@dynamicalsystems/idl 0.12.0 → 0.13.0

package/src/organization/release.v1.ts

@@ -0,0 +1,403 @@
+// dsg.organization.release/1
+// Semantic bodies and installation observations are separate documents.
+import { type Static, Type } from "@sinclair/typebox";
+import {
+  closed,
+  Hex64,
+  NonEmptyString,
+  Orn,
+  Reference,
+  SafeInt,
+  UtcSecond,
+  type ProfileEntry,
+} from "../primitives.js";
+import { ExtensionComponentKindSchema } from "../extension/release.v1.js";
+
+export const ORGANIZATION_RELEASE_PROFILE = "dsg.organization.release/1" as const;
+export const ORGANIZATION_RELEASE_CANONICALIZATION = "RFC8785-JCS-UTF8" as const;
+const Identifier = Type.String({ pattern: "^[a-z][a-z0-9-]*(?:[.-][a-z0-9]+)*$" });
+const Revision = Type.String({ pattern: "^(?:[0-9a-f]{40}|[0-9a-f]{64})$" });
+const Identifiers = () => Type.Array(Identifier, { uniqueItems: true });
+const References = () => Type.Array(Reference, { uniqueItems: true });
+const Evidence = () => Type.Array(Reference, { minItems: 1, uniqueItems: true });
+const Header = {
+  profile: Type.Literal(ORGANIZATION_RELEASE_PROFILE),
+  schemaVersion: Type.Literal(1),
+};
+
+export const CompilerContractSchema = closed({
+  profile: Type.String({ pattern: "^dsg\\.[a-z0-9.-]+/[1-9][0-9]*$" }),
+  version: Type.String({ pattern: "^(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)$" }),
+  implementation: Reference,
+});
+export type CompilerContract = Static<typeof CompilerContractSchema>;
+export const DependencyKindSchema = Type.Union([
+  Type.Literal("extension-release"),
+  Type.Literal("component"),
+  Type.Literal("idl-package"),
+  Type.Literal("module-release"),
+  Type.Literal("law-release"),
+  Type.Literal("definition"),
+  Type.Literal("workload-artifact"),
+  Type.Literal("event-catalog"),
+  Type.Literal("example"),
+  Type.Literal("project"),
+  Type.Literal("target"),
+]);
+export type DependencyKind = Static<typeof DependencyKindSchema>;
+export const DependencyLockEntrySchema = closed({
+  id: Identifier,
+  kind: DependencyKindSchema,
+  reference: Reference,
+  mediaType: NonEmptyString,
+  selectedMemberIds: Identifiers(),
+  dependsOn: Identifiers(),
+});
+export type DependencyLockEntry = Static<typeof DependencyLockEntrySchema>;
+// Entries and their dependency IDs are sorted. The closure is exactly the graph
+// reachable from roots; graph validation is a consumer obligation, not uniqueItems.
+export const DependencyLockSchema = closed({
+  ...Header,
+  kind: Type.Literal("dependency-lock"),
+  canonicalization: Type.Literal(ORGANIZATION_RELEASE_CANONICALIZATION),
+  roots: Identifiers(),
+  entries: Type.Array(DependencyLockEntrySchema, { uniqueItems: true }),
+  compiler: CompilerContractSchema,
+});
+export type DependencyLock = Static<typeof DependencyLockSchema>;
+
+export const OrganizationReleaseMemberKindSchema = Type.Union([
+  Type.Literal("publication"),
+  Type.Literal("import"),
+  Type.Literal("capability-admission"),
+  Type.Literal("workflow-publication"),
+  Type.Literal("contract-check"),
+  Type.Literal("target-readiness"),
+  Type.Literal("setup-condition"),
+  Type.Literal("paid-execution-readiness"),
+]);
+export type OrganizationReleaseMemberKind = Static<typeof OrganizationReleaseMemberKindSchema>;
+export const OrganizationReleaseMemberSchema = closed({
+  id: Identifier,
+  kind: OrganizationReleaseMemberKindSchema,
+  required: Type.Boolean(),
+  acceptableDispositions: Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true }),
+  subject: Reference,
+});
+export type OrganizationReleaseMember = Static<typeof OrganizationReleaseMemberSchema>;
+export const ComponentBindingSchema = closed({
+  id: Identifier,
+  kind: ExtensionComponentKindSchema,
+  reference: Reference,
+});
+export type ComponentBinding = Static<typeof ComponentBindingSchema>;
+export const BuildSelectionSchema = closed({
+  id: Identifier,
+  selection: Reference,
+  extensionRelease: Reference,
+  members: Type.Array(ComponentBindingSchema, { minItems: 1, uniqueItems: true }),
+});
+export type BuildSelection = Static<typeof BuildSelectionSchema>;
+export const BuildComponentSchema = closed({
+  extensionRelease: Reference,
+  memberId: Identifier,
+  kind: ExtensionComponentKindSchema,
+  reference: Reference,
+  mediaType: NonEmptyString,
+});
+export type BuildComponent = Static<typeof BuildComponentSchema>;
+export const OrganizationBuildSchema = closed({
+  ...Header,
+  kind: Type.Literal("organization-build"),
+  organization: NonEmptyString,
+  canonicalization: Type.Literal(ORGANIZATION_RELEASE_CANONICALIZATION),
+  source: closed({ root: Reference, revision: Revision }),
+  facts: closed({ name: NonEmptyString, purpose: NonEmptyString, space: NonEmptyString }),
+  workspaceProfile: Reference,
+  projects: Type.Array(closed({ id: Identifier, membership: Reference, revision: Revision }), {
+    uniqueItems: true,
+  }),
+  sourceDocuments: Type.Array(
+    closed({ path: NonEmptyString, sha256: Hex64, mediaType: NonEmptyString }),
+    { minItems: 1, uniqueItems: true },
+  ),
+  selections: Type.Array(BuildSelectionSchema, { uniqueItems: true }),
+  components: Type.Array(BuildComponentSchema, { uniqueItems: true }),
+  typedReleases: Type.Array(DependencyLockEntrySchema, { uniqueItems: true }),
+  dependencyLock: Reference,
+  compiler: CompilerContractSchema,
+  instructions: References(),
+  handling: References(),
+  releaseDeclarations: References(),
+  releaseMembers: Type.Array(OrganizationReleaseMemberSchema, { uniqueItems: true }),
+});
+export type OrganizationBuild = Static<typeof OrganizationBuildSchema>;
+// No self-reference or status: activation and supersession are record state.
+export const OrganizationReleaseSchema = closed({
+  ...Header,
+  kind: Type.Literal("organization-release"),
+  id: Identifier,
+  organization: NonEmptyString,
+  build: Reference,
+  dependencyLock: Reference,
+  selections: Identifiers(),
+  members: Type.Array(OrganizationReleaseMemberSchema, { minItems: 1, uniqueItems: true }),
+});
+export type OrganizationRelease = Static<typeof OrganizationReleaseSchema>;
+
+const ImportCommon = {
+  ...Header,
+  kind: Type.Literal("import-disposition"),
+  installation: Orn,
+  build: Reference,
+  release: Reference,
+  subject: Reference,
+  observedAt: UtcSecond,
+};
+export const ImportDispositionSchema = Type.Union([
+  closed({ ...ImportCommon, status: Type.Literal("pending") }),
+  closed({
+    ...ImportCommon,
+    status: Type.Literal("verified"),
+    disposition: Type.Union([Type.Literal("published"), Type.Literal("digest-match")]),
+    evidence: Evidence(),
+  }),
+  closed({
+    ...ImportCommon,
+    status: Type.Literal("staged"),
+    disposition: Type.Literal("captured"),
+    evidence: Evidence(),
+  }),
+  closed({
+    ...ImportCommon,
+    status: Type.Literal("refused"),
+    disposition: Type.Union([
+      Type.Literal("digest-mismatch"),
+      Type.Literal("missing"),
+      Type.Literal("unsupported"),
+    ]),
+    reason: NonEmptyString,
+    evidence: Evidence(),
+  }),
+]);
+export type ImportDisposition = Static<typeof ImportDispositionSchema>;
+export const ReleaseStatusSchema = Type.Union([
+  Type.Literal("active"),
+  Type.Literal("retired"),
+  Type.Literal("revoked"),
+]);
+export type ReleaseStatus = Static<typeof ReleaseStatusSchema>;
+export const ReleaseStatusObservationSchema = closed({
+  ...Header,
+  kind: Type.Literal("release-status-observation"),
+  subject: Reference,
+  registry: Reference,
+  trustView: Reference,
+  status: ReleaseStatusSchema,
+  effectiveAt: UtcSecond,
+  observedAt: UtcSecond,
+  evidence: Evidence(),
+});
+export type ReleaseStatusObservation = Static<typeof ReleaseStatusObservationSchema>;
+// A status evaluation pins both the observation and the consumer's current trust
+// input. Retirement permits existing active execution; revocation never does.
+export const ReleaseEligibilitySchema = closed({
+  ...Header,
+  kind: Type.Literal("release-eligibility"),
+  release: Reference,
+  operation: Type.Union([
+    Type.Literal("resolve"),
+    Type.Literal("select"),
+    Type.Literal("import"),
+    Type.Literal("admit"),
+    Type.Literal("activate"),
+    Type.Literal("execute"),
+  ]),
+  observation: ReleaseStatusObservationSchema,
+  trustView: Reference,
+  activeSet: Type.Union([Reference, Type.Null()]),
+});
+export type ReleaseEligibility = Static<typeof ReleaseEligibilitySchema>;
+export const ApprovedUseSchema = closed({ use: NonEmptyString, binding: Reference });
+export type ApprovedUse = Static<typeof ApprovedUseSchema>;
+const AdmissionCommon = {
+  ...Header,
+  kind: Type.Literal("admission-record"),
+  id: Identifier,
+  installation: Orn,
+  organization: NonEmptyString,
+  build: Reference,
+  release: Reference,
+  selectionId: Identifier,
+  extensionRelease: Reference,
+  evaluatingCase: Reference,
+  decision: Reference,
+  authority: Reference,
+  fence: Reference,
+  revision: SafeInt,
+  decidedAt: UtcSecond,
+};
+export const AdmissionRecordSchema = Type.Union([
+  closed({
+    ...AdmissionCommon,
+    status: Type.Literal("admitted"),
+    components: Type.Array(ComponentBindingSchema, { minItems: 1, uniqueItems: true }),
+    approvedUses: Type.Array(ApprovedUseSchema, { minItems: 1, uniqueItems: true }),
+    bindings: Evidence(),
+    evidence: Evidence(),
+  }),
+  closed({
+    ...AdmissionCommon,
+    status: Type.Literal("refused"),
+    components: Type.Array(ComponentBindingSchema, { uniqueItems: true }),
+    reason: NonEmptyString,
+    evidence: Evidence(),
+  }),
+]);
+export type AdmissionRecord = Static<typeof AdmissionRecordSchema>;
+const AdmissionObservationCommon = {
+  ...Header,
+  kind: Type.Literal("admission-status-observation"),
+  admission: Reference,
+  decision: Reference,
+  evidence: Evidence(),
+  observedAt: UtcSecond,
+};
+export const AdmissionStatusObservationSchema = Type.Union([
+  closed({
+    ...AdmissionObservationCommon,
+    status: Type.Literal("suspended"),
+    reason: NonEmptyString,
+  }),
+  closed({
+    ...AdmissionObservationCommon,
+    status: Type.Literal("superseded"),
+    replacement: Reference,
+  }),
+  closed({
+    ...AdmissionObservationCommon,
+    status: Type.Literal("revoked"),
+    governedRevocation: Reference,
+    trustView: Reference,
+    reason: NonEmptyString,
+  }),
+]);
+export type AdmissionStatusObservation = Static<typeof AdmissionStatusObservationSchema>;
+const MemberObservationCommon = {
+  ...Header,
+  kind: Type.Literal("member-observation"),
+  installation: Orn,
+  build: Reference,
+  release: Reference,
+  memberId: Identifier,
+  memberKind: OrganizationReleaseMemberKindSchema,
+  subject: Reference,
+  evidence: Evidence(),
+  observedAt: UtcSecond,
+};
+export const MemberObservationSchema = Type.Union([
+  closed({
+    ...MemberObservationCommon,
+    disposition: Type.Union([Type.Literal("ready"), Type.Literal("verified")]),
+  }),
+  closed({
+    ...MemberObservationCommon,
+    disposition: Type.Union([
+      Type.Literal("refused"),
+      Type.Literal("suspended"),
+      Type.Literal("revoked"),
+    ]),
+    reason: NonEmptyString,
+  }),
+]);
+export type MemberObservation = Static<typeof MemberObservationSchema>;
+export const ActiveMemberSchema = closed({
+  selectionId: Identifier,
+  memberId: Identifier,
+  extensionRelease: Reference,
+  components: Type.Array(ComponentBindingSchema, { minItems: 1, uniqueItems: true }),
+  admission: Reference,
+});
+export type ActiveMember = Static<typeof ActiveMemberSchema>;
+export const ActiveSetSchema = closed({
+  ...Header,
+  kind: Type.Literal("active-set"),
+  installation: Orn,
+  organization: NonEmptyString,
+  release: Reference,
+  build: Reference,
+  predecessor: Type.Union([Reference, Type.Null()]),
+  members: Type.Array(ActiveMemberSchema, { uniqueItems: true }),
+  memberObservations: Evidence(),
+  policies: References(),
+  configuration: References(),
+  activatingCase: Reference,
+  authority: Reference,
+  activatingDecision: Reference,
+  fence: Reference,
+  revision: SafeInt,
+  activatedAt: UtcSecond,
+});
+export type ActiveSet = Static<typeof ActiveSetSchema>;
+const CatalogEntryCommon = {
+  id: Identifier,
+  activeSet: Reference,
+  selectionId: Identifier,
+  memberId: Identifier,
+  extensionRelease: Reference,
+  workflow: Reference,
+  example: Type.Union([Reference, Type.Null()]),
+  jobClass: Type.Union([Reference, Type.Null()]),
+  workloadArtifact: Type.Union([Reference, Type.Null()]),
+  contracts: References(),
+  availabilityEvidence: Evidence(),
+};
+export const CatalogEntrySchema = Type.Union([
+  closed({ ...CatalogEntryCommon, availability: Type.Literal("available") }),
+  closed({
+    ...CatalogEntryCommon,
+    availability: Type.Literal("unavailable"),
+    unavailableReason: NonEmptyString,
+  }),
+]);
+export type CatalogEntry = Static<typeof CatalogEntrySchema>;
+export const CatalogSchema = closed({
+  ...Header,
+  kind: Type.Literal("catalog"),
+  activeSet: Reference,
+  entries: Type.Array(CatalogEntrySchema, { uniqueItems: true }),
+});
+export type Catalog = Static<typeof CatalogSchema>;
+export const BoundAttestationSchema = closed({
+  ...Header,
+  kind: Type.Literal("bound-attestation"),
+  subject: Reference,
+  issuer: Orn,
+  evidence: Reference,
+  verification: Type.Union([
+    Type.Literal("publisher-signature"),
+    Type.Literal("registry-recognition"),
+    Type.Literal("source-provenance"),
+    Type.Literal("component-digest"),
+  ]),
+  observedAt: UtcSecond,
+  signature: NonEmptyString,
+});
+export type BoundAttestation = Static<typeof BoundAttestationSchema>;
+export const organizationReleaseV1: ProfileEntry = {
+  literal: ORGANIZATION_RELEASE_PROFILE,
+  documents: {
+    dependencyLock: DependencyLockSchema,
+    organizationBuild: OrganizationBuildSchema,
+    importDisposition: ImportDispositionSchema,
+    releaseStatusObservation: ReleaseStatusObservationSchema,
+    releaseEligibility: ReleaseEligibilitySchema,
+    organizationRelease: OrganizationReleaseSchema,
+    admissionRecord: AdmissionRecordSchema,
+    admissionStatusObservation: AdmissionStatusObservationSchema,
+    memberObservation: MemberObservationSchema,
+    activeSet: ActiveSetSchema,
+    catalog: CatalogSchema,
+    boundAttestation: BoundAttestationSchema,
+  },
+};

package/src/organization/source.v3.ts

@@ -0,0 +1,165 @@
+// dsg.organization.source/3
+// Organization authoring is selection and review input only. This profile has
+// no principals, grants, admissions, deployment wiring, or runtime authority.
+import { type Static, Type } from "@sinclair/typebox";
+import { ExtensionReleaseReferenceSchema } from "../extension/release.v1.js";
+import { closed, Hex64, NonEmptyString, type ProfileEntry } from "../primitives.js";
+import {
+  DependencyLockSchema,
+  type DependencyLock,
+  OrganizationReleaseMemberKindSchema,
+} from "./release.v1.js";
+import {
+  OrganizationDocumentPathSchema,
+  OrganizationSpaceSchema,
+  OrganizationSourceLocationSchema,
+  ProjectSourceSchema,
+} from "./source.v2.js";
+
+export const ORGANIZATION_SOURCE_V3_PROFILE = "dsg.organization.source/3" as const;
+
+const IdentifierSchema = Type.String({ pattern: "^[a-z][a-z0-9-]*(?:[.-][a-z0-9]+)*$" });
+const UniqueIdentifiers = () => Type.Array(IdentifierSchema, { minItems: 1, uniqueItems: true });
+const IdentifierSet = () => Type.Array(IdentifierSchema, { uniqueItems: true });
+const UniquePaths = () => Type.Array(OrganizationDocumentPathSchema, { uniqueItems: true });
+const UniqueStrings = () => Type.Array(NonEmptyString, { uniqueItems: true });
+
+export const OrganizationSourceProjectSchema = closed({
+  schemaVersion: Type.Literal(3),
+  kind: Type.Literal("project-membership"),
+  id: IdentifierSchema,
+  source: ProjectSourceSchema,
+  contract: OrganizationDocumentPathSchema,
+  handling: OrganizationDocumentPathSchema,
+});
+export type OrganizationSourceProject = Static<typeof OrganizationSourceProjectSchema>;
+
+export const OrganizationSelectionDispositionSchema = closed({
+  kind: Type.Union([
+    Type.Literal("publication"),
+    Type.Literal("import"),
+    Type.Literal("admission"),
+    Type.Literal("target"),
+    Type.Literal("check"),
+    Type.Literal("setup"),
+    Type.Literal("paid-execution"),
+  ]),
+  required: Type.Boolean(),
+  acceptable: UniqueStrings(),
+});
+export type OrganizationSelectionDisposition = Static<
+  typeof OrganizationSelectionDispositionSchema
+>;
+
+export const AuthoredOverlaySchema = closed({
+  id: IdentifierSchema,
+  document: OrganizationDocumentPathSchema,
+  sha256: Hex64,
+  mediaType: NonEmptyString,
+});
+export type AuthoredOverlay = Static<typeof AuthoredOverlaySchema>;
+
+export const CapabilitySelectionV3Schema = closed({
+  schemaVersion: Type.Literal(3),
+  kind: Type.Literal("capability-selection"),
+  id: IdentifierSchema,
+  release: ExtensionReleaseReferenceSchema,
+  memberIds: UniqueIdentifiers(),
+  origin: Type.Union([
+    Type.Literal("workspace"),
+    Type.Literal("official"),
+    Type.Literal("curated"),
+  ]),
+  dependencyLock: OrganizationDocumentPathSchema,
+  requiredDispositions: Type.Array(OrganizationSelectionDispositionSchema, {
+    minItems: 1,
+    uniqueItems: true,
+  }),
+  authoredOverlays: Type.Array(AuthoredOverlaySchema, { uniqueItems: true }),
+});
+export type CapabilitySelectionV3 = Static<typeof CapabilitySelectionV3Schema>;
+
+export const WorkspaceProfileV3Schema = closed({
+  schemaVersion: Type.Literal(3),
+  kind: Type.Literal("workspace-profile"),
+  profile: Type.Literal(ORGANIZATION_SOURCE_V3_PROFILE),
+  id: IdentifierSchema,
+  version: Type.String({ pattern: "^(?:0|[1-9][0-9]*)\\.[0-9]+\\.[0-9]+$" }),
+  requirements: closed({
+    facts: UniqueStrings(),
+    minimumProjects: Type.Integer({ minimum: 0 }),
+    requiredSelections: Type.Array(IdentifierSchema, { uniqueItems: true }),
+    instructions: Type.Boolean(),
+  }),
+  allowedOrigins: Type.Array(
+    Type.Union([Type.Literal("workspace"), Type.Literal("official"), Type.Literal("curated")]),
+    { minItems: 1, uniqueItems: true },
+  ),
+  sourceChecks: UniquePaths(),
+});
+export type WorkspaceProfileV3 = Static<typeof WorkspaceProfileV3Schema>;
+
+/** A semantic dependency lock is a source document referenced by the root;
+ * its lock bytes contain no Build self-reference or runtime observations. */
+export const OrganizationDependencyLockSchema = DependencyLockSchema;
+export type OrganizationDependencyLock = DependencyLock;
+
+export const OrganizationSourceReleaseMemberSchema = closed({
+  id: IdentifierSchema,
+  kind: OrganizationReleaseMemberKindSchema,
+  required: Type.Boolean(),
+  acceptableDispositions: Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true }),
+  subject: OrganizationDocumentPathSchema,
+});
+export type OrganizationSourceReleaseMember = Static<typeof OrganizationSourceReleaseMemberSchema>;
+
+/** Source-only Organization Release declaration. Runtime status, admission,
+ * activation, predecessor, and supersession belong to release records. */
+export const OrganizationReleaseDeclarationSchema = closed({
+  schemaVersion: Type.Literal(3),
+  kind: Type.Literal("organization-release-declaration"),
+  id: IdentifierSchema,
+  dependencyLock: OrganizationDocumentPathSchema,
+  selections: IdentifierSet(),
+  members: Type.Array(OrganizationSourceReleaseMemberSchema, {
+    minItems: 1,
+    uniqueItems: true,
+  }),
+  acceptance: closed({
+    requiredMembers: UniqueIdentifiers(),
+    acceptableDispositions: Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true }),
+  }),
+});
+export type OrganizationReleaseDeclaration = Static<typeof OrganizationReleaseDeclarationSchema>;
+
+export const OrganizationRootV3Schema = closed({
+  schemaVersion: Type.Literal(3),
+  kind: Type.Literal("organization"),
+  org: NonEmptyString,
+  space: OrganizationSpaceSchema,
+  purpose: NonEmptyString,
+  profile: OrganizationDocumentPathSchema,
+  projects: UniquePaths(),
+  capabilities: UniquePaths(),
+  dependencyLocks: UniquePaths(),
+  releases: UniquePaths(),
+  instructions: UniquePaths(),
+  documents: UniquePaths(),
+  archive: Type.Optional(OrganizationDocumentPathSchema),
+  source: Type.Optional(OrganizationSourceLocationSchema),
+});
+export type OrganizationRootV3 = Static<typeof OrganizationRootV3Schema>;
+
+export const organizationSourceV3: ProfileEntry = {
+  literal: ORGANIZATION_SOURCE_V3_PROFILE,
+  rootDocument: "organization",
+  documents: {
+    organization: OrganizationRootV3Schema,
+    profile: WorkspaceProfileV3Schema,
+    project: OrganizationSourceProjectSchema,
+    capabilitySelection: CapabilitySelectionV3Schema,
+    dependencyLock: OrganizationDependencyLockSchema,
+    releaseMember: OrganizationSourceReleaseMemberSchema,
+    releaseDeclaration: OrganizationReleaseDeclarationSchema,
+  },
+};

package/src/run/execution-binding.v1.ts

@@ -0,0 +1,70 @@
+// dsg.run.execution-binding/1
+// Exact authority chain re-derived independently by the kernel and execution
+// plane before any effect. No mutable discovery or latest lookup is permitted.
+import { type Static, Type } from "@sinclair/typebox";
+import { closed, Hex64, Orn, Reference, type ProfileEntry } from "../primitives.js";
+import {
+  AdmissionRecordSchema,
+  ActiveSetSchema,
+  BuildSelectionSchema,
+  CatalogEntrySchema,
+  ReleaseEligibilitySchema,
+} from "../organization/release.v1.js";
+import { OperationRequestSchema } from "./operation.v1.js";
+import { JobClassSchema } from "./job-class.v1.js";
+import {
+  WorkloadArtifactSchema,
+  WorkloadArtifactProvenanceSchema,
+} from "./workload-artifact.v1.js";
+
+export const EXECUTION_BINDING_PROFILE = "dsg.run.execution-binding/1" as const;
+
+export const ExecutionBindingSchema = closed({
+  profile: Type.Literal(EXECUTION_BINDING_PROFILE),
+  schemaVersion: Type.Literal(1),
+  kind: Type.Literal("execution-binding"),
+  installation: Orn,
+  operation: Reference,
+  activeSet: Reference,
+  admission: Reference,
+  organizationRelease: Reference,
+  organizationBuild: Reference,
+  selection: Reference,
+  extensionRelease: Reference,
+  workflow: Reference,
+  jobClass: Reference,
+  workloadArtifact: Reference,
+  executableManifestSha256: Hex64,
+  target: Reference,
+  eventCatalog: Reference,
+  law: Reference,
+  reservation: Reference,
+  trustView: Reference,
+});
+export type ExecutionBinding = Static<typeof ExecutionBindingSchema>;
+
+export const ExecutionRequestEnvelopeSchema = closed({
+  profile: Type.Literal(EXECUTION_BINDING_PROFILE),
+  schemaVersion: Type.Literal(1),
+  kind: Type.Literal("execution-request-envelope"),
+  operation: OperationRequestSchema,
+  binding: ExecutionBindingSchema,
+  jobClass: JobClassSchema,
+  workloadArtifact: WorkloadArtifactSchema,
+  workloadArtifactProvenance: WorkloadArtifactProvenanceSchema,
+  admission: AdmissionRecordSchema,
+  activeSet: ActiveSetSchema,
+  selection: BuildSelectionSchema,
+  catalogEntry: CatalogEntrySchema,
+  releaseEligibility: ReleaseEligibilitySchema,
+});
+export type ExecutionRequestEnvelope = Static<typeof ExecutionRequestEnvelopeSchema>;
+
+export const executionBindingV1: ProfileEntry = {
+  literal: EXECUTION_BINDING_PROFILE,
+  rootDocument: "executionBinding",
+  documents: {
+    executionBinding: ExecutionBindingSchema,
+    executionRequestEnvelope: ExecutionRequestEnvelopeSchema,
+  },
+};

package/src/run/job-class.v1.ts

@@ -0,0 +1,57 @@
+// dsg.run.job-class/1
+// Immutable execution semantics shared by the organization compiler, kernel,
+// and execution plane. Catalog detail APIs resolve these exact bytes.
+import { type Static, Type } from "@sinclair/typebox";
+import { closed, NonEmptyString, Reference, SafeInt, type ProfileEntry } from "../primitives.js";
+
+export const JOB_CLASS_PROFILE = "dsg.run.job-class/1" as const;
+
+const RequiredReferences = () => Type.Array(Reference, { minItems: 1, uniqueItems: true });
+const RequiredStrings = () => Type.Array(NonEmptyString, { minItems: 1, uniqueItems: true });
+
+export const JobClassBoundsSchema = closed({
+  maxRunSeconds: SafeInt,
+  maxGpuSeconds: SafeInt,
+  maxParallelism: SafeInt,
+  maxUsdMicroUnits: SafeInt,
+});
+export type JobClassBounds = Static<typeof JobClassBoundsSchema>;
+
+export const JobClassSchema = closed({
+  profile: Type.Literal(JOB_CLASS_PROFILE),
+  schemaVersion: Type.Literal(1),
+  kind: Type.Literal("job-class"),
+  id: NonEmptyString,
+  executor: NonEmptyString,
+  mode: NonEmptyString,
+  modeEnvironmentVariable: NonEmptyString,
+  workloadArtifact: Reference,
+  platforms: RequiredStrings(),
+  isolation: Type.Union([Type.Literal("ephemeral"), Type.Literal("dedicated")]),
+  inputContracts: RequiredReferences(),
+  outputContracts: RequiredReferences(),
+  eventCatalog: Reference,
+  decisionRequirements: RequiredReferences(),
+  bounds: JobClassBoundsSchema,
+  handling: Type.Union([
+    Type.Literal("public"),
+    Type.Literal("restricted"),
+    Type.Literal("confidential"),
+  ]),
+  retention: Type.Union([
+    Type.Literal("ephemeral"),
+    Type.Literal("bounded"),
+    Type.Literal("durable"),
+  ]),
+  completion: Reference,
+  teardown: Reference,
+  evidence: Reference,
+  replay: Reference,
+});
+export type JobClass = Static<typeof JobClassSchema>;
+
+export const jobClassV1: ProfileEntry = {
+  literal: JOB_CLASS_PROFILE,
+  rootDocument: "jobClass",
+  documents: { jobClass: JobClassSchema },
+};