@fourier-labs/harbour-contracts 0.28.0 → 0.30.0

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.28.0.0",
-  "publishVersion": "0.28.0",
-  "publishTag": "v0.28.0",
-  "schemasDigest": "sha256:f5fa7ad6b50cdd28fdfbbd594b2c92035052cd1091eed1273586082565da6df4",
+  "repositoryVersion": "0.30.0.0",
+  "publishVersion": "0.30.0",
+  "publishTag": "v0.30.0",
+  "schemasDigest": "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:b7c2021f907620ab3df9122992f73c25661a2e4e5ae0207cdc000de1d5227b04",
-  "generatedTypeScriptDigest": "sha256:72c340ec27372dbd65849b677e671f42b2a09dec5e6bc7810d735c6b0c6edcd0",
+  "generatedGoDigest": "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3",
+  "generatedTypeScriptDigest": "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -47,11 +47,11 @@
     "schema/error-category.enum.json": "sha256:693f8ce67d5554358f89b76132024cb8a082216f192d80a66bc4dc64e8983332",
     "schema/error-envelope.schema.json": "sha256:75dccda7dd16fdf8435deda53fc7dbcdc109b65114617a17f11763010c656f90",
     "schema/kvs-routing-entry.schema.json": "sha256:b75f3a5dfa93a428b2764e03222b66b6ef2bed980f8bac8ffac54afdf3526bc5",
-    "schema/promotion-request.schema.json": "sha256:560460b57fc639d248fa657a2a1e3d88d27ab9139faf17ee58633b671f8b5072",
+    "schema/promotion-request.schema.json": "sha256:00e96dfd8ddbdba88ea222941d43f3609ff6c815a79e34f6705cab458101c969",
     "schema/promotion-response.schema.json": "sha256:4129712d2e29d6ef21d93d4bd0bacfd60ada3f2ee0ade852824e64346b817634",
     "schema/sanitized-binding-evidence.schema.json": "sha256:b03bcc1911c99c69fda50eb656fc3e115f88fe2990c1708fbb5cd3542f4b8bba",
     "schema/secret-reference.schema.json": "sha256:966f7a6d2575b46a4b54804d06dc05c6229ebbcbd9200fe6a6c8d3b4ffb90f9f",
-    "schema/security-scan-input.schema.json": "sha256:9f9c9e6131c1abee454320b77e4332e3780c0c63f108f54f75c93194a32ccff7",
+    "schema/security-scan-input.schema.json": "sha256:83502dffb3c07ac2e0698928e6dc123f454fc667d4aacd336bcad6944ef2ac3d",
     "schema/security-verdict.schema.json": "sha256:ec3c2d5c9df3601aeed0909b36c7f427469c7f0eeb3295c5809b96d09bf3fc26",
     "schema/transform-report.schema.json": "sha256:815e764445fb41b912d0c0468f00621ad61f941fb4c7b9364e3f204ad47cdf7f",
     "schema/version-state.schema.json": "sha256:e7c4b2e7b615ebb07f36d0df22ded51b2c9688ef9e9bfe79de1d5cd94de9ae40"
@@ -93,7 +93,7 @@
     "gen-go/doc.go": "sha256:c17bc2d39ed175ce7105c68305f8ae7152f659eb7cd187ecceee7698eb3a65dd",
     "gen-go/error_category.go": "sha256:a8b64524be3716e62ca6016e56f2332a56fa5e16e42647421e516aa01a7d6806",
     "gen-go/schema_documents.go": "sha256:4b9094aaf0acc4bae4b65784954853f0888572a53fa1a1dc354f97c88ded805f",
-    "gen-go/types.go": "sha256:b61e41c09988a76c706cbb13c45547234a368f6d1214c86d7fa5ffa0f362a559",
+    "gen-go/types.go": "sha256:fccee4956ef19c796aae7c9f6ed346b6ccdedbb35f4d801f5970ff8ecb96a2c3",
     "gen-go/version_state.go": "sha256:827f8768359998409b86ea02d9ba1a149981928bae7161e4dc95fe0520ce7410"
   },
   "generatedTypeScript": {
@@ -137,12 +137,12 @@
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
     "gen-ts/index.ts": "sha256:bb37bf7838034dcf410562855582ae3bfbf24ee43d506bbc514ad512557016b5",
     "gen-ts/kvs-routing-entry.ts": "sha256:d92e85ee9f257d77850d1d3aac9438e2055f38084ff84a48fcedae239d47d4ca",
-    "gen-ts/promotion-request.ts": "sha256:6ef4612172202bca918a6260d40f2a1a8739845c6c0f747dd1ce5e520e081011",
+    "gen-ts/promotion-request.ts": "sha256:9db88cef67f777a16bac628039ec3f582acb9e8cfff6fb592b30d0a0e55abc68",
     "gen-ts/promotion-response.ts": "sha256:f1c9cafac96faeb02a443a31786f67714e818f38d90108e7af41958396524d6f",
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:4db7e9ed83f563a46e337815a55bbd6433864c41d9ec8e8a80810a16e3095ebb",
     "gen-ts/secret-reference.ts": "sha256:a8b65de72705b6f51f57cd8ca58881483108005b1fa4d19106c3e9cf1fa877e7",
-    "gen-ts/security-scan-input.ts": "sha256:5d9bde7394d8b34cca1d36b51ce17bf73cfccd9cfd7cab810f83d4de58f22285",
+    "gen-ts/security-scan-input.ts": "sha256:b31f048be04c34b40f49d3b3ba53277e473cd435ae9216ba3a3b4dac69fb5685",
     "gen-ts/security-verdict.ts": "sha256:fea950cddbd12fe0218e2573c9a29c6748d56612a464559f1e6d688fa97f68c7",
     "gen-ts/transform-report.ts": "sha256:6c54b579884d98135d73945d00980820b136f269622db27fa56a1c4c0e57d3b6",
     "gen-ts/version-state-machine.ts": "sha256:4371bc7e2bde86b0447f5242104c576cc160dfd7dae1885acbfb63540f230bdd",

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.28.0.0";
-export declare const ContractPublishVersion: "0.28.0";
-export declare const ContractPublishTag: "v0.28.0";
-export declare const ContractSchemasDigest: "sha256:f5fa7ad6b50cdd28fdfbbd594b2c92035052cd1091eed1273586082565da6df4";
+export declare const ContractRepositoryVersion: "0.30.0.0";
+export declare const ContractPublishVersion: "0.30.0";
+export declare const ContractPublishTag: "v0.30.0";
+export declare const ContractSchemasDigest: "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:b7c2021f907620ab3df9122992f73c25661a2e4e5ae0207cdc000de1d5227b04";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:72c340ec27372dbd65849b677e671f42b2a09dec5e6bc7810d735c6b0c6edcd0";
+export declare const ContractGeneratedGoDigest: "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.28.0.0";
-export const ContractPublishVersion = "0.28.0";
-export const ContractPublishTag = "v0.28.0";
-export const ContractSchemasDigest = "sha256:f5fa7ad6b50cdd28fdfbbd594b2c92035052cd1091eed1273586082565da6df4";
+export const ContractRepositoryVersion = "0.30.0.0";
+export const ContractPublishVersion = "0.30.0";
+export const ContractPublishTag = "v0.30.0";
+export const ContractSchemasDigest = "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:b7c2021f907620ab3df9122992f73c25661a2e4e5ae0207cdc000de1d5227b04";
-export const ContractGeneratedTypeScriptDigest = "sha256:72c340ec27372dbd65849b677e671f42b2a09dec5e6bc7810d735c6b0c6edcd0";
+export const ContractGeneratedGoDigest = "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3";
+export const ContractGeneratedTypeScriptDigest = "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c";

package/dist/gen-ts/promotion-request.d.ts

@@ -1,3 +1,23 @@
+/**
+ * One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable.
+ */
+export type PromotionRequestSecretBinding = {
+    /**
+     * Environment-variable name the app reads.
+     */
+    name: string;
+    /**
+     * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request.
+     */
+    secretRef?: string;
+    /**
+     * Approved plain configuration, not a credential. Its classification must be configuration.
+     */
+    value?: string;
+} & PromotionRequestSecretBinding1;
+export type PromotionRequestSecretBinding1 = {
+    [k: string]: unknown;
+};
 type BindingClassificationEntry = {
     kind: 'configuration' | 'secret' | 'provider_credential';
     confidence: 'high' | 'low';
@@ -28,27 +48,14 @@ export interface PromotionRequest {
     bindingClassification: BindingClassificationSubject;
 }
 /**
- * Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors.
+ * Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name.
  */
 export interface PromotionRequestEnvironmentBindings {
     /**
-     * Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets.
+     * Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings.
      */
     bindings: PromotionRequestSecretBinding[];
 }
-/**
- * One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
- */
-export interface PromotionRequestSecretBinding {
-    /**
-     * Environment-variable name the app reads.
-     */
-    name: string;
-    /**
-     * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
-     */
-    secretRef: string;
-}
 /**
  * Complete pre-allocation, value-free classification for the exact production source revision and declared production binding names. It intentionally has no production versionId; DCP allocates that identity atomically.
  */

package/dist/gen-ts/security-scan-input.d.ts

@@ -1,9 +1,9 @@
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.
+ * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
     /**
-     * Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then.
+     * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
      */
     phase: 'SOURCE' | 'ARTIFACT';
     /**
@@ -34,4 +34,55 @@ export interface SecurityScanInput {
      * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
      */
     classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+    /**
+     * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
+     */
+    imageDigest?: string;
+    bundleRef?: S3Ref;
+    /**
+     * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
+     *
+     * @minItems 1
+     */
+    infraRefs?: S3Ref1[];
+    /**
+     * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
+     */
+    provenance?: {
+        /**
+         * GitHub owner/name of the build-source repository.
+         */
+        repo: string;
+        /**
+         * Full 40-hex lowercase commit SHA the artifact was built from.
+         */
+        commit: string;
+        /**
+         * Branch the artifact was built from, caller-supplied provenance.
+         */
+        branch?: string;
+    };
+}
+/**
+ * ARTIFACT phase: S3 location of the built deployable bundle to scan.
+ */
+export interface S3Ref {
+    /**
+     * S3 bucket name.
+     */
+    bucket: string;
+    /**
+     * S3 object key.
+     */
+    key: string;
+}
+export interface S3Ref1 {
+    /**
+     * S3 bucket name.
+     */
+    bucket: string;
+    /**
+     * S3 object key.
+     */
+    key: string;
 }

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.28.0.0" as const;
-export const ContractPublishVersion = "0.28.0" as const;
-export const ContractPublishTag = "v0.28.0" as const;
-export const ContractSchemasDigest = "sha256:f5fa7ad6b50cdd28fdfbbd594b2c92035052cd1091eed1273586082565da6df4" as const;
+export const ContractRepositoryVersion = "0.30.0.0" as const;
+export const ContractPublishVersion = "0.30.0" as const;
+export const ContractPublishTag = "v0.30.0" as const;
+export const ContractSchemasDigest = "sha256:f2fac98b4ea48578a3a7cc15008b0bc2db5c771fd46c68613159b5c8ac000887" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:b7c2021f907620ab3df9122992f73c25661a2e4e5ae0207cdc000de1d5227b04" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:72c340ec27372dbd65849b677e671f42b2a09dec5e6bc7810d735c6b0c6edcd0" as const;
+export const ContractGeneratedGoDigest = "sha256:da46f772799e1eb8fd530c3eb34937a8cfbf218f5ea6288f6614fe69cd3b3bc3" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:5e6ce1d6fb4b8dbcbab57b4495707fe323abd8d8a0433438aee16f57a000932c" as const;

package/gen-ts/promotion-request.ts

@@ -1,6 +1,26 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
+/**
+ * One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable.
+ */
+export type PromotionRequestSecretBinding = {
+  /**
+   * Environment-variable name the app reads.
+   */
+  name: string;
+  /**
+   * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request.
+   */
+  secretRef?: string;
+  /**
+   * Approved plain configuration, not a credential. Its classification must be configuration.
+   */
+  value?: string;
+} & PromotionRequestSecretBinding1;
+export type PromotionRequestSecretBinding1 = {
+  [k: string]: unknown;
+};
 type BindingClassificationEntry = {
   kind: 'configuration' | 'secret' | 'provider_credential';
   confidence: 'high' | 'low';
@@ -32,27 +52,14 @@ export interface PromotionRequest {
   bindingClassification: BindingClassificationSubject;
 }
 /**
- * Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors.
+ * Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name.
  */
 export interface PromotionRequestEnvironmentBindings {
   /**
-   * Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets.
+   * Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings.
    */
   bindings: PromotionRequestSecretBinding[];
 }
-/**
- * One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable.
- */
-export interface PromotionRequestSecretBinding {
-  /**
-   * Environment-variable name the app reads.
-   */
-  name: string;
-  /**
-   * Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
-   */
-  secretRef: string;
-}
 /**
  * Complete pre-allocation, value-free classification for the exact production source revision and declared production binding names. It intentionally has no production versionId; DCP allocates that identity atomically.
  */

package/gen-ts/security-scan-input.ts

@@ -2,11 +2,11 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.
+ * Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
  */
 export interface SecurityScanInput {
   /**
-   * Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then.
+   * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
    */
   phase: 'SOURCE' | 'ARTIFACT';
   /**
@@ -37,4 +37,55 @@ export interface SecurityScanInput {
    * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
    */
   classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+  /**
+   * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
+   */
+  imageDigest?: string;
+  bundleRef?: S3Ref;
+  /**
+   * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
+   *
+   * @minItems 1
+   */
+  infraRefs?: S3Ref1[];
+  /**
+   * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
+   */
+  provenance?: {
+    /**
+     * GitHub owner/name of the build-source repository.
+     */
+    repo: string;
+    /**
+     * Full 40-hex lowercase commit SHA the artifact was built from.
+     */
+    commit: string;
+    /**
+     * Branch the artifact was built from, caller-supplied provenance.
+     */
+    branch?: string;
+  };
+}
+/**
+ * ARTIFACT phase: S3 location of the built deployable bundle to scan.
+ */
+export interface S3Ref {
+  /**
+   * S3 bucket name.
+   */
+  bucket: string;
+  /**
+   * S3 object key.
+   */
+  key: string;
+}
+export interface S3Ref1 {
+  /**
+   * S3 bucket name.
+   */
+  bucket: string;
+  /**
+   * S3 object key.
+   */
+  key: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Harbour components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/promotion-request.schema.json

@@ -41,15 +41,15 @@
           "items": {
             "$ref": "#/definitions/PromotionRequestSecretBinding"
           },
-          "description": "Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets."
+          "description": "Approved runtime bindings for the production version. An empty array means the caller checked and found no bindings."
         }
       },
-      "description": "Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors."
+      "description": "Optional runtime bindings for the production version, matching the preview secret-reference or plain-configuration shape. Credentials remain secret references; classification covers every binding name."
     },
     "PromotionRequestSecretBinding": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["name", "secretRef"],
+      "required": ["name"],
       "properties": {
         "name": {
           "type": "string",
@@ -59,10 +59,20 @@
         "secretRef": {
           "type": "string",
           "pattern": "^secretref://tenant/[A-Za-z0-9._-]+/(?:app/[A-Za-z0-9._-]+/(?:secret/[A-Z][A-Z0-9_]{0,127}|source/[a-z0-9][a-z0-9._-]{0,63})|source/[a-z0-9][a-z0-9._-]{0,63})$",
-          "description": "Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it."
+          "description": "Governance app secret, app-scoped minted data-source credential, or approved tenant-source credential reference the deployment plane resolves. The credential value never appears in this request."
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 512,
+          "description": "Approved plain configuration, not a credential. Its classification must be configuration."
         }
       },
-      "description": "One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only app secrets, app-scoped minted data-source credentials and tenant-scoped source credentials from an approved BYO grant; integration and provider credentials remain unrepresentable."
+      "oneOf": [
+        { "required": ["secretRef"] },
+        { "required": ["value"] }
+      ],
+      "description": "One runtime binding: exactly one of secretRef or plain value, as in preview. The legacy type name is retained for consumers. Secret references remain limited to app secrets and approved data-source credentials; integration and provider credentials remain unrepresentable."
     }
   }
 }

package/schema/security-scan-input.schema.json

@@ -2,15 +2,23 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/security-scan-input.schema.json",
   "title": "SecurityScanInput",
-  "description": "Input to the Harbour Security Assurance machine (Security Assurance LLD §2). M1 runs the SOURCE phase only; ARTIFACT is reserved in the enum so the contract is stable through M2. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance.",
+  "description": "Input to the Harbour Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.",
   "type": "object",
   "additionalProperties": false,
   "required": ["phase", "org", "app", "env", "repo", "commit", "branch"],
+  "if": { "properties": { "phase": { "const": "ARTIFACT" } }, "required": ["phase"] },
+  "then": {
+    "anyOf": [
+      { "required": ["imageDigest"] },
+      { "required": ["bundleRef"] },
+      { "required": ["infraRefs"] }
+    ]
+  },
   "properties": {
     "phase": {
       "type": "string",
       "enum": ["SOURCE", "ARTIFACT"],
-      "description": "Scan phase. M1 implements SOURCE only; ARTIFACT is reserved for M2 (image scan against an ECR digest) and is rejected by the machine until then."
+      "description": "Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present."
     },
     "org": {
       "type": "string",
@@ -47,6 +55,56 @@
       "type": "string",
       "enum": ["GREEN", "YELLOW", "ORANGE", "RED"],
       "description": "Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default."
+    },
+    "imageDigest": {
+      "type": "string",
+      "pattern": "^([^@\\s]+@)?sha256:[0-9a-f]{64}$",
+      "description": "ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes."
+    },
+    "bundleRef": {
+      "$ref": "#/definitions/S3Ref",
+      "description": "ARTIFACT phase: S3 location of the built deployable bundle to scan."
+    },
+    "infraRefs": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/S3Ref" },
+      "minItems": 1,
+      "description": "ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks."
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repo", "commit"],
+      "properties": {
+        "repo": {
+          "type": "string",
+          "minLength": 1,
+          "pattern": "^[^/\\s]+/[^/\\s]+$",
+          "description": "GitHub owner/name of the build-source repository."
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$",
+          "description": "Full 40-hex lowercase commit SHA the artifact was built from."
+        },
+        "branch": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Branch the artifact was built from, caller-supplied provenance."
+        }
+      },
+      "description": "Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim."
+    }
+  },
+  "definitions": {
+    "S3Ref": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["bucket", "key"],
+      "properties": {
+        "bucket": { "type": "string", "minLength": 1, "description": "S3 bucket name." },
+        "key": { "type": "string", "minLength": 1, "description": "S3 object key." }
+      }
     }
   }
 }