profile}`, from: 'inferred', because: `purpose names EXTRA_PROFILES=${profile}` };
+    }
+    else if (makeTarget) {
+        mount = { value: 'host', from: 'inferred', because: `purpose opens with \`make ${makeTarget[1]}\` — a target, never a compose service` };
+    }
+    else {
+        mount = { value: 'none', from: 'inferred', because: 'no profile and no make target in purpose — read, never mounted' };
+    }
+    return {
+        slug,
+        dir,
+        remote: remote === '-' ? undefined : remote,
+        branch: branch === '-' ? undefined : branch,
+        mount,
+        acquire: { value: acquire, from: tier === 'required' ? 'inferred' : 'read', because: tier === 'required' ? 'tier "required" implies setup clones it' : undefined },
+        var: varName,
+        purpose,
+    };
+}
+/**
+ * Fields a registry draft cannot answer from any existing registry.
+ *
+ * This is deliberately not solved by writing a plausible value. A host lane's reason — a
+ * simulator that cannot be containerised, a renderer that lives in a vendor's cloud — is a
+ * constraint someone discovered, and a generated guess at it is worse than a blank, because
+ * the next reader treats it as established. So a registry draft is a config that is
+ * incomplete *and says which parts*, and the operator answers once.
+ */
+export function gaps(siblings) {
+    const out = [];
+    for (const s of siblings) {
+        if (s.mount.value === 'host') {
+            out.push({
+                slug: s.slug,
+                field: 'host_reason',
+                why: 'no registry dialect records why a repository cannot join the stack',
+                blocking: true,
+            });
+        }
+        // A lane touching live data or local hardware must never run automatically, and no
+        // dialect records that. Left unasked, a draft would be a config in which a lane that
+        // renders against a live third-party store is an ordinary automatic target.
+        if (requiresOperatorGate({ mount: s.mount.value, purpose: s.purpose })) {
+            out.push({
+                slug: s.slug,
+                field: 'gate',
+                why: 'this lane can touch live data or local hardware and must require an operator',
+                blocking: true,
+                fix: 'set gate = "operator" before running this lane',
+            });
+        }
+        // Not asked for a row that is not a repository: it has no install step, and a gap
+        // nobody can answer is noise that degrades the signal of the ones that matter.
+        if (s.acquire.value !== 'none') {
+            out.push({
+                slug: s.slug,
+                field: 'toolchain',
+                why: 'not recorded by any registry dialect; defaults to "none" until confirmed',
+                blocking: false,
+            });
+        }
+    }
+    return out;
+}

package/dist/registry-resolve/render-shell.d.ts

@@ -0,0 +1,18 @@
+export interface ResolvedRegistryShellModel {
+    formatVersion: string;
+    cockpitSourceRevision: string;
+    registrySha256: string;
+    dialect: 'lane' | 'tier';
+    siblingsRoot: string;
+    rows: readonly string[];
+    paths: readonly string[];
+    variables: readonly {
+        name: string;
+        defaultPath: string;
+    }[];
+    adoption: readonly {
+        layer: string;
+        state: string;
+    }[];
+}
+export declare function renderResolvedRegistryShell(model: ResolvedRegistryShellModel): string;

package/dist/registry-resolve/render-shell.js

@@ -0,0 +1,36 @@
+function quote(value) {
+    if (/\0|\r|\n|\$\(|\$\{|`/.test(value)) {
+        throw new Error('REGISTRY_ARTIFACT_UNSAFE: value contains executable or multiline shell syntax');
+    }
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function array(name, values) {
+    return [`${name}=(`, ...values.map((value) => `  ${quote(value)}`), ')'];
+}
+export function renderResolvedRegistryShell(model) {
+    if (model.siblingsRoot.includes('|') ||
+        model.variables.some(({ defaultPath }) => defaultPath.includes('|')) ||
+        model.paths.some((path) => path.split('|').length !== 3) ||
+        model.rows.some((row) => row.split('|').length !== (model.dialect === 'lane' ? 6 : 7)) ||
+        model.adoption.some(({ layer, state }) => layer.includes('|') || state.includes('|'))) {
+        throw new Error('REGISTRY_ARTIFACT_UNSAFE: a field contains the shell record delimiter');
+    }
+    for (const variable of model.variables) {
+        if (!/^[A-Z][A-Z0-9_]*_DIR$/.test(variable.name)) {
+            throw new Error('REGISTRY_VARIABLE_INVALID: expected a namespaced sibling directory variable');
+        }
+    }
+    return [
+        `COCKPIT_REGISTRY_FORMAT=${quote(model.formatVersion)}`,
+        `COCKPIT_SOURCE_REVISION=${quote(model.cockpitSourceRevision)}`,
+        `COCKPIT_REGISTRY_SHA256=${quote(model.registrySha256)}`,
+        `COCKPIT_REGISTRY_DIALECT=${quote(model.dialect)}`,
+        `COCKPIT_SIBLINGS_ROOT=${quote(model.siblingsRoot)}`,
+        ...array('COCKPIT_REGISTRY_ROWS', model.rows),
+        ...array('COCKPIT_SIBLING_PATHS', model.paths),
+        ...array('COCKPIT_SIBLING_VARIABLES', model.variables.map((variable) => `${variable.name}|${variable.defaultPath}`)),
+        ...array('COCKPIT_ADOPTION_STATES', model.adoption.map(({ layer, state }) => `${layer}|${state}`)),
+        ...model.variables.map(({ name, defaultPath }) => `export ${name}=${quote(defaultPath)}`),
+        '',
+    ].join('\n');
+}

package/dist/repair.d.ts

@@ -0,0 +1,29 @@
+import { type ExecutableFix, type FixContext } from './fix-catalogue.js';
+import type { Diagnostic } from './diagnostics.js';
+interface RepairInput {
+    readonly changes: readonly Readonly<{
+        operation: 'write' | 'remove';
+        path: string;
+    }>[];
+    readonly repairAuthority?: Readonly<{
+        kind: 'generated-environment-repair';
+    }>;
+    readonly outcome: Readonly<{
+        diagnostics: readonly Diagnostic[];
+    }>;
+    readonly fixContext: FixContext;
+    readonly repairRefusal?: Readonly<{
+        kind: 'refusal';
+        artifact: null;
+        destination: null;
+        diagnostics: readonly Diagnostic[];
+        result: null;
+        status: 2;
+    }>;
+}
+export declare function proposeGeneratedEnvironmentRepair(currentness: RepairInput): Readonly<{
+    changes: RepairInput['changes'];
+    fixes: readonly ExecutableFix[];
+    refusal: RepairInput['repairRefusal'] | null;
+}>;
+export {};

package/dist/repair.js

@@ -0,0 +1,8 @@
+import { admitDiagnosticFix } from './fix-catalogue.js';
+export function proposeGeneratedEnvironmentRepair(currentness) {
+    const fixes = currentness.repairAuthority ? currentness.outcome.diagnostics.flatMap(diagnostic => {
+        const admitted = admitDiagnosticFix(diagnostic, currentness.fixContext);
+        return admitted ? [admitted] : [];
+    }) : [];
+    return { changes: currentness.changes, fixes, refusal: currentness.repairRefusal ?? null };
+}

package/dist/repository-path.d.ts

@@ -0,0 +1,9 @@
+/** A path or glob (`*`, `?`, `**`), optionally `<slug>:`-prefixed, without `..` segments or a leading `/`. */
+export declare const REPOSITORY_PATH: RegExp;
+/** One file or directory, optionally `<slug>:`-prefixed: no wildcards, no `.` or `..` segments, no leading or trailing `/`. */
+export declare const REPOSITORY_FILE: RegExp;
+/** The sibling a reference names, if any, and the path inside that repository. */
+export declare function splitRepositoryPath(reference: string): Readonly<{
+    slug?: string;
+    path: string;
+}>;

package/dist/repository-path.js

@@ -0,0 +1,16 @@
+// A path in one of a cockpit's repositories: `path` in the cockpit's own, or `<sibling slug>:path` in a
+// sibling. Work-order scopes and sources, the [docs] declarations and every reader of them spell and
+// split it here, so a reference one admits is the reference the other resolves.
+const SLUG = '[a-z0-9][a-z0-9-]{0,63}';
+// Never absolute or climbing. The climbing check looks past the sibling prefix, which would otherwise
+// consume the `:` before `..`.
+/** A path or glob (`*`, `?`, `**`), optionally `<slug>:`-prefixed, without `..` segments or a leading `/`. */
+export const REPOSITORY_PATH = new RegExp(`^(?!(?:${SLUG}:)?(?:.*/)?\\.\\.(?:/|$))(?:${SLUG}:)?(?![/])[A-Za-z0-9._@+\\-/*?]+$`);
+/** One file or directory, optionally `<slug>:`-prefixed: no wildcards, no `.` or `..` segments, no leading or trailing `/`. */
+export const REPOSITORY_FILE = new RegExp(`^(?!(?:${SLUG}:)?(?:.*/)?\\.\\.?(?:/|$))(?:${SLUG}:)?(?![/])[A-Za-z0-9._@+\\-/]*[A-Za-z0-9._@+-]$`);
+const PREFIXED = new RegExp(`^(${SLUG}):(.*)$`);
+/** The sibling a reference names, if any, and the path inside that repository. */
+export function splitRepositoryPath(reference) {
+    const match = PREFIXED.exec(reference);
+    return match ? { slug: match[1], path: match[2] } : { path: reference };
+}

package/dist/schema-json.d.ts

@@ -0,0 +1 @@
+export declare function renderCockpitSchema(): string;

package/dist/schema-json.js

@@ -0,0 +1,177 @@
+import { z } from 'zod';
+import { CockpitConfig, OPERATOR_GATE_RISK_PATTERN, STRUCTURED_INPUT_ENTRY_LIMIT } from './schema.js';
+export function renderCockpitSchema() {
+    const schema = z.toJSONSchema(CockpitConfig, {
+        io: 'input',
+        target: 'draft-04',
+        // Draft 4 has no propertyNames, and Zod drops a record's key schema there, so an editor
+        // accepted any key the loader refuses. Every key must match one pattern property instead.
+        override: ({ zodSchema, jsonSchema }) => {
+            const def = zodSchema._zod.def;
+            if (def.type !== 'record')
+                return;
+            const { type, pattern, maxLength, ...rest } = z.toJSONSchema(def.keyType, { io: 'input', target: 'draft-7' });
+            delete rest.$schema;
+            const value = jsonSchema.additionalProperties;
+            if (type !== 'string' || typeof pattern !== 'string' || Object.keys(rest).length > 0 || maxLength !== undefined && typeof maxLength !== 'number'
+                || value === undefined || typeof value === 'boolean') {
+                throw new Error(`record key schema ${JSON.stringify({ type, pattern, maxLength, ...rest })} has no draft-04 rendering`);
+            }
+            const key = maxLength === undefined ? pattern : `^(?=[\\s\\S]{0,${maxLength}}$)(?:${pattern})`;
+            jsonSchema.patternProperties = { [key]: value };
+            jsonSchema.additionalProperties = false;
+        },
+    });
+    const properties = schema.properties;
+    const sibling = properties.sibling.items;
+    const environment = properties.environment;
+    const environmentProperties = environment.properties;
+    const browser = properties.browser;
+    const browserProperties = browser.properties;
+    const testing = properties.testing;
+    const postureRequirement = environmentProperties.posture_requirements.items;
+    postureRequirement.anyOf = [{ required: ['addressing'] }, { required: ['authentication'] }];
+    for (const field of ['resettable_volumes', 'generated_host_paths', 'compose_files']) {
+        environmentProperties[field].uniqueItems = true;
+    }
+    ;
+    browserProperties.harnesses.uniqueItems = true;
+    const browserProxy = browserProperties.proxy;
+    const browserProxyProperties = browserProxy.properties;
+    browserProxyProperties.allowed_hosts.uniqueItems = true;
+    browser.anyOf = [
+        { properties: { request_preapproval: { enum: [false] } } },
+        { properties: { data: { required: ['mode', 'isolated', 'reaches_production'], properties: {
+                        mode: { enum: ['empty', 'seeded'] }, isolated: { enum: [true] }, reaches_production: { enum: [false] },
+                    } } } },
+    ];
+    testing.oneOf = [
+        { properties: { native_hooks: { properties: { install: { enum: ['inspect'] } } } }, not: { required: ['native_hook_policy'] } },
+        { properties: { native_hooks: { properties: { install: { enum: ['explicit-native'] } }, required: ['install'] } }, required: ['native_hooks', 'native_hook_policy'] },
+    ];
+    sibling.allOf = [
+        {
+            oneOf: [
+                {
+                    properties: { acquire: { enum: ['none'] } },
+                    not: { required: ['remote'] },
+                },
+                {
+                    properties: { acquire: { enum: ['auto', 'manual'] } },
+                    required: ['remote'],
+                },
+            ],
+        },
+        {
+            anyOf: [
+                {
+                    properties: { mount: { enum: ['host'] } },
+                    required: ['host_reason'],
+                },
+                {
+                    properties: { mount: { not: { enum: ['host'] } } },
+                },
+            ],
+        },
+        {
+            anyOf: [
+                {
+                    properties: { gate: { enum: ['operator'] } },
+                    required: ['gate'],
+                },
+                {
+                    not: {
+                        anyOf: [
+                            { properties: { mount: { enum: ['host'] } } },
+                            { properties: { purpose: { pattern: OPERATOR_GATE_RISK_PATTERN } } },
+                        ],
+                    },
+                },
+            ],
+        },
+    ];
+    schema['x-cockpit-runtime-checks'] = [
+        { path: 'sibling[].slug', rule: 'unique' },
+        { path: 'sibling[].dir', rule: 'unique' },
+        { path: 'sibling[].var', rule: 'unique' },
+        { path: 'sibling[].environment_files[].instance', rule: 'unique' },
+        { path: 'environment.resettable_volumes[]', rule: 'unique' },
+        { path: 'environment.resettable_volumes[]', rule: 'declared_compose_volume_key' },
+        { path: 'environment.generated_host_paths[]', rule: 'unique' },
+        { path: 'environment.compose_files[]', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].name', rule: 'unique' },
+        { path: 'environment.install_policies[].toolchain+lockfile', rule: 'unique' },
+        { path: 'environment.posture_requirements[].requirement', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].port', rule: 'declared_in_ports.bases' },
+        { path: 'browser.artifacts', rule: 'exact_environment.generated_host_paths_coverage' },
+        { path: 'browser', rule: 'matches_environment_addressing_authentication_and_client_cap' },
+        { path: 'browser.images', rule: 'mcp_driver_shares_major_minor_with_project_driver' },
+        { path: 'testing.gates[].stages[]', rule: 'references_declared_testing_stage' },
+        { path: 'sibling[].environment_files[]', rule: 'template_and_instance_differ' },
+        { path: 'sibling[].derives.mcp_sources[].path', rule: 'unique_within_sibling' },
+        { path: 'environment.seed', rule: 'requires_resettable_volumes' },
+        {
+            path: 'ports',
+            rule: 'count_times_base_count_within_shared_input_budget',
+            limit: STRUCTURED_INPUT_ENTRY_LIMIT,
+        },
+        { path: 'surfaces.overlays[].name', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources[].path', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources', rule: 'feature_namespace_and_complete_skill_definitions' },
+        { path: 'surfaces.overlays[].sources[].bytes', rule: 'utf8_byte_length_at_most_65536' },
+        { path: 'surfaces.overlays[].replaces.name', rule: 'matches_declaration_name' },
+        { path: 'surfaces.harnesses[].name', rule: 'unique' },
+        { path: 'surfaces.harnesses[].capabilities', rule: 'one_row_per_surface_feature' },
+        { path: 'surfaces.harnesses[].capabilities[].spelling', rule: 'unique_when_emitted' },
+        { path: 'surfaces.adopted[].path', rule: 'unique' },
+        { path: 'surfaces.adopted[].source', rule: 'equals_cockpit/adopted/<path>' },
+        { path: 'surfaces.adopted[].provenance.kind', rule: 'declared' },
+    ];
+    schema['x-cockpit-editor-limitations'] = [
+        { path: 'sibling[].environment_files[].instance', rule: 'unique' },
+        { path: 'sibling[].environment_files[]', rule: 'template_and_instance_differ' },
+        { path: 'sibling[].derives.mcp_sources[].path', rule: 'unique_within_sibling' },
+        { path: 'environment.seed', rule: 'requires_resettable_volumes' },
+        { path: 'environment.entrypoint_derivatives[].name', rule: 'unique' },
+        { path: 'environment.entrypoint_derivatives[].port', rule: 'declared_in_ports.bases' },
+        { path: 'environment.install_policies[].toolchain+lockfile', rule: 'unique' },
+        { path: 'environment.posture_requirements[].requirement', rule: 'unique' },
+        { path: 'browser.artifacts', rule: 'exact_environment.generated_host_paths_coverage' },
+        { path: 'browser', rule: 'matches_environment_addressing_authentication_and_client_cap' },
+        { path: 'browser.images', rule: 'mcp_driver_shares_major_minor_with_project_driver' },
+        { path: 'testing.gates[].stages[]', rule: 'references_declared_testing_stage' },
+        { path: 'surfaces.overlays[].name', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources[].path', rule: 'unique' },
+        { path: 'surfaces.overlays[].sources', rule: 'feature_namespace_and_complete_skill_definitions' },
+        { path: 'surfaces.overlays[].sources[].bytes', rule: 'utf8_byte_length_at_most_65536' },
+        { path: 'surfaces.overlays[].replaces.name', rule: 'matches_declaration_name' },
+        { path: 'surfaces.harnesses[].name', rule: 'unique' },
+        { path: 'surfaces.harnesses[].capabilities', rule: 'one_row_per_surface_feature' },
+        { path: 'surfaces.harnesses[].capabilities[].spelling', rule: 'unique_when_emitted' },
+        { path: 'surfaces.adopted[].path', rule: 'unique' },
+        { path: 'surfaces.adopted[].source', rule: 'equals_cockpit/adopted/<path>' },
+        { path: 'surfaces.adopted[].provenance.kind', rule: 'declared' },
+    ];
+    // Found by shape, so every table that embeds a provenance carries the rule, wherever it sits.
+    const requireProvenanceEvidence = (node) => {
+        const fields = node.properties;
+        if (fields?.observed_on && fields.kind && fields.source) {
+            node.anyOf = [
+                { properties: { kind: { enum: ['declared'] } } },
+                { properties: { kind: { enum: ['measured'] } }, required: ['observed_on'] },
+                { properties: { kind: { enum: ['inferred'] }, confirmed: { enum: [true] } }, required: ['confirmed', 'observed_on'] },
+            ];
+        }
+        for (const value of Object.values(node)) {
+            if (Array.isArray(value))
+                for (const entry of value) {
+                    if (entry !== null && typeof entry === 'object')
+                        requireProvenanceEvidence(entry);
+                }
+            else if (value !== null && typeof value === 'object')
+                requireProvenanceEvidence(value);
+        }
+    };
+    requireProvenanceEvidence(schema);
+    return `${JSON.stringify(schema, null, 2)}\n`;
+}