@fourier-labs/harbour-contracts 0.46.0 → 0.50.0

package/schema/integration-execute-request.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/integration-execute-request.schema.json",
   "title": "IntegrationExecuteRequest",
-  "description": "Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.",
+  "description": "Body of POST /_harbour/integrations/execute (app SDK), forwarded unchanged to the governance development and runtime execute routes. Exactly one declared operation against one declared resource. The identity mode is NOT a caller field: it is fixed by the operation and enforced from the approved grant; any identity/userId/scope field is rejected by additionalProperties. Per-operation input bounds: slack.channel.history {limit? 1..15, default 15}; slack.message.post {text 1..4000 chars} and a required idempotencyKey retained across retries of one explicit Send; gmail.thread.list {limit? 1..15, default 15}; gmail.message.read {messageId}; gmail.message.send {to 1..50 addresses (to+cc+bcc <= 50 in total), cc?, bcc?, subject 1..256 chars, text 1..4000 chars, replyToMessageId?} and a required idempotencyKey like slack.message.post (plain text only, no attachments); warehouse.view.read {columns 1..32, limit? 1..1000, default 100}. Transport limits (not expressible here): request <= 16 KiB, total deadline 10 s.",
   "type": "object",
   "additionalProperties": false,
   "required": ["connection", "operation", "resource", "input"],
@@ -16,18 +16,24 @@
       "properties": {
         "limit": { "type": "integer", "minimum": 1, "maximum": 1000 },
         "text": { "type": "string", "minLength": 1, "maxLength": 4000 },
+        "messageId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$", "description": "gmail.message.read: the Gmail message id a gmail.thread.list result named." },
+        "to": { "$ref": "#/definitions/EmailAddressList", "description": "gmail.message.send: primary recipients." },
+        "cc": { "$ref": "#/definitions/EmailAddressList", "description": "gmail.message.send: carbon-copy recipients." },
+        "bcc": { "$ref": "#/definitions/EmailAddressList", "description": "gmail.message.send: blind-copy recipients." },
+        "subject": { "type": "string", "minLength": 1, "maxLength": 256, "description": "gmail.message.send: one-line subject (no line breaks)." },
+        "replyToMessageId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$", "description": "gmail.message.send: a Gmail message id (from gmail.thread.list / gmail.message.read) the email replies to; the send joins that thread." },
         "columns": {
           "type": "array",
           "minItems": 1,
           "maxItems": 32,
-          "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" }
+          "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/ColumnName" }
         }
       }
     },
     "idempotencyKey": {
       "type": "string",
       "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
-      "description": "UUID of one explicit Send action; required for slack.message.post only. The same key with the same payload and subject returns the recorded outcome for seven days."
+      "description": "UUID of one explicit Send action; required for slack.message.post and gmail.message.send only. The same key with the same payload and subject returns the recorded outcome for seven days."
     }
   },
   "allOf": [
@@ -36,7 +42,7 @@
       "then": {
         "not": { "required": ["idempotencyKey"] },
         "properties": {
-          "input": { "properties": { "limit": { "maximum": 15 } }, "not": { "anyOf": [{ "required": ["text"] }, { "required": ["columns"] }] } }
+          "input": { "properties": { "limit": { "maximum": 15 } }, "not": { "anyOf": [{ "required": ["text"] }, { "required": ["columns"] }, { "required": ["messageId"] }, { "required": ["to"] }, { "required": ["subject"] }] } }
         }
       }
     },
@@ -45,7 +51,7 @@
       "then": {
         "required": ["idempotencyKey"],
         "properties": {
-          "input": { "required": ["text"], "not": { "anyOf": [{ "required": ["limit"] }, { "required": ["columns"] }] } }
+          "input": { "required": ["text"], "not": { "anyOf": [{ "required": ["limit"] }, { "required": ["columns"] }, { "required": ["messageId"] }, { "required": ["to"] }, { "required": ["subject"] }] } }
         }
       }
     },
@@ -54,11 +60,42 @@
       "then": {
         "not": { "required": ["idempotencyKey"] },
         "properties": {
-          "input": { "required": ["columns"], "not": { "required": ["text"] } }
+          "input": { "required": ["columns"], "not": { "anyOf": [{ "required": ["text"] }, { "required": ["messageId"] }, { "required": ["to"] }, { "required": ["subject"] }] } }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "operation": { "const": "gmail.thread.list" } } },
+      "then": {
+        "not": { "required": ["idempotencyKey"] },
+        "properties": {
+          "input": { "properties": { "limit": { "maximum": 15 } }, "not": { "anyOf": [{ "required": ["text"] }, { "required": ["columns"] }, { "required": ["messageId"] }, { "required": ["to"] }, { "required": ["subject"] }] } }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "operation": { "const": "gmail.message.read" } } },
+      "then": {
+        "not": { "required": ["idempotencyKey"] },
+        "properties": {
+          "input": { "required": ["messageId"], "not": { "anyOf": [{ "required": ["text"] }, { "required": ["columns"] }, { "required": ["limit"] }, { "required": ["to"] }, { "required": ["subject"] }] } }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "operation": { "const": "gmail.message.send" } } },
+      "then": {
+        "required": ["idempotencyKey"],
+        "properties": {
+          "input": { "required": ["to", "subject", "text"], "not": { "anyOf": [{ "required": ["limit"] }, { "required": ["columns"] }, { "required": ["messageId"] }] } }
         }
       }
     }
   ],
+  "definitions": {
+    "EmailAddress": { "type": "string", "minLength": 3, "maxLength": 254, "pattern": "^[^\\s@<>,;\"]+@[^\\s@<>,;\"]+\\.[^\\s@<>,;\"]+$", "description": "One bare email address (no display name)." },
+    "EmailAddressList": { "type": "array", "minItems": 1, "maxItems": 50, "uniqueItems": true, "items": { "$ref": "#/definitions/EmailAddress" } }
+  },
   "examples": [
     { "connection": "company-slack", "operation": "slack.channel.history", "resource": "team-updates", "input": { "limit": 15 } },
     {
@@ -68,6 +105,15 @@
       "input": { "text": "Weekly update posted." },
       "idempotencyKey": "6f1c2c1e-3a1c-4c3e-9f0e-2b6f7d8a9c10"
     },
-    { "connection": "sales-warehouse", "operation": "warehouse.view.read", "resource": "weekly_sales", "input": { "columns": ["week", "total"], "limit": 100 } }
+    { "connection": "sales-warehouse", "operation": "warehouse.view.read", "resource": "weekly_sales", "input": { "columns": ["week", "total"], "limit": 100 } },
+    { "connection": "gmail", "operation": "gmail.thread.list", "resource": "inbox", "input": { "limit": 15 } },
+    { "connection": "gmail", "operation": "gmail.message.read", "resource": "inbox", "input": { "messageId": "18f2c3a4b5d6e7f8" } },
+    {
+      "connection": "gmail",
+      "operation": "gmail.message.send",
+      "resource": "inbox",
+      "input": { "to": ["jane@example.com"], "subject": "Weekly report", "text": "Shipped the weekly report.", "replyToMessageId": "18f2c3a4b5d6e7f8" },
+      "idempotencyKey": "6f1c2c1e-3a1c-4c3e-9f0e-2b6f7d8a9c11"
+    }
   ]
 }

package/schema/integration-execute-result.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/integration-execute-result.schema.json",
   "title": "IntegrationExecuteResult",
-  "description": "The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the three operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time only, never the provider payload); slack.message.post -> {messageId}; warehouse.view.read -> {rows} (decimal/64-bit values as strings, dates as ISO strings). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. Results over 1 MiB are rejected, not truncated.",
+  "description": "The `data` member of a successful execute response `{data, requestId}`; the SDK unwraps `data`. Exactly one of the six operation results: slack.channel.history -> {messages, hasMore} (plain text/IDs/time only, never the provider payload); slack.message.post -> {messageId}; gmail.thread.list -> {threads, hasMore} (newest inbox threads; each `messageId` is the thread's newest message, what gmail.message.read takes); gmail.message.read -> {id, threadId, subject, from, to, date, text, truncated} (headers plus the plain text with html stripped, cut at 16 KiB with `truncated` set); gmail.message.send -> {messageId, threadId} (the Gmail ids of the sent message and its thread); warehouse.view.read -> {rows} (decimal/64-bit values as strings, dates as ISO strings). An unknown send outcome is never a result; it is an error with details.code SEND_OUTCOME_UNKNOWN. Results over 1 MiB are rejected, not truncated.",
   "type": "object",
   "additionalProperties": false,
   "properties": {
@@ -13,6 +13,19 @@
     },
     "hasMore": { "type": "boolean" },
     "messageId": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "threads": {
+      "type": "array",
+      "maxItems": 15,
+      "items": { "$ref": "#/definitions/GmailThread" }
+    },
+    "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "threadId": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "subject": { "type": "string", "maxLength": 2048 },
+    "from": { "type": "string", "maxLength": 2048 },
+    "to": { "type": "string", "maxLength": 8192 },
+    "date": { "type": "string", "maxLength": 128 },
+    "text": { "type": "string", "maxLength": 16384 },
+    "truncated": { "type": "boolean" },
     "rows": {
       "type": "array",
       "maxItems": 1000,
@@ -22,9 +35,25 @@
   "oneOf": [
     { "required": ["messages", "hasMore"], "maxProperties": 2 },
     { "required": ["messageId"], "maxProperties": 1 },
+    { "required": ["messageId", "threadId"], "maxProperties": 2 },
+    { "required": ["threads", "hasMore"], "maxProperties": 2 },
+    { "required": ["id", "threadId", "subject", "from", "to", "date", "text", "truncated"], "maxProperties": 8 },
     { "required": ["rows"], "maxProperties": 1 }
   ],
   "definitions": {
+    "GmailThread": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "messageId", "subject", "from", "date", "snippet"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "messageId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "subject": { "type": "string", "maxLength": 2048 },
+        "from": { "type": "string", "maxLength": 2048 },
+        "date": { "type": "string", "maxLength": 128 },
+        "snippet": { "type": "string", "maxLength": 4096 }
+      }
+    },
     "ChannelMessage": {
       "type": "object",
       "additionalProperties": false,
@@ -43,6 +72,12 @@
       "hasMore": false
     },
     { "messageId": "1725840100.000200" },
+    { "messageId": "18f2c3a4b5d6e7f9", "threadId": "18f2c3a4b5d6e7f0" },
+    {
+      "threads": [{ "id": "18f2c3a4b5d6e7f0", "messageId": "18f2c3a4b5d6e7f8", "subject": "Weekly report", "from": "Jane <jane@example.com>", "date": "2026-09-11T08:00:00Z", "snippet": "Shipped the weekly report." }],
+      "hasMore": false
+    },
+    { "id": "18f2c3a4b5d6e7f8", "threadId": "18f2c3a4b5d6e7f0", "subject": "Weekly report", "from": "Jane <jane@example.com>", "to": "team@example.com", "date": "2026-09-11T08:00:00Z", "text": "Shipped the weekly report.", "truncated": false },
     { "rows": [{ "week": "2026-W36", "total": "1234.50" }] }
   ]
 }

package/schema/saas-connection.schema.json

@@ -2,70 +2,99 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/saas-connection.schema.json",
   "title": "SaasConnection",
-  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). IT maps each environment to a provider installation and logical channel aliases to channel IDs; apps only ever see the aliases. Contains references, never secrets: the client secret lives in Secrets Manager under clientSecretRef and installation tokens under their own token records.",
+  "description": "Tenant-wide SaaS connection record (control table sk SAASCONN#<sourceId>, same tenant partition as database sources; alias uniqueness is enforced across both). One connection per tenant and provider: a single bot installation of the platform-owned provider app and a single logical channel map shared by every app environment (grants, requests and user consent links stay per environment). A Gmail connection has neither installation nor channels: user consent is the only step and its one resource is the fixed `inbox` alias. Contains references, never secrets: installation tokens live under their own token records. The pre-T25 per-environment shape (`clientId`, `clientSecretRef`, `environments`, `installations`) is deprecated: the control plane normalises such a stored record on read and never writes it.",
   "type": "object",
   "additionalProperties": false,
-  "required": ["sourceId", "kind", "provider", "displayName", "status", "version", "clientId", "environments", "operations", "developmentPreapproval"],
+  "required": ["schema", "tenantId", "sourceId", "kind", "provider", "displayName", "status", "version", "channels", "operations", "developmentPreapproval", "createdAt", "updatedAt"],
   "properties": {
+    "schema": { "type": "string", "const": "harbour.saas-connection/1.0" },
+    "tenantId": { "type": "string", "minLength": 1, "maxLength": 255 },
     "sourceId": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
     "kind": { "type": "string", "const": "saas" },
-    "provider": { "type": "string", "enum": ["slack"] },
-    "displayName": { "type": "string", "minLength": 1, "maxLength": 255 },
+    "provider": { "$ref": "#/definitions/SaasProvider" },
+    "displayName": { "type": "string", "minLength": 1, "maxLength": 120 },
     "status": { "$ref": "#/definitions/SaasConnectionStatus" },
     "version": { "type": "integer", "minimum": 1, "description": "Optimistic-concurrency version; every write is conditional on it." },
-    "clientId": { "type": "string", "minLength": 1, "maxLength": 255 },
+    "installation": { "$ref": "#/definitions/SaasInstallation" },
+    "channels": {
+      "type": "object",
+      "maxProperties": 64,
+      "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
+      "additionalProperties": { "type": "string", "pattern": "^[A-Z0-9]{5,20}$", "description": "Provider channel ID; only public, non-archived channels are valid." },
+      "description": "Logical channel alias -> provider channel ID, shared by every environment. Always empty for Gmail."
+    },
+    "operations": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 5,
+      "uniqueItems": true,
+      "items": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationOperation" },
+      "not": { "contains": { "const": "warehouse.view.read" } },
+      "description": "Operations IT allows apps to request on this connection: the provider's own SaaS operations (Slack: slack.channel.history, slack.message.post; Gmail: gmail.thread.list, gmail.message.read, gmail.message.send). Never warehouse.view.read."
+    },
+    "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
+    "blockedDevelopmentBuilders": {
+      "type": "array",
+      "maxItems": 256,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1, "maxLength": 255 },
+      "description": "Lower-cased builder emails excluded from development preapproval."
+    },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" },
+    "clientId": { "type": "string", "minLength": 1, "maxLength": 255, "deprecated": true, "description": "Deprecated (pre-T25 tenant-owned provider client). Dropped on read; never written." },
     "clientSecretRef": {
       "type": "string",
       "pattern": "^secretref://[A-Za-z0-9][A-Za-z0-9/_.:-]*$",
-      "description": "secretref://tenant/{tenantId}/saas/{sourceId}/client"
+      "deprecated": true,
+      "description": "Deprecated (pre-T25 tenant-owned provider client secret reference). Dropped on read; never written."
     },
     "environments": {
       "type": "object",
       "additionalProperties": false,
       "minProperties": 1,
+      "deprecated": true,
+      "description": "Deprecated pre-T25 per-environment mapping. On read the development entry's channels become `channels`; never written.",
       "properties": {
         "development": { "$ref": "#/definitions/SaasEnvironmentMapping" },
         "preview": { "$ref": "#/definitions/SaasEnvironmentMapping" },
         "production": { "$ref": "#/definitions/SaasEnvironmentMapping" }
       }
     },
-    "operations": {
-      "type": "array",
-      "minItems": 1,
-      "maxItems": 2,
-      "uniqueItems": true,
-      "items": { "type": "string", "enum": ["slack.channel.history", "slack.message.post"] },
-      "description": "Operations IT allows apps to request on this connection."
-    },
-    "developmentPreapproval": { "$ref": "#/definitions/DevelopmentPreapproval" },
     "installations": {
       "type": "object",
       "propertyNames": { "$ref": "#/definitions/InstallationName" },
-      "additionalProperties": { "$ref": "#/definitions/SaasInstallation" },
-      "description": "Provider installations keyed by the installation name environments point at."
-    },
-    "createdAt": { "type": "string", "format": "date-time" },
-    "updatedAt": { "type": "string", "format": "date-time" }
+      "additionalProperties": { "$ref": "#/definitions/LegacySaasInstallation" },
+      "deprecated": true,
+      "description": "Deprecated pre-T25 named installations. On read the `nonprod` entry (or the development mapping's) becomes `installation`; never written."
+    }
   },
   "definitions": {
+    "SaasProvider": {
+      "type": "string",
+      "enum": ["slack", "gmail"],
+      "description": "Slack carries an installation and a channel map; Gmail is user-consent only and read-only."
+    },
     "SaasConnectionStatus": {
       "type": "string",
       "enum": ["ACTIVE", "DISABLED"],
       "description": "DISABLED stops every app call immediately (details.code CONNECTION_DISABLED)."
     },
-    "InstallationName": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,62}$" },
-    "SaasEnvironmentMapping": {
+    "SaasInstallationStatus": {
+      "type": "string",
+      "enum": ["installed", "reconnect_required", "revoked"]
+    },
+    "SaasInstallation": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["installation", "channels"],
+      "required": ["tokenRecordId", "workspaceId", "botUserId", "status", "installedAt"],
+      "description": "The one bot installation of the platform-owned provider app in this tenant's workspace.",
       "properties": {
-        "installation": { "$ref": "#/definitions/InstallationName" },
-        "channels": {
-          "type": "object",
-          "maxProperties": 64,
-          "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
-          "additionalProperties": { "type": "string", "pattern": "^[A-Z0-9]{1,32}$", "description": "Provider channel ID; only public, non-archived channels are valid." }
-        }
+        "tokenRecordId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "workspaceId": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "botUserId": { "type": "string", "maxLength": 128, "description": "Empty only for a legacy record normalised without one." },
+        "status": { "$ref": "#/definitions/SaasInstallationStatus" },
+        "installedAt": { "type": "string", "format": "date-time" }
       }
     },
     "DevelopmentPreapproval": {
@@ -77,10 +106,26 @@
         "hours": { "type": "integer", "minimum": 1, "maximum": 168, "description": "Development grant duration; default 24." }
       }
     },
-    "SaasInstallation": {
+    "InstallationName": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,62}$", "deprecated": true },
+    "SaasEnvironmentMapping": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["tokenRecordId", "workspaceId", "botUserId", "status"],
+      "required": ["installation", "channels"],
+      "deprecated": true,
+      "properties": {
+        "installation": { "$ref": "#/definitions/InstallationName" },
+        "channels": {
+          "type": "object",
+          "maxProperties": 64,
+          "propertyNames": { "$ref": "app-integrations-declaration.schema.json#/definitions/IntegrationAlias" },
+          "additionalProperties": { "type": "string", "pattern": "^[A-Z0-9]{1,32}$" }
+        }
+      }
+    },
+    "LegacySaasInstallation": {
+      "type": "object",
+      "additionalProperties": false,
+      "deprecated": true,
       "properties": {
         "tokenRecordId": { "type": "string", "minLength": 1, "maxLength": 128 },
         "workspaceId": { "type": "string", "minLength": 1, "maxLength": 128 },
@@ -91,25 +136,36 @@
   },
   "examples": [
     {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
       "sourceId": "company-slack",
       "kind": "saas",
       "provider": "slack",
       "displayName": "Company Slack",
       "status": "ACTIVE",
       "version": 3,
-      "clientId": "1234567890.1234567890",
-      "clientSecretRef": "secretref://tenant/fourier/saas/company-slack/client",
-      "environments": {
-        "development": { "installation": "nonprod", "channels": { "team-updates": "C0123NONPROD" } },
-        "production": { "installation": "prod", "channels": { "team-updates": "C0123PROD" } }
-      },
+      "installation": { "tokenRecordId": "tok_workspace", "workspaceId": "T0WORKSPACE", "botUserId": "U0BOT", "status": "installed", "installedAt": "2026-09-09T08:00:00Z" },
+      "channels": { "team-updates": "C0123TEAM" },
       "operations": ["slack.channel.history", "slack.message.post"],
       "developmentPreapproval": { "enabled": true, "hours": 24 },
-      "installations": {
-        "nonprod": { "tokenRecordId": "tok_nonprod", "workspaceId": "T0NONPROD", "botUserId": "U0BOT", "status": "ACTIVE" }
-      },
       "createdAt": "2026-09-09T08:00:00Z",
       "updatedAt": "2026-09-09T08:00:00Z"
+    },
+    {
+      "schema": "harbour.saas-connection/1.0",
+      "tenantId": "fourier",
+      "sourceId": "gmail",
+      "kind": "saas",
+      "provider": "gmail",
+      "displayName": "Gmail",
+      "status": "ACTIVE",
+      "version": 1,
+      "channels": {},
+      "operations": ["gmail.thread.list", "gmail.message.read", "gmail.message.send"],
+      "developmentPreapproval": { "enabled": false, "hours": 24 },
+      "blockedDevelopmentBuilders": ["contractor@example.com"],
+      "createdAt": "2026-09-11T08:00:00Z",
+      "updatedAt": "2026-09-11T08:00:00Z"
     }
   ]
 }

package/schema/transform-report.schema.json

@@ -9,6 +9,7 @@
   "required": ["application"],
   "properties": {
     "applied_playbooks": {
+      "description": "Optional self-report of the playbooks the agent says it applied. A claim about its own behaviour is not evidence, so nothing validates it; a deployable report may omit it, and one that still carries it stays valid.",
       "type": "array",
       "minItems": 1,
       "items": { "type": "string", "minLength": 1 }
@@ -666,7 +667,7 @@
   ],
   "oneOf": [
     {
-      "required": ["applied_playbooks", "static_rebuild_required", "analysis", "database", "preservation_plan", "validation_fixtures", "application"],
+      "required": ["static_rebuild_required", "analysis", "database", "preservation_plan", "validation_fixtures", "application"],
       "properties": {
         "application": {
           "required": ["runtime", "buildKind", "topology", "entrypoint", "build", "basePath", "evidence", "unsupportedFeatures"],

package/schema/well-defined-app-manifest.schema.json

@@ -26,9 +26,70 @@
       "type": "array",
       "maxItems": 128,
       "items": { "$ref": "#/definitions/WorkloadBinding" }
+    },
+    "runtime": {
+      "type": "string",
+      "pattern": "^(?:nodejs|python)[0-9]+(?:\\.[0-9]+)?$",
+      "description": "Optional language runtime the application container is built on, spelled exactly as transform-report.application.runtime does (nodejs22, python3.11). Optional so a manifest written before the producer emits it still validates."
+    },
+    "capabilities": {
+      "type": "array",
+      "maxItems": 5,
+      "uniqueItems": true,
+      "items": { "$ref": "#/definitions/Capability" },
+      "description": "Optional declaration of the Harbour browser capabilities the application uses. Same closed set as the app-capabilities document; this is the declaration, not a source scan."
+    },
+    "routeAuth": {
+      "$ref": "#/definitions/RouteAuth",
+      "description": "Optional method/path authentication policy. Omitted means every route requires Harbour SSO, the same default the policy states explicitly."
     }
   },
   "definitions": {
+    "Capability": {
+      "type": "string",
+      "enum": ["data", "files", "actions", "realtime", "telemetry"]
+    },
+    "RouteAuth": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["default", "public"],
+      "description": "Harbour SSO is required by default; the public list is the only way a route escapes it, and each entry names the methods and the application-authorized mode so the artifact contract's route_auth can be built from this document alone.",
+      "properties": {
+        "default": {
+          "type": "string",
+          "const": "sso_required",
+          "default": "sso_required"
+        },
+        "public": {
+          "type": "array",
+          "maxItems": 64,
+          "default": [],
+          "items": { "$ref": "#/definitions/PublicRoute" }
+        }
+      }
+    },
+    "PublicRoute": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "methods", "mode"],
+      "properties": {
+        "path": {
+          "type": "string",
+          "pattern": "^/(?:[A-Za-z0-9._~-]+/)*(?:[A-Za-z0-9._~-]+|\\*)$"
+        },
+        "methods": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 7,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "enum": ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+          }
+        },
+        "mode": { "type": "string", "const": "application_authorized" }
+      }
+    },
     "ResourceProfile": {
       "type": "string",
       "enum": ["standard", "memory-1g", "memory-2g"]