@fourier-labs/harbour-contracts 0.5.0 → 0.9.0

package/dist/gen-ts/kvs-routing-entry.d.ts

@@ -1,13 +1,27 @@
 /**
- * Value stored in the CloudFront KeyValueStore, keyed by host header `<app>.(beta.)harbour.dev` and read by the CloudFront Function on every request (LLD §8). MVP carries exactly {static, api} and nothing else — quota/kill-switch fields are a deliberate, additive future extension consumed by the same function.
+ * Value stored in the CloudFront KeyValueStore and read by the viewer-request router on EVERY request. Keyed by `<org>.<app>` — the tenant-qualified app identity, not a host header; slugs are lowercase DNS-label-shaped and cannot contain dots, so the single dot is an unambiguous separator. Two constraints cannot be expressed in JSON Schema and are enforced in the router: the TOTAL length of all `staticAssetPrefixes` must not exceed 512 bytes, and the array must be empty when `routeMode` is `static`. Written by cutover; a request whose entry fails any of these rules is refused at the edge rather than routed on a guess.
  */
 export interface KvsRoutingEntry {
     /**
-     * S3 origin path for static assets of the LIVE version, e.g. `builds/<app>/<digest>/` (from the artifact `static.path`, LLD §3).
+     * Immutable prefix of the LIVE version's static output: `builds/<org>/<app>/<64-hex-digest>`, with no trailing slash. The digest is what makes a cutover safe — the router rewrites matching requests to this prefix before the cache lookup, so it is also the edge cache key, and a new version therefore cannot serve the previous version's cached bytes.
      */
-    static: string;
+    staticPath: string;
     /**
-     * Backend target for `/api/*` routes — the Lambda alias reached via API Gateway / Function URL for the LIVE version.
+     * Whether the app has an application runtime. REQUIRED: an entry without it is refused with 503 rather than guessed at. In `server` mode a path under a declared `staticAssetPrefixes` entry is served from S3 and everything else goes to `apiDomain`; in `static` mode every path is served from S3.
      */
-    api: string;
+    routeMode: 'server' | 'static';
+    /**
+     * The version's monotonic sequence number within its lane. Cutover uses it to keep writes one-way: an entry is only replaced by a strictly higher ordinal, so a delayed or replayed write cannot move an app backwards.
+     */
+    ordinal: number;
+    /**
+     * The app runtime's AWS_IAM-protected Lambda Function URL host. Required in `server` mode and omitted entirely for a static-only app. The router refuses any other domain shape, so this cannot be pointed at an arbitrary origin.
+     */
+    apiDomain?: string;
+    /**
+     * Build-derived prefixes that a `server` app serves from its immutable S3 output rather than from its runtime, e.g. `_next/static/`. Derived from verified build output, never from framework names. Must be strictly ascending, must total at most 512 bytes, and must be absent or empty in `static` mode — the last two are enforced in the router because JSON Schema cannot express them. Omitted when empty: a server app with public build output and no prefixes serves every asset from its Lambda, which is a build-plan defect rather than a routing one.
+     *
+     * @maxItems 16
+     */
+    staticAssetPrefixes?: string[];
 }

package/dist/gen-ts/promotion-request.d.ts

@@ -14,4 +14,27 @@ export interface PromotionRequest {
      * Durable caller-generated key. Identical replays return the original production version; reuse with a changed request is rejected.
      */
     idempotencyKey: string;
+    environmentBindings?: PromotionRequestEnvironmentBindings;
+}
+/**
+ * Optional secret bindings for the production version. Additive: promotions without it remain valid, and a deployment plane that ignores the field behaves exactly as before. Named environmentBindings to match deploy-request.schema.json, whose preview counterpart this mirrors.
+ */
+export interface PromotionRequestEnvironmentBindings {
+    /**
+     * Secret bindings for the production version. An empty array is meaningful: it says the caller looked and the app declares no secrets.
+     */
+    bindings: PromotionRequestSecretBinding[];
+}
+/**
+ * One secret binding. Unlike the preview counterpart there is no `value` member and `secretRef` is required, so a plain literal is unrepresentable on the promotion path rather than merely refused by the handler. The secretRef pattern admits only the app-secret shape, which is what keeps a promotion from naming a tenant integration credential.
+ */
+export interface PromotionRequestSecretBinding {
+    /**
+     * Environment-variable name the app reads.
+     */
+    name: string;
+    /**
+     * Governance reference the deployment plane resolves. The value never appears in the request, in this schema, or in any record derived from it.
+     */
+    secretRef: string;
 }

package/dist/gen-ts/transform-report.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Structured output an agent must return from one Harbour transformation attempt. Handed to the agent as its output schema, then decoded and semantically re-validated by the control plane, which remains the authority. The enum on applied_playbooks.items is the one dynamic part: the adapter injects the names of the playbooks supplied for that invocation before writing the document, so the model is structurally prevented from naming a playbook it was not given. Application-secret handling was removed platform-wide, so this document carries no redactions and no secrets fields.
+ */
+export interface TransformReport {
+    /**
+     * @minItems 1
+     */
+    applied_playbooks: string[];
+    static_rebuild_required: boolean;
+    analysis: {
+        deployable: boolean;
+        needsTransformation: boolean;
+        /**
+         * @maxItems 64
+         */
+        blockers: string[];
+        /**
+         * @minItems 1
+         * @maxItems 1024
+         */
+        surfaces: string[];
+        /**
+         * @maxItems 1024
+         */
+        evidence: {
+            path: string;
+            line: number;
+            reason: string;
+        }[];
+    };
+    database: {
+        mode: 'none' | 'sql' | 'unsupported';
+        changeType: 'none' | 'code_only' | 'schema_only' | 'code_and_schema';
+        requiresCodeChanges: boolean;
+        requiresSchemaMigration: boolean;
+        desiredSchemaPath: string;
+        /**
+         * @maxItems 128
+         */
+        migrationPaths: string[];
+        /**
+         * @maxItems 512
+         */
+        changedFiles: string[];
+        /**
+         * @maxItems 128
+         */
+        evidence: {
+            path: string;
+            line: number;
+            reason: string;
+        }[];
+        /**
+         * @maxItems 64
+         */
+        unsupportedFeatures: string[];
+    };
+    application: {
+        runtime: string;
+        buildKind: 'container' | 'static';
+        topology: 'static' | 'backend' | 'frontend_and_backend';
+        entrypoint: string;
+        build: {
+            /**
+             * @minItems 1
+             * @maxItems 64
+             */
+            installCommand: string[];
+            /**
+             * @minItems 1
+             * @maxItems 64
+             */
+            buildCommand: string[];
+            /**
+             * @minItems 1
+             * @maxItems 16
+             */
+            outputs: {
+                path: string;
+                kind: 'public' | 'backend';
+                route: string;
+            }[];
+        };
+        basePath: {
+            required: boolean;
+            environmentVariable: 'HARBOUR_BASE_PATH';
+        };
+        /**
+         * @minItems 1
+         * @maxItems 64
+         */
+        evidence: {
+            path: string;
+            line: number;
+            reason: string;
+        }[];
+        /**
+         * @maxItems 64
+         */
+        unsupportedFeatures: string[];
+    };
+}

package/dist/gen-ts/transform-report.js

@@ -0,0 +1,3 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+export {};

package/fixtures/ai/valid-blocked-trace-event.json

@@ -0,0 +1,31 @@
+{
+  "schema": "harbour.ai-trace-event/1.0",
+  "traceId": "trc_blocked123",
+  "requestId": "req_blocked123",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "production",
+  "versionId": "fourier#support-assistant#production#000124",
+  "policyDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "requestedModel": "gpt-4.1-mini",
+  "governedModelAlias": "harbour/standard",
+  "outcome": "blocked",
+  "costMicroUsd": 0,
+  "latencyMs": 4,
+  "retryCount": 0,
+  "fallbackUsed": false,
+  "reservationId": "req_blocked123#budget",
+  "attempts": [],
+  "guardrailResults": [
+    {
+      "ruleId": "input-secret-pattern",
+      "detectorId": "input.secret_pattern",
+      "detectorVersion": "1.0.0",
+      "phase": "input",
+      "action": "BLOCK",
+      "result": "blocked"
+    }
+  ],
+  "contentCaptureStatus": "off",
+  "occurredAt": "2026-08-02T10:00:00Z"
+}

package/fixtures/ai/valid-budget-ledger-event.json

@@ -0,0 +1,15 @@
+{
+  "schema": "harbour.ai-budget-ledger-event/2.0",
+  "eventId": "ledger_000124_1",
+  "idempotencyKey": "reserve_000124",
+  "budgetScope": "fourier/support-assistant/production",
+  "period": "2026-08",
+  "eventType": "RESERVED",
+  "reservationId": "req_example123#budget",
+  "requestId": "req_example123",
+  "amountMicroUsd": 500,
+  "committedMicroUsdAfter": 10500,
+  "pricingRevisionDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "eventDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "occurredAt": "2026-08-10T10:00:00Z"
+}

package/fixtures/ai/valid-classification-stamp.json

@@ -0,0 +1,19 @@
+{
+  "schema": "harbour.ai-classification-stamp/1.0",
+  "stampId": "cls_000124",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "sourceRevision": "0123456789abcdef",
+  "status": "AVAILABLE",
+  "classification": "Yellow",
+  "classifierId": "harbour-source-classifier",
+  "classifierVersion": "1.0.0",
+  "sourceDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "inventoryDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "securityEvidenceDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "evidenceDigest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "stampDigest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+  "stampedAt": "2026-08-10T10:00:00Z"
+}

package/fixtures/ai/valid-composite-policy-digest.json

@@ -0,0 +1,11 @@
+{
+  "input": {
+    "schema": "harbour.ai-composite-policy-digest/1.0",
+    "baselineDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "classificationStampDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "tenantPolicyDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+    "applicationPolicyDigest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+  },
+  "preimage": "harbour.ai-composite-policy-digest/1\nsha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\nsha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\nsha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc\nsha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd\n-",
+  "digest": "sha256:b6cf8539c27e06d64213c564c40455d56303cbf30fd346253ea1842c7377d2a0"
+}

package/fixtures/ai/valid-deployment-gate-decision.json

@@ -0,0 +1,18 @@
+{
+  "schema": "harbour.ai-deployment-gate-decision/1.0",
+  "decisionId": "gate_000124_1",
+  "sequence": 1,
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "sourceRevision": "0123456789abcdef",
+  "decision": "PASS",
+  "reasonCodes": [],
+  "classificationStampDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "planDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "policyDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "evidenceDigest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "decisionDigest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+  "decidedAt": "2026-08-10T10:05:00Z"
+}

package/fixtures/ai/valid-failed-trace-event.json

@@ -0,0 +1,50 @@
+{
+  "schema": "harbour.ai-trace-event/1.0",
+  "traceId": "trc_failed123",
+  "requestId": "req_failed123",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "production",
+  "versionId": "fourier#support-assistant#production#000124",
+  "callsiteFingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "policyDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "routeRevision": "harbour/standard#3",
+  "requestedModel": "gpt-4.1-mini",
+  "governedModelAlias": "harbour/standard",
+  "provider": "openai",
+  "providerModel": "gpt-4.1-mini",
+  "outcome": "failed",
+  "priceRevision": "openai-gpt-4.1-mini-2026-08-01",
+  "costMicroUsd": 48,
+  "latencyMs": 31204,
+  "retryCount": 1,
+  "fallbackUsed": false,
+  "reservationId": "req_failed123#budget",
+  "attempts": [
+    {
+      "attempt": 1,
+      "provider": "openai",
+      "providerModel": "gpt-4.1-mini",
+      "priceRevision": "openai-gpt-4.1-mini-2026-08-01",
+      "outcome": "failed",
+      "usage": null,
+      "costMicroUsd": 0,
+      "latencyMs": 30001,
+      "errorCode": "provider_unavailable"
+    },
+    {
+      "attempt": 2,
+      "provider": "openai",
+      "providerModel": "gpt-4.1-mini",
+      "priceRevision": "openai-gpt-4.1-mini-2026-08-01",
+      "outcome": "failed",
+      "usage": { "inputTokens": 120, "outputTokens": 0 },
+      "costMicroUsd": 48,
+      "latencyMs": 1203,
+      "errorCode": "provider_server_error"
+    }
+  ],
+  "guardrailResults": [],
+  "contentCaptureStatus": "off",
+  "occurredAt": "2026-08-02T10:00:00Z"
+}

package/fixtures/ai/valid-gateway-key-lifecycle-event.json

@@ -0,0 +1,16 @@
+{
+  "schema": "harbour.ai-gateway-key-lifecycle-event/1.0",
+  "eventId": "keyevt_000124_2",
+  "sequence": 2,
+  "keyId": "0123456789abcdef0123456789abcdef",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "fromStatus": "PENDING",
+  "toStatus": "ACTIVE",
+  "cause": "ACTIVATION",
+  "secretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+  "eventDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "occurredAt": "2026-08-10T10:03:00Z"
+}

package/fixtures/ai/valid-gateway-key-lookup.json

@@ -0,0 +1,14 @@
+{
+  "schema": "harbour.ai-gateway-key-lookup/1.0",
+  "keyId": "0123456789abcdef0123456789abcdef",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "tokenPrefix": "hbr_test_",
+  "status": "ACTIVE",
+  "keyMac": "AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRobHB0eHyA=",
+  "createdAt": "2026-08-02T09:59:00Z",
+  "activatedAt": "2026-08-02T10:00:00Z",
+  "expiresAt": "2026-09-01T10:00:00Z"
+}

package/fixtures/ai/valid-governance-decision.json

@@ -0,0 +1,53 @@
+{
+  "schema": "harbour.ai-governance-decision/1.0",
+  "phase": "PLAN",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "sourceRevision": "0123456789abcdef",
+  "decision": "PASS",
+  "interceptionPath": "DETERMINISTIC_ADAPTER",
+  "reasonCodes": [],
+  "uncoveredCallsiteFingerprints": [],
+  "inventoryDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "policyDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "runtimeContractDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "interceptionPlan": [
+    {
+      "callSiteFingerprint": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "sourcePath": "src/ai-client.ts",
+      "expectedSourceFileSha256": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "strategy": "deterministic_adapter",
+      "allowedSyntaxKinds": ["ImportDeclaration", "NewExpression"],
+      "transformId": "google-genai-client-boundary",
+      "transformVersion": "1.0.0",
+      "runtimeShimName": "@harbour/gemini-compat",
+      "runtimeShimVersion": "1.0.0",
+      "runtimeShimDigest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+    }
+  ],
+  "interceptionPlanDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+  "runtimeContract": {
+    "schema": "harbour.ai-runtime-contract/1.0",
+    "tenantId": "fourier",
+    "appId": "support-assistant",
+    "environment": "preview",
+    "versionId": "fourier#support-assistant#preview#000124",
+    "sourceRevision": "0123456789abcdef",
+    "mode": "enforce",
+    "gatewayBaseUrl": "https://ai.harbour.example/v1",
+    "gatewayKeySecretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+    "modelAliases": { "generation": "harbour/standard" },
+    "policyDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "runtimeBinding": {
+      "schema": "harbour.ai-runtime-binding/1.0",
+      "platform": "aws_lambda",
+      "workloadIdentityRef": "iam-role://harbour/preview/support-assistant/000124",
+      "secretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+      "runtimeBindingDigest": "sha256:6666666666666666666666666666666666666666666666666666666666666666"
+    },
+    "requiredStrategies": ["deterministic_adapter"]
+  },
+  "decidedAt": "2026-08-02T10:00:00Z"
+}

package/fixtures/ai/valid-inventory.json

@@ -0,0 +1,30 @@
+{
+  "schema": "harbour.ai-callsite-inventory/1.0",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "sourceRevision": "0123456789abcdef",
+  "analyzerVersion": "ai-callsites/1.0",
+  "coverage": "complete_for_supported_sdks",
+  "scanStatus": "cybersecurity_scan_unavailable",
+  "callsites": [
+    {
+      "fingerprint": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "path": "src/ai-client.ts",
+      "sourceFileSha256": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "line": 18,
+      "language": "typescript",
+      "sdk": "openai",
+      "method": "responses.create",
+      "requestedModel": "gpt-4.1-mini",
+      "strategy": "deployment_injection",
+      "status": "detected",
+      "securityFindingIds": [],
+      "evidence": {
+        "fingerprint": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+        "excerpt": "openai call via responses.create"
+      }
+    }
+  ]
+}

package/fixtures/ai/valid-metering-policy.json

@@ -0,0 +1,8 @@
+{
+  "schema": "harbour.ai-metering-policy/2.0",
+  "policyDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "pricingRevisionDigests": ["sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"],
+  "reservationMode": "committed_exposure",
+  "policyDigestV2": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "publishedAt": "2026-08-10T09:00:00Z"
+}

package/fixtures/ai/valid-policy-snapshot.json

@@ -0,0 +1,117 @@
+{
+  "schema": "harbour.ai-policy-snapshot/1.0",
+  "scope": {
+    "level": "application_environment",
+    "tenantId": "fourier",
+    "appId": "support-assistant",
+    "environment": "preview"
+  },
+  "revision": 3,
+  "publishedAt": "2026-08-02T10:00:00Z",
+  "contentDigest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "baselineDigest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+  "classificationMinimum": {
+    "classification": "Yellow",
+    "mappingDigest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+  },
+  "providers": [
+    {
+      "id": "openai-primary",
+      "provider": "openai",
+      "baseUrl": "https://api.openai.com/v1",
+      "credentialSecretRef": "aws-sm://harbour/nonprod/ai/providers/openai/primary",
+      "enabled": true
+    }
+  ],
+  "models": [
+    {
+      "id": "openai-gpt-4.1-mini",
+      "providerId": "openai-primary",
+      "providerModel": "gpt-4.1-mini",
+      "capabilities": ["generation"],
+      "approved": true,
+      "pricing": {
+        "revision": "openai-gpt-4.1-mini-2026-08-01",
+        "inputMicroUsdPerMillion": 400000,
+        "outputMicroUsdPerMillion": 1600000
+      }
+    }
+  ],
+  "routes": [
+    {
+      "alias": "harbour/standard",
+      "version": 3,
+      "capability": "generation",
+      "targets": [
+        { "modelId": "openai-gpt-4.1-mini", "priority": 0, "weight": 10000 }
+      ],
+      "retryCount": 1,
+      "timeoutMs": 30000
+    }
+  ],
+  "policies": [
+    {
+      "name": "default-generation",
+      "version": 2,
+      "maxRequestBytes": 2097152,
+      "maxInputTokens": 32000,
+      "maxOutputTokens": 4096,
+      "bufferedDelivery": false,
+      "permittedRequestFields": {
+        "temperature": true,
+        "maxOutputTokens": true,
+        "responseFormat": false,
+        "tools": true
+      },
+      "guardrails": [
+        {
+          "ruleId": "input-tool-name-allowlist",
+          "detectorId": "tool.name_allowlist",
+          "detectorVersion": "1.0.0",
+          "phase": "input",
+          "action": "BLOCK",
+          "parameters": {
+            "allowedTools": ["search_documents"]
+          }
+        },
+        {
+          "ruleId": "output-json-shape",
+          "detectorId": "output.json_schema",
+          "detectorVersion": "1.0.0",
+          "phase": "output",
+          "action": "BLOCK",
+          "parameters": {
+            "jsonSchema": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "answer": { "type": "string", "maxLength": 4000 },
+                "citations": {
+                  "type": "array",
+                  "maxItems": 16,
+                  "items": { "type": "string", "maxLength": 256 }
+                }
+              },
+              "required": ["answer"]
+            }
+          }
+        }
+      ]
+    }
+  ],
+  "limits": [
+    {
+      "name": "application-default",
+      "enabled": true,
+      "scope": "application",
+      "requestsPerMinute": 60,
+      "tokensPerMinute": 100000,
+      "monthlyBudgetMicroUsd": 100000000
+    }
+  ],
+  "retention": {
+    "captureMode": "BEST_EFFORT",
+    "retentionDays": 30,
+    "revealRoles": ["tenant-admin"]
+  }
+}

package/fixtures/ai/valid-pricing-revision.json

@@ -0,0 +1,14 @@
+{
+  "schema": "harbour.ai-pricing-revision/2.0",
+  "revisionId": "openai-gpt-test-2026-08-10",
+  "provider": "openai",
+  "providerModel": "gpt-test",
+  "currency": "USD",
+  "dimensions": [
+    { "dimension": "tokens", "direction": "input", "unit": "token", "scale": 1000000, "microUsdPerScale": 100000 },
+    { "dimension": "tokens", "direction": "output", "unit": "token", "scale": 1000000, "microUsdPerScale": 200000 }
+  ],
+  "revisionDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "effectiveAt": "2026-08-10T00:00:00Z",
+  "publishedAt": "2026-08-10T09:00:00Z"
+}

package/fixtures/ai/valid-runtime-binding.json

@@ -0,0 +1,7 @@
+{
+  "schema": "harbour.ai-runtime-binding/1.0",
+  "platform": "aws_lambda",
+  "workloadIdentityRef": "iam-role://harbour/preview/support-assistant/000124",
+  "secretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+  "runtimeBindingDigest": "sha256:6666666666666666666666666666666666666666666666666666666666666666"
+}

package/fixtures/ai/valid-runtime-contract.json

@@ -0,0 +1,24 @@
+{
+  "schema": "harbour.ai-runtime-contract/1.0",
+  "tenantId": "fourier",
+  "appId": "support-assistant",
+  "environment": "preview",
+  "versionId": "fourier#support-assistant#preview#000124",
+  "sourceRevision": "0123456789abcdef",
+  "mode": "observe",
+  "gatewayBaseUrl": "https://ai.harbour.example/v1",
+  "gatewayKeySecretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+  "modelAliases": {
+    "generation": "harbour/standard",
+    "embeddings": "harbour/embeddings"
+  },
+  "policyDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "runtimeBinding": {
+    "schema": "harbour.ai-runtime-binding/1.0",
+    "platform": "aws_lambda",
+    "workloadIdentityRef": "iam-role://harbour/preview/support-assistant/000124",
+    "secretRef": "aws-sm://harbour/ai/fourier/support-assistant/preview/versions/000124/gateway-key",
+    "runtimeBindingDigest": "sha256:6666666666666666666666666666666666666666666666666666666666666666"
+  },
+  "requiredStrategies": ["deployment_injection"]
+}

package/fixtures/ai/valid-trace-event-v2.json

@@ -0,0 +1,24 @@
+{
+  "schema": "harbour.ai-trace-event/2.0",
+  "traceId": "trc_example123",
+  "requestId": "req_example123",
+  "policyDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "outcome": "succeeded",
+  "usageLineItems": [
+    {
+      "attempt": 1,
+      "dimension": "tokens",
+      "direction": "input",
+      "quantity": 120,
+      "unit": "token",
+      "priceRevisionDigest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "scale": 1000000,
+      "costMicroUsd": 12,
+      "provenance": "reported"
+    }
+  ],
+  "totalCostMicroUsd": 12,
+  "reservationId": "req_example123#budget",
+  "meteringStatus": "settled",
+  "occurredAt": "2026-08-10T10:00:00Z"
+}