@fourier-labs/harbour-contracts 0.33.0 → 0.41.0

package/schema/deployment-status-failure.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/deployment-status-failure.schema.json",
   "title": "DeploymentStatusFailure",
-  "description": "Frontend-safe failure projection nested in a failed DeploymentStatusResponse. Internal evidence references, AWS identifiers and raw provider errors are excluded.",
+  "description": "Frontend-safe failure projection nested in a failed DeploymentStatusResponse. Raw provider errors are excluded; a digest-bound diagnosticRef locates the complete redacted terminal diagnostic.",
   "type": "object",
   "additionalProperties": false,
   "required": ["category", "retryable", "message", "remediationHint"],
@@ -23,6 +23,20 @@
       "type": "string",
       "minLength": 1,
       "maxLength": 1000
+    },
+    "diagnosticRef": {
+      "$ref": "#/definitions/FailureDiagnosticRef"
+    }
+  },
+  "definitions": {
+    "FailureDiagnosticRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "sha256"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^runs/[A-Za-z0-9._/-]+\\.json$" },
+        "sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+      }
     }
   }
 }

package/schema/deployment-status-response.schema.json

@@ -105,9 +105,21 @@
         },
         "remediationHint": {
           "type": "string"
+        },
+        "diagnosticRef": {
+          "$ref": "#/definitions/StatusDiagnosticRef"
         }
       }
     },
+    "StatusDiagnosticRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "sha256"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^runs/[A-Za-z0-9._/-]+\\.json$" },
+        "sha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }
+      }
+    },
     "StatusProgressEvent": {
       "type": "object",
       "additionalProperties": false,

package/schema/error-category.enum.json

@@ -16,6 +16,7 @@
     { "id": "intake.unsupported-runtime", "retryable": false, "description": "Detected runtime has no Harbour build recipe." },
     { "id": "intake.attestation-missing", "retryable": false, "description": "Required auth attestation absent." },
     { "id": "intake.multi-app-repo", "retryable": false, "description": "Repo contains more than one deployable app." },
+    { "id": "intake.source-invalid", "retryable": false, "description": "The submitted source tree fails its own clean install, build, import, boot, schema-presence, or pristine-lineage checks before Harbour transformation begins." },
     { "id": "secrets.unresolvable", "retryable": false, "retired": true, "description": "RETIRED 2026-08-08 and no longer emittable: the secret-materializer stack, its reconciler and the secret-reference playbook were all removed, so nothing can reach this state. Kept rather than deleted because historical failure records still carry it and a dropped id would decode to nothing. Do not emit in new code." },
     { "id": "secrets.reference-unresolvable", "retryable": false, "description": "A governance secret reference supplied on the deploy request could not be resolved to a stored value — the secret does not exist, the read was denied, or the secretref:// URI is malformed. Not retryable: no amount of waiting produces the value, a human must set it (or fix the reference) before the deploy can proceed." },
     { "id": "secrets.placeholder-unresolved", "retryable": false, "description": "The built workspace still contains a ${HARBOUR_REDACTED_<KEY>} substitution placeholder after transformation, meaning the transform never converted it into a runtime secret lookup and the artifact would ship a literal placeholder where a secret belongs. Not retryable: the workspace is already built, so the same input yields the same placeholder until the transform is corrected." },
@@ -24,14 +25,24 @@
     { "id": "storage.unsupported-engine", "retryable": false, "family": true, "description": "Storage engine with no Harbour mapping; concrete token names the engine, e.g. storage.unsupported-engine.mongodb." },
     { "id": "storage.mapping-drift", "retryable": false, "description": "Declared storage binding diverged from detected usage." },
     { "id": "storage.unavailable", "retryable": true, "description": "The platform's shared application database could not be reached while preparing or provisioning the deploy — e.g. the Aurora cluster dial timing out during a scale-from-zero cold start. Says nothing about the app, so it IS retryable: the same deploy submitted again is expected to succeed once the database is awake. Previously surfaced as uncategorized.deploy (errorType wrapError)." },
+    { "id": "ai.plan-blocked", "retryable": false, "description": "The governance control plane's AI PLAN verdict was BLOCKED: the app makes AI calls that cannot be governed as the tenant is configured today — no provider connected or enabled, no credential, no budget, an SDK or provider the gateway cannot intercept, or a scan that could not cover the whole app. The analyzer's maker message carries the plain-English reason and the governance reason codes. NOT retryable: the same deploy re-earns the same verdict until a person changes the tenant's AI configuration or the app. Previously surfaced as uncategorized.deploy (errorType wrapError)." },
     { "id": "transform.deadline-exceeded", "retryable": true, "description": "The transform wall deadline was reached before a passing candidate was found. A fresh deployment attempt is safe and may resume from the latest saved transformation checkpoint." },
-    { "id": "transform.non-retryable", "retryable": false, "family": true, "description": "Agent declared the app unconvertible or hit an unsupported construct; fails immediately without burning remaining budget. Concrete token names the reason." },
+    { "id": "transform.attempts-exhausted", "retryable": false, "description": "The bounded transformation attempt count was exhausted before a passing candidate was found." },
+    { "id": "transform.non-retryable", "retryable": false, "retired": true, "description": "RETIRED 2026-09-06. Historical agent declines used a prose-derived suffix in this family. New reports must select one of the fixed structured categories below." },
     { "id": "transform.validation-failed", "retryable": true, "description": "Transform candidate failed validation with iterable feedback; re-enters TRANSFORMING while deadline remains." },
+    { "id": "auth.validation-seed-unsupported", "retryable": false, "description": "The application requires authenticated validation setup that Harbour cannot express with its supported validation seed contract." },
+    { "id": "auth.identity-entity-unresolvable", "retryable": false, "description": "The application identity model cannot deterministically resolve the trusted Harbour subject to one application entity." },
+    { "id": "dependency.python-runtime-unsupported", "retryable": false, "description": "The application requires a Python minor version for which Harbour has no approved resolver and runtime image." },
+    { "id": "dependency.resolver-unavailable", "retryable": true, "description": "The approved dependency resolver image or restricted registry lane was unavailable." },
+    { "id": "dependency.resolution-failed", "retryable": false, "description": "The application dependency manifest could not be resolved by its approved package manager." },
+    { "id": "dependency.lockfile-stale", "retryable": false, "description": "The final dependency manifest and lockfile disagree after dependency resolution." },
+    { "id": "aurora.bundle-invalid", "retryable": false, "description": "The candidate's Harbour-managed Aurora migration bundle is missing, malformed, or inconsistent." },
+    { "id": "capability.unsupported", "retryable": false, "description": "A required application capability has no supported equivalent under the Harbour platform contract." },
     { "id": "frontend.env-inlined-unfixable", "retryable": false, "description": "Client code inlined build-time env/self-URLs in a way transformation cannot rewrite." },
     { "id": "build.recipe-failed", "retryable": false, "description": "The Harbour build recipe failed for the detected runtime." },
     { "id": "build.image-too-large", "retryable": false, "description": "Built image exceeded the size limit." },
     { "id": "browser.probe-failed", "retryable": true, "description": "The app built and produced its declared outputs, but the browser probe found it does not serve them — typically assets emitted at the root instead of under the app base path. Retryable because it is fed back to the transform agent, which is the component that can fix it; the merged job retries in-loop and the state machine retries the job. Distinct from build.recipe-failed, which means the build itself did not succeed: here it did." },
-    { "id": "browser.probe-unavailable", "retryable": false, "description": "The browser probe could not reach a verdict — Chromium crashed or disconnected, or it wrote no result document. Says nothing about the app, so it is NOT fed back to the agent: retrying would spend agent budget on something the agent cannot influence, and that budget is currently the only cost control in the system (control-plane-infra ADR 0007). Replaces the uncategorized.browser-probe token the merged job emitted while this entry did not exist." },
+    { "id": "browser.probe-unavailable", "retryable": false, "description": "The browser probe could not reach a verdict — Chromium crashed or disconnected, or it wrote no result document. Says nothing about the app, so it is not fed back to the agent. Replaces the uncategorized.browser-probe token the merged job emitted while this entry did not exist." },
     { "id": "verify.smoke-failed", "retryable": false, "description": "Candidate smoke/health check failed (boot, routes, storage, secret refs, response shape)." },
     { "id": "verify.characterization-diverged", "retryable": false, "description": "Post-MVP: recorded req/res replay diverged beyond thresholds." },
     { "id": "verify.migration-from-zero-failed", "retryable": false, "description": "Post-MVP: from-zero migration chain failed on scratch DB." },

package/schema/transform-report.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/transform-report.schema.json",
   "title": "TransformReport",
-  "description": "Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields.",
+  "description": "Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields. A deployable report must also carry preservation_plan: the agent's own grounded smoke tests (one to three happy_path user journeys plus a boundary_check per behaviour its playbooks or edits could regress) that the validation cell executes after transformation, and an uncovered list naming every boundary it could not test and why. It also carries validation_fixtures: null when no external fixture is needed, or a bounded generic HTTP/WebSocket fixture declaration for that one run. An unsupported report carries only application.unsupported and no plan or fixtures.",
   "x-go-embed": true,
   "type": "object",
   "additionalProperties": false,
@@ -56,21 +56,19 @@
         "changeType",
         "requiresCodeChanges",
         "requiresSchemaMigration",
-        "desiredSchemaPath",
         "migrationPaths",
         "changedFiles",
         "evidence",
         "unsupportedFeatures"
       ],
       "properties": {
-        "mode": { "type": "string", "enum": ["none", "sql", "unsupported"] },
+        "mode": { "type": "string", "enum": ["none", "sql"] },
         "changeType": {
           "type": "string",
           "enum": ["none", "code_only", "schema_only", "code_and_schema"]
         },
         "requiresCodeChanges": { "type": "boolean" },
         "requiresSchemaMigration": { "type": "boolean" },
-        "desiredSchemaPath": { "type": "string", "maxLength": 512 },
         "migrationPaths": {
           "type": "array",
           "maxItems": 128,
@@ -102,6 +100,203 @@
         }
       }
     },
+    "preservation_plan": {
+      "description": "Agent-authored preservation (smoke) plan for this attempt. Required whenever the report is deployable; forbidden on an unsupported report. Every test must be grounded in files the agent actually read or changed (evidence) and expressed as tenant-relative browser or HTTP steps the validation cell can execute without secrets. Structural bounds live here; per-action required fields, at least one assert* step per test, one to three happy_path tests, unique ids, the {{runId}} substitution and path safety are enforced semantically by the deployment plane.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "tests", "uncovered"],
+      "properties": {
+        "version": { "type": "integer", "const": 1 },
+        "tests": {
+          "description": "Ordered smoke tests. happy_path tests cover primary user journeys inferred from routes, APIs, forms and focused tests; boundary_check tests pin the smallest observable behaviour each applied playbook or changed file could regress.",
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "kind", "name", "boundaries", "evidence", "confidence", "steps"],
+            "properties": {
+              "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+              "kind": { "type": "string", "enum": ["happy_path", "boundary_check"] },
+              "name": { "type": "string", "minLength": 1, "maxLength": 120 },
+              "boundaries": {
+                "description": "Transformation boundaries this test claims to cover.",
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 8,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "enum": ["application", "routing", "database", "authentication", "runtime_dependency", "files", "provider", "background_work"]
+                }
+              },
+              "evidence": {
+                "description": "Files (and optionally lines) in the transformed workspace that ground this test. Paths must exist after transformation.",
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 8,
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["path", "reason"],
+                  "properties": {
+                    "path": { "type": "string", "minLength": 1, "maxLength": 512 },
+                    "line": { "type": "integer", "minimum": 1 },
+                    "reason": { "type": "string", "minLength": 1, "maxLength": 512 }
+                  }
+                }
+              },
+              "confidence": { "type": "string", "enum": ["high", "medium", "low"] },
+              "steps": {
+                "description": "Executed in order inside the validation cell's authenticated browser context; the test stops at its first failed step. Which optional fields apply depends on action: navigate/request/assertURL use path; click/fill/assertVisible use target; fill uses value; assertVisible uses text; request uses method, body and name; assertResponse uses request, status, jsonKey and jsonValue.",
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 20,
+                "items": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["action"],
+                  "properties": {
+                    "action": {
+                      "type": "string",
+                      "enum": ["navigate", "click", "fill", "reload", "request", "assertVisible", "assertURL", "assertResponse"]
+                    },
+                    "path": {
+                      "description": "Tenant-relative path starting with '/'; never a scheme or host.",
+                      "type": "string",
+                      "maxLength": 512
+                    },
+                    "target": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": ["by"],
+                      "properties": {
+                        "by": { "type": "string", "enum": ["role", "label", "placeholder", "text", "testId", "css"] },
+                        "role": { "type": "string", "maxLength": 64 },
+                        "name": { "description": "Accessible name when by is role.", "type": "string", "maxLength": 256 },
+                        "value": { "description": "Locator value for every by other than role.", "type": "string", "maxLength": 512 }
+                      }
+                    },
+                    "value": { "type": "string", "maxLength": 1024 },
+                    "text": { "type": "string", "maxLength": 512 },
+                    "method": { "type": "string", "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"] },
+                    "body": { "description": "JSON text sent as the request body.", "type": "string", "maxLength": 16384 },
+                    "name": { "description": "Names a request's response for a later assertResponse in the same test.", "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+                    "request": { "description": "The named preceding request an assertResponse inspects.", "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+                    "status": { "type": "integer", "minimum": 100, "maximum": 599 },
+                    "jsonKey": { "description": "Top-level key or dotted path into the JSON response; no brackets.", "type": "string", "maxLength": 128 },
+                    "jsonValue": { "description": "Expected value, compared as a string.", "type": "string", "maxLength": 512 },
+                    "timeoutMs": { "type": "integer", "minimum": 1000, "maximum": 30000 }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "uncovered": {
+          "description": "Boundaries the agent deliberately left untested, each with a reviewed reason. An empty array claims full coverage.",
+          "type": "array",
+          "maxItems": 8,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["boundary", "reason"],
+            "properties": {
+              "boundary": {
+                "type": "string",
+                "enum": ["application", "routing", "database", "authentication", "runtime_dependency", "files", "provider", "background_work"]
+              },
+              "reason": {
+                "type": "string",
+                "enum": ["not-observable-in-validation-cell", "no-safe-fixture", "no-grounded-surface"]
+              },
+              "detail": { "type": "string", "maxLength": 512 }
+            }
+          }
+        }
+      }
+    },
+    "validation_fixtures": {
+      "description": "A bounded, non-secret fixture program for this transformation's throwaway validation cell. Null means the application needs no external fixture. Bindings use application-owned logical names and explicitly inject only generated fixture URLs; fixtures describe deterministic HTTP or WebSocket exchanges without naming an application or provider and without executable code. The deployment plane semantically verifies unique fixture ids, template references, operation coverage, JSON text and safe config updates before forwarding the spec to the data plane.",
+      "anyOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["version", "bindings", "fixtures"],
+          "properties": {
+            "version": { "type": "integer", "const": 1 },
+            "bindings": {
+              "description": "Bounded per-run fixture requirements. logical_name is an arbitrary application-owned binding name; deployment-plane semantic validation requires it to be unique within this array.",
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 32,
+              "items": { "$ref": "#/definitions/ValidationFixtureBinding" }
+            },
+            "fixtures": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 32,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["id", "type", "http", "websocket"],
+                "properties": {
+                  "id": {
+                    "type": "string",
+                    "pattern": "^[a-z][a-z0-9-]{0,63}$"
+                  },
+                  "type": { "type": "string", "enum": ["http", "websocket"] },
+                  "http": {
+                    "anyOf": [
+                      { "$ref": "#/definitions/ValidationHttpFixture" },
+                      { "type": "null" }
+                    ]
+                  },
+                  "websocket": {
+                    "anyOf": [
+                      { "$ref": "#/definitions/ValidationWebSocketFixture" },
+                      { "type": "null" }
+                    ]
+                  }
+                },
+                "oneOf": [
+                  {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["id", "type", "http", "websocket"],
+                    "properties": {
+                      "id": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]{0,63}$"
+                      },
+                      "type": { "const": "http" },
+                      "http": { "$ref": "#/definitions/ValidationHttpFixture" },
+                      "websocket": { "type": "null" }
+                    }
+                  },
+                  {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["id", "type", "http", "websocket"],
+                    "properties": {
+                      "id": {
+                        "type": "string",
+                        "pattern": "^[a-z][a-z0-9-]{0,63}$"
+                      },
+                      "type": { "const": "websocket" },
+                      "http": { "type": "null" },
+                      "websocket": { "$ref": "#/definitions/ValidationWebSocketFixture" }
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        },
+        { "type": "null" }
+      ]
+    },
     "application": {
       "type": "object",
       "additionalProperties": false,
@@ -109,11 +304,42 @@
         "unsupported": {
           "type": "object",
           "additionalProperties": false,
-          "required": ["capability", "constraint", "reason"],
+          "required": ["category", "capability", "operation", "constraint", "reason", "evidence"],
           "properties": {
+            "category": {
+              "type": "string",
+              "enum": [
+                "auth.validation-seed-unsupported",
+                "auth.identity-entity-unresolvable",
+                "capability.unsupported"
+              ],
+              "description": "Closed machine category selected independently from the human explanation."
+            },
             "capability": { "type": "string", "minLength": 1, "maxLength": 512 },
+            "operation": {
+              "description": "The exact source operation that cannot be preserved, such as a cross-document transactional write. Name a concrete operation, not an engine or product.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 512
+            },
             "constraint": { "type": "string", "minLength": 1, "maxLength": 512 },
-            "reason": { "type": "string", "minLength": 1, "maxLength": 2048 }
+            "reason": { "type": "string", "minLength": 1, "maxLength": 2048 },
+            "evidence": {
+              "description": "Exact source locations proving the required operation and the unsupported platform capability. Environment failures and unfinished conversion work are not evidence.",
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 32,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["path", "line", "reason"],
+                "properties": {
+                  "path": { "type": "string", "minLength": 1, "maxLength": 512 },
+                  "line": { "type": "integer", "minimum": 1 },
+                  "reason": { "type": "string", "minLength": 1, "maxLength": 1024 }
+                }
+              }
+            }
           }
         },
         "runtime": {
@@ -145,23 +371,18 @@
           ]
         },
         "validationSeed": {
-          "description": "Build-only bootstrap for authenticated browser validation. Use null when the application does not require a local database user. When local authorization resolves Harbour identity to an application-owned user or membership row, declare an idempotent command that creates the fixed validation identity in the throwaway database. Reuse an existing seed command when available; otherwise add the smallest validation-only script using the application's existing database layer. The command is never run during production deployment.",
+          "description": "Build-only PostgreSQL bootstrap for authenticated browser validation. Use null when the application does not require a pre-existing database identity. The SQL file runs only in Harbour's throwaway validation database after migrations and before candidate boot. Harbour supplies the fixed probe subject and lowercased email as transaction-local settings.",
           "anyOf": [
             {
               "type": "object",
               "additionalProperties": false,
-              "required": ["command", "identityEmailEnvironmentVariable"],
+              "required": ["kind", "path"],
               "properties": {
-                "command": {
-                  "type": "array",
-                  "minItems": 1,
-                  "maxItems": 64,
-                  "items": { "type": "string", "minLength": 1, "maxLength": 1024 }
-                },
-                "identityEmailEnvironmentVariable": {
+                "kind": { "type": "string", "const": "sql" },
+                "path": {
                   "type": "string",
-                  "pattern": "^[A-Z][A-Z0-9_]{0,127}$",
-                  "description": "Existing application-owned environment variable that receives the trusted browser probe email, for example ADMIN_EMAIL."
+                  "pattern": "^\\.harbour/validation/(?:[^/]+/)*[^/]+\\.sql$",
+                  "maxLength": 512
                 }
               }
             },
@@ -243,9 +464,209 @@
       }
     }
   },
+  "definitions": {
+    "ValidationFixtureBinding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["logical_name", "operations", "environment", "config"],
+      "properties": {
+        "logical_name": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
+        },
+        "fixture_id": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]{0,63}$",
+          "description": "Optional explicit fixture association for a binding that has no URL mapping, such as a credential-only binding."
+        },
+        "operations": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 5,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["http", "websocket", "email", "webhook", "ai"]
+          }
+        },
+        "environment": {
+          "description": "Environment variables that receive a generated fixture URL. Values cannot carry arbitrary configuration or secrets.",
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["name"],
+            "properties": {
+              "name": {
+                "type": "string",
+                "pattern": "^[A-Z][A-Z0-9_]{0,127}$"
+              },
+              "value": {
+                "type": "string",
+                "pattern": "^\\{\\{fixture\\.[a-z][a-z0-9-]{0,63}\\.url\\}\\}$"
+              },
+              "test_value": {
+                "type": "string",
+                "minLength": 13,
+                "maxLength": 256,
+                "pattern": "^harbour-test-[^:/\\s]{1,243}$",
+                "description": "Validation-only synthetic credential. It is never exported as deployed runtime configuration."
+              }
+            },
+            "oneOf": [
+              { "required": ["value"], "not": { "required": ["test_value"] } },
+              { "required": ["test_value"], "not": { "required": ["value"] } }
+            ]
+          }
+        },
+        "config": {
+          "description": "Structured JSON or YAML keys that receive a generated fixture URL in a bounded relative application config file.",
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "format", "key", "value"],
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 512,
+                "pattern": "^(?:[A-Za-z0-9_-][A-Za-z0-9._-]*/)*[A-Za-z0-9_-][A-Za-z0-9._-]*$"
+              },
+              "format": { "type": "string", "enum": ["json", "yaml"] },
+              "key": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256,
+                "pattern": "^[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)*$"
+              },
+              "value": {
+                "type": "string",
+                "pattern": "^\\{\\{fixture\\.[a-z][a-z0-9-]{0,63}\\.url\\}\\}$"
+              }
+            }
+          }
+        }
+      }
+    },
+    "ValidationFixtureNameValuePairs": {
+      "type": "array",
+      "maxItems": 32,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "value"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1, "maxLength": 128 },
+          "value": { "type": "string", "maxLength": 2048 }
+        }
+      }
+    },
+    "ValidationHttpFixture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["base_path", "routes"],
+      "properties": {
+        "base_path": {
+          "type": "string",
+          "maxLength": 512,
+          "pattern": "^/(?:[A-Za-z0-9._~-]+(?:/[A-Za-z0-9._~-]+)*)?$"
+        },
+        "routes": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["operation", "request", "response"],
+            "properties": {
+              "operation": {
+                "type": "string",
+                "enum": ["http", "email", "webhook", "ai"]
+              },
+              "request": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["method", "path", "query", "headers", "body"],
+                "properties": {
+                  "method": {
+                    "type": "string",
+                    "enum": ["GET", "POST", "PUT", "PATCH", "DELETE"]
+                  },
+                  "path": {
+                    "type": "string",
+                    "maxLength": 512,
+                    "pattern": "^/(?:[A-Za-z0-9._~-]+(?:/[A-Za-z0-9._~-]+)*)?$"
+                  },
+                  "query": { "$ref": "#/definitions/ValidationFixtureNameValuePairs" },
+                  "headers": { "$ref": "#/definitions/ValidationFixtureNameValuePairs" },
+                  "body": { "type": "string", "maxLength": 16384 }
+                }
+              },
+              "response": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["status", "headers", "body"],
+                "properties": {
+                  "status": { "type": "integer", "minimum": 100, "maximum": 599 },
+                  "headers": { "$ref": "#/definitions/ValidationFixtureNameValuePairs" },
+                  "body": { "type": "string", "maxLength": 16384 }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "ValidationWebSocketFixture": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "expected_json", "send_messages", "close"],
+      "properties": {
+        "path": {
+          "type": "string",
+          "maxLength": 512,
+          "pattern": "^/(?:[A-Za-z0-9._~-]+(?:/[A-Za-z0-9._~-]+)*)?$"
+        },
+        "expected_json": {
+          "description": "Exact JSON value the fixture expects as the first client message, or null when no client message is required. JSON parsing is a semantic check.",
+          "anyOf": [
+            { "type": "string", "minLength": 1, "maxLength": 16384 },
+            { "type": "null" }
+          ]
+        },
+        "send_messages": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": { "type": "string", "maxLength": 16384 }
+        },
+        "close": {
+          "anyOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["code", "reason"],
+              "properties": {
+                "code": { "type": "integer", "minimum": 1000, "maximum": 4999 },
+                "reason": { "type": "string", "maxLength": 123 }
+              }
+            },
+            { "type": "null" }
+          ]
+        }
+      }
+    }
+  },
+  "x-unique-array-by": [
+    { "field": "validation_fixtures.bindings", "key": "logical_name" }
+  ],
   "oneOf": [
     {
-      "required": ["applied_playbooks", "static_rebuild_required", "analysis", "database", "application"],
+      "required": ["applied_playbooks", "static_rebuild_required", "analysis", "database", "preservation_plan", "validation_fixtures", "application"],
       "properties": {
         "application": {
           "required": ["runtime", "buildKind", "topology", "entrypoint", "build", "basePath", "evidence", "unsupportedFeatures"],