@mnstry/atelier 0.2.0-alpha.1

package/contracts/atelier-analysis-adapter.v1.schema.json

@@ -0,0 +1,360 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-analysis-adapter.v1.schema.json",
+  "$comment": "contract revision 1.1.0 (contract-stability epoch)",
+  "title": "atelier-analysis-adapter@v1",
+  "description": "Provider-neutral contract for optional analysis adapters. Analysis may emit proposed claims, but cannot mutate canonical Atelier state.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/manifest"
+    },
+    {
+      "$ref": "#/$defs/proposals"
+    }
+  ],
+  "$defs": {
+    "manifest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "adapterId",
+        "provider",
+        "enabled",
+        "outputRoot",
+        "claimContract",
+        "execution",
+        "authority"
+      ],
+      "properties": {
+        "schema": {
+          "const": "atelier-analysis-adapter@v1"
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        },
+        "adapterId": {
+          "type": "string",
+          "pattern": "^atelier\\.analysis\\.[a-z0-9][a-z0-9.-]*$"
+        },
+        "provider": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9.-]*$"
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": false
+        },
+        "outputRoot": {
+          "$ref": "#/$defs/localPath"
+        },
+        "claimContract": {
+          "const": "atelier-claim@v1"
+        },
+        "execution": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "posture",
+            "hiddenModelProvider",
+            "network",
+            "installCommand",
+            "executeCommand"
+          ],
+          "properties": {
+            "posture": {
+              "enum": [
+                "inert",
+                "dry-run",
+                "reviewed-executor"
+              ]
+            },
+            "hiddenModelProvider": {
+              "const": false
+            },
+            "network": {
+              "enum": [
+                "none",
+                "active-harness-approved"
+              ]
+            },
+            "installCommand": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "executeCommand": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "reviewedBy": {
+              "type": "string",
+              "minLength": 1
+            },
+            "reviewedAt": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "ext": {
+              "type": "object",
+              "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+            }
+          },
+          "allOf": [
+            {
+              "if": {
+                "properties": {
+                  "posture": {
+                    "const": "inert"
+                  }
+                },
+                "required": [
+                  "posture"
+                ]
+              },
+              "then": {
+                "properties": {
+                  "network": {
+                    "const": "none"
+                  },
+                  "installCommand": {
+                    "type": "null"
+                  },
+                  "executeCommand": {
+                    "type": "null"
+                  }
+                }
+              }
+            },
+            {
+              "if": {
+                "properties": {
+                  "posture": {
+                    "const": "reviewed-executor"
+                  }
+                },
+                "required": [
+                  "posture"
+                ]
+              },
+              "then": {
+                "required": [
+                  "reviewedBy",
+                  "reviewedAt"
+                ]
+              }
+            }
+          ]
+        },
+        "authority": {
+          "$ref": "#/$defs/claimOnlyAuthority"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "proposals": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "provider",
+        "generatedAt",
+        "proposals",
+        "authority"
+      ],
+      "properties": {
+        "schema": {
+          "const": "atelier-proposals@v1"
+        },
+        "contractVersion": {
+          "type": "string",
+          "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+        },
+        "adapterId": {
+          "type": "string",
+          "pattern": "^atelier\\.analysis\\.[a-z0-9][a-z0-9.-]*$"
+        },
+        "provider": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9.-]*$"
+        },
+        "generatedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "proposals": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/proposedClaim"
+          }
+        },
+        "authority": {
+          "$ref": "#/$defs/claimOnlyAuthority"
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "claimOnlyAuthority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "claimOnly",
+        "frontMatterMutation",
+        "graphRelationMutation",
+        "publicExportFeed",
+        "mcpFeed",
+        "runtimeImport",
+        "directCanonicalWrite"
+      ],
+      "properties": {
+        "claimOnly": {
+          "const": true
+        },
+        "frontMatterMutation": {
+          "const": false
+        },
+        "graphRelationMutation": {
+          "const": false
+        },
+        "publicExportFeed": {
+          "const": false
+        },
+        "mcpFeed": {
+          "const": false
+        },
+        "runtimeImport": {
+          "const": false
+        },
+        "directCanonicalWrite": {
+          "const": false
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "proposedClaim": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": [
+        "schema",
+        "provider",
+        "status",
+        "promoted"
+      ],
+      "properties": {
+        "schema": {
+          "const": "atelier-claim@v1"
+        },
+        "provider": {
+          "type": "string",
+          "pattern": "^[a-z0-9][a-z0-9.-]*$"
+        },
+        "status": {
+          "const": "proposed"
+        },
+        "promoted": {
+          "const": false
+        }
+      },
+      "not": {
+        "anyOf": [
+          {
+            "required": [
+              "kg"
+            ]
+          },
+          {
+            "required": [
+              "frontmatter"
+            ]
+          },
+          {
+            "required": [
+              "frontMatter"
+            ]
+          },
+          {
+            "required": [
+              "relations"
+            ]
+          },
+          {
+            "required": [
+              "graphRelations"
+            ]
+          },
+          {
+            "required": [
+              "publicExport"
+            ]
+          },
+          {
+            "required": [
+              "atelierExport"
+            ]
+          },
+          {
+            "required": [
+              "mcpFeed"
+            ]
+          },
+          {
+            "required": [
+              "runtimeImport"
+            ]
+          },
+          {
+            "required": [
+              "canonicalWrite"
+            ]
+          },
+          {
+            "required": [
+              "canonicalMutation"
+            ]
+          },
+          {
+            "required": [
+              "mutation"
+            ]
+          },
+          {
+            "required": [
+              "writes"
+            ]
+          }
+        ]
+      }
+    },
+    "localPath": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9._/-]+$",
+      "not": {
+        "anyOf": [
+          {
+            "pattern": "^/"
+          },
+          {
+            "pattern": "(^|/)\\.\\.(/|$)"
+          },
+          {
+            "pattern": "^[a-zA-Z][a-zA-Z0-9+.-]*:"
+          }
+        ]
+      }
+    }
+  }
+}

package/contracts/atelier-attestation.v1.schema.json

@@ -0,0 +1,239 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mnstry.ai/schemas/atelier/atelier-attestation.v1.schema.json",
+  "$comment": "contract revision 1.0.0 (contract-stability epoch)",
+  "title": "atelier-attestation@v1",
+  "description": "Record of an admission decision by an issuer over a canonicalized payload document. An attestation never encodes conformance: conformance is public and offline, decided by the published validators. Unsigned attestations (signature null) are non-authoritative.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "attestationId",
+    "issuedAt",
+    "issuer",
+    "subject",
+    "verdict",
+    "signature"
+  ],
+  "properties": {
+    "schema": {
+      "const": "atelier-attestation@v1"
+    },
+    "contractVersion": {
+      "type": "string",
+      "pattern": "^1\\.[0-9]+\\.[0-9]+$"
+    },
+    "attestationId": {
+      "type": "string",
+      "pattern": "^attestation:[a-z0-9][a-z0-9:-]*$"
+    },
+    "issuedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "issuer": {
+      "description": "Who made the admission decision. Issuer identity is asserted here; authority comes only from a recognized signature.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "role"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "role": {
+          "enum": [
+            "admission-authority",
+            "tool",
+            "self"
+          ]
+        },
+        "keyId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "subject": {
+      "description": "The attested payload: its contract, its stable reference, and a canonical hash binding the attestation to exact payload bytes.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "ref",
+        "payloadHash"
+      ],
+      "properties": {
+        "schema": {
+          "description": "Contract of the attested payload document.",
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9.-]*@v[0-9]+$"
+        },
+        "ref": {
+          "description": "Stable identifier of the payload (exportId, runId, or claimId).",
+          "type": "string",
+          "minLength": 1
+        },
+        "payloadHash": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "algorithm",
+            "canonicalization",
+            "digest"
+          ],
+          "properties": {
+            "algorithm": {
+              "const": "sha-256"
+            },
+            "canonicalization": {
+              "const": "RFC8785-JCS"
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            "ext": {
+              "type": "object",
+              "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+            }
+          }
+        },
+        "references": {
+          "description": "Optional cross-references to related governed documents.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "type",
+              "id"
+            ],
+            "properties": {
+              "type": {
+                "enum": [
+                  "claim",
+                  "run",
+                  "export",
+                  "protocol"
+                ]
+              },
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "ext": {
+                "type": "object",
+                "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+              }
+            }
+          }
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "verdict": {
+      "description": "The admission decision. scope is structurally pinned to admission: a document claiming a conformance verdict cannot validate.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "scope",
+        "decision"
+      ],
+      "properties": {
+        "scope": {
+          "const": "admission"
+        },
+        "decision": {
+          "enum": [
+            "admitted",
+            "rejected",
+            "needs-review"
+          ]
+        },
+        "reasons": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9.-]*$"
+              },
+              "message": {
+                "type": "string",
+                "minLength": 1
+              },
+              "ext": {
+                "type": "object",
+                "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+              }
+            }
+          }
+        },
+        "ext": {
+          "type": "object",
+          "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+        }
+      }
+    },
+    "signature": {
+      "description": "Required in shape, nullable in value. null means the attestation is unsigned and non-authoritative; silently absent is not expressible.",
+      "oneOf": [
+        {
+          "type": "null"
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "algorithm",
+            "keyId",
+            "value"
+          ],
+          "properties": {
+            "algorithm": {
+              "enum": [
+                "ed25519",
+                "es256"
+              ]
+            },
+            "keyId": {
+              "type": "string",
+              "minLength": 1
+            },
+            "value": {
+              "description": "Unpadded base64url signature bytes. Length must be a valid base64url shape (never length % 4 == 1); minLength 43 is the 32-byte signature floor.",
+              "type": "string",
+              "minLength": 43,
+              "pattern": "^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-]{2,3})?$"
+            },
+            "ext": {
+              "type": "object",
+              "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+            }
+          }
+        }
+      ]
+    },
+    "ext": {
+      "type": "object",
+      "description": "Reserved extension container. Producers MAY add namespaced members (recommend vendor-prefixed keys). Consumers MUST ignore members they do not recognize. Contents are not validated at v1 and carry no authority over first-class fields."
+    }
+  }
+}