@opensoha/contracts 0.1.13 → 0.1.14

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98"
-	PermissionCatalogSHA256 = "f563a9be8901002e790f271d589c9f4b8b05dcd8e9b4bba767b835b1cc606b76"
+	PermissionCatalogContentSHA256 = "0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609"
+	PermissionCatalogSHA256 = "5f1d8b49fb4155473f61ff255002ec7a13e3f63d718d5f9fc592daa93da610df"
 )
 
 //go:embed permission-catalog.json

package/auth/catalog_test.go

@@ -86,3 +86,43 @@ func TestPermissionCatalogIncludesIndependentResourceCreationEntry(t *testing.T)
 		t.Fatal("platform.resource-creation.use is missing")
 	}
 }
+
+func TestPermissionCatalogIncludesIndependentWorkbenchEntries(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key        string `json:"key"`
+			Domain     string `json:"domain"`
+			Action     string `json:"action"`
+			Status     string `json:"status"`
+			Assignable bool   `json:"assignable"`
+		} `json:"permissions"`
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatalf("decode permission catalog: %v", err)
+	}
+
+	want := map[string]bool{
+		"workbench.ai.view":         false,
+		"workbench.compute.view":    false,
+		"workbench.delivery.view":   false,
+		"workbench.home.view":       false,
+		"workbench.monitoring.view": false,
+		"workbench.platform.view":   false,
+		"workbench.security.view":   false,
+		"workbench.settings.view":   false,
+	}
+	for _, permission := range catalog.Permissions {
+		if _, ok := want[permission.Key]; !ok {
+			continue
+		}
+		if permission.Domain != "workbench" || permission.Action != "view" || permission.Status != "active" || !permission.Assignable {
+			t.Fatalf("workbench entry must be independently assignable: %#v", permission)
+		}
+		want[permission.Key] = true
+	}
+	for key, found := range want {
+		if !found {
+			t.Fatalf("%s is missing", key)
+		}
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:82626eb53d9cd6b53ee502ae32285392c672f7f186a7dbefb42bf1f700d67e98",
+  "contentHash": "sha256:0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -10929,12 +10929,132 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "workbench.ai.view",
+      "domain": "workbench",
+      "resource": "ai",
+      "action": "view",
+      "displayName": "访问 AI 工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.compute.view",
+      "domain": "workbench",
+      "resource": "compute",
+      "action": "view",
+      "displayName": "访问计算资源工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.delivery.view",
+      "domain": "workbench",
+      "resource": "delivery",
+      "action": "view",
+      "displayName": "访问应用交付工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.home.view",
+      "domain": "workbench",
+      "resource": "home",
+      "action": "view",
+      "displayName": "访问应用门户",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.monitoring.view",
+      "domain": "workbench",
+      "resource": "monitoring",
+      "action": "view",
+      "displayName": "访问可观测与值班工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.platform.view",
+      "domain": "workbench",
+      "resource": "platform",
+      "action": "view",
+      "displayName": "访问 k8s工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.security.view",
+      "domain": "workbench",
+      "resource": "security",
+      "action": "view",
+      "displayName": "访问身份与安全工作台",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "workbench.settings.view",
+      "domain": "workbench",
+      "resource": "settings",
+      "action": "view",
+      "displayName": "访问设置中心",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "workspace.application.view",
       "domain": "workspace",
       "resource": "application",
       "action": "view",
-      "displayName": "查看应用工作台",
+      "displayName": "查看工作空间应用",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",
@@ -10950,7 +11070,7 @@
       "domain": "workspace",
       "resource": "resource",
       "action": "view",
-      "displayName": "查看 k8s工作台",
+      "displayName": "查看工作空间资源",
       "riskLevel": "read",
       "scopeKinds": [
         "tenant",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.13",
+  "version": "0.1.14",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.13",
+  "version": "0.1.14",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/invalid/unknown-inheritance.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "ops",
+  "sourceKind": "Deployment",
+  "sourceName": "api",
+  "targetKind": "Job",
+  "targetName": "report",
+  "inherit": ["everything"],
+  "restartPolicy": "Never"
+}

package/fixtures/openapi/KubernetesWorkloadSnapshotRequest/valid/selective-job.json

@@ -0,0 +1,9 @@
+{
+  "namespace": "ops",
+  "sourceKind": "Deployment",
+  "sourceName": "api",
+  "targetKind": "Job",
+  "targetName": "report",
+  "inherit": ["environment", "storage", "resources", "securityContext", "scheduling"],
+  "restartPolicy": "Never"
+}

package/gen/go/sohaapi/client.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const defaultUserAgent = "opensoha-contracts/0.1.13"
+const defaultUserAgent = "opensoha-contracts/0.1.14"
 
 type Client struct {
 	BaseURL    string

package/gen/go/sohaapi/types.go

@@ -2713,6 +2713,42 @@ func (e KubernetesWorkloadImportInputWorkloadKind) Valid() bool {
 	}
 }
 
+// Defines values for KubernetesWorkloadSnapshotInheritance.
+const (
+	KubernetesWorkloadSnapshotInheritanceEnvironment      KubernetesWorkloadSnapshotInheritance = "environment"
+	KubernetesWorkloadSnapshotInheritanceInitContainers   KubernetesWorkloadSnapshotInheritance = "initContainers"
+	KubernetesWorkloadSnapshotInheritanceResources        KubernetesWorkloadSnapshotInheritance = "resources"
+	KubernetesWorkloadSnapshotInheritanceScheduling       KubernetesWorkloadSnapshotInheritance = "scheduling"
+	KubernetesWorkloadSnapshotInheritanceSecurityContext  KubernetesWorkloadSnapshotInheritance = "securityContext"
+	KubernetesWorkloadSnapshotInheritanceServiceRuntime   KubernetesWorkloadSnapshotInheritance = "serviceRuntime"
+	KubernetesWorkloadSnapshotInheritanceStorage          KubernetesWorkloadSnapshotInheritance = "storage"
+	KubernetesWorkloadSnapshotInheritanceTemplateMetadata KubernetesWorkloadSnapshotInheritance = "templateMetadata"
+)
+
+// Valid indicates whether the value is a known member of the KubernetesWorkloadSnapshotInheritance enum.
+func (e KubernetesWorkloadSnapshotInheritance) Valid() bool {
+	switch e {
+	case KubernetesWorkloadSnapshotInheritanceEnvironment:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceInitContainers:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceResources:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceScheduling:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceSecurityContext:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceServiceRuntime:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceStorage:
+		return true
+	case KubernetesWorkloadSnapshotInheritanceTemplateMetadata:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for KubernetesWorkloadSnapshotRestartPolicy.
 const (
 	KubernetesWorkloadSnapshotRestartPolicyNever     KubernetesWorkloadSnapshotRestartPolicy = "Never"
@@ -14065,6 +14101,9 @@ type KubernetesWorkloadSnapshotEnvelope struct {
 	Data KubernetesWorkloadSnapshot `json:"data"`
 }
 
+// KubernetesWorkloadSnapshotInheritance defines model for KubernetesWorkloadSnapshotInheritance.
+type KubernetesWorkloadSnapshotInheritance string
+
 // KubernetesWorkloadSnapshotRequest defines model for KubernetesWorkloadSnapshotRequest.
 type KubernetesWorkloadSnapshotRequest struct {
 	// ActiveDeadlineSeconds Zero leaves the Kubernetes default unchanged.
@@ -14075,9 +14114,12 @@ type KubernetesWorkloadSnapshotRequest struct {
 	Command               []string          `json:"command,omitempty"`
 
 	// Completions Zero leaves the Kubernetes default unchanged.
-	Completions int               `json:"completions,omitempty"`
-	Description string            `json:"description,omitempty"`
-	Labels      map[string]string `json:"labels,omitempty"`
+	Completions int    `json:"completions,omitempty"`
+	Description string `json:"description,omitempty"`
+
+	// Inherit Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.
+	Inherit []KubernetesWorkloadSnapshotInheritance `json:"inherit,omitempty"`
+	Labels  map[string]string                       `json:"labels,omitempty"`
 
 	// Namespace Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped.
 	Namespace string `json:"namespace"`

package/gen/go/sohaapi/types_test.go

@@ -9,9 +9,10 @@ func TestKubernetesWorkloadSnapshotRequestGeneratedShape(t *testing.T) {
 		SourceName:    "reports",
 		TargetKind:    KubernetesWorkloadSnapshotTargetKindCronJob,
 		TargetName:    "reports-schedule",
+		Inherit:       []KubernetesWorkloadSnapshotInheritance{KubernetesWorkloadSnapshotInheritanceEnvironment},
 		RestartPolicy: KubernetesWorkloadSnapshotRestartPolicyNever,
 	}
-	if request.Namespace != "default" {
-		t.Fatalf("namespace = %q, want default", request.Namespace)
+	if request.Namespace != "default" || len(request.Inherit) != 1 {
+		t.Fatalf("request = %#v", request)
 	}
 }

package/gen/ts/sohaapi/index.ts

@@ -15975,6 +15975,8 @@ export interface components {
         KubernetesWorkloadSnapshotTargetKind: "Job" | "CronJob" | "WorkloadCronJob";
         /** @enum {string} */
         KubernetesWorkloadSnapshotRestartPolicy: "Never" | "OnFailure";
+        /** @enum {string} */
+        KubernetesWorkloadSnapshotInheritance: "environment" | "storage" | "resources" | "securityContext" | "scheduling" | "initContainers" | "templateMetadata" | "serviceRuntime";
         KubernetesWorkloadSnapshotRequest: {
             /** @description Namespace shared by the source workload and generated target because referenced Secrets, ConfigMaps, ServiceAccounts, and PVCs are namespace-scoped. */
             namespace: string;
@@ -15993,6 +15995,8 @@ export interface components {
             };
             command?: string[];
             args?: string[];
+            /** @description Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory. */
+            inherit?: components["schemas"]["KubernetesWorkloadSnapshotInheritance"][];
             restartPolicy: components["schemas"]["KubernetesWorkloadSnapshotRestartPolicy"];
             /** @description Zero leaves the Kubernetes default unchanged. */
             parallelism?: number;
@@ -19379,6 +19383,7 @@ export type LogStreamEvent = components['schemas']['LogStreamEvent'];
 export type KubernetesWorkloadSnapshotSourceKind = components['schemas']['KubernetesWorkloadSnapshotSourceKind'];
 export type KubernetesWorkloadSnapshotTargetKind = components['schemas']['KubernetesWorkloadSnapshotTargetKind'];
 export type KubernetesWorkloadSnapshotRestartPolicy = components['schemas']['KubernetesWorkloadSnapshotRestartPolicy'];
+export type KubernetesWorkloadSnapshotInheritance = components['schemas']['KubernetesWorkloadSnapshotInheritance'];
 export type KubernetesWorkloadSnapshotRequest = components['schemas']['KubernetesWorkloadSnapshotRequest'];
 export type KubernetesWorkloadSnapshotContainer = components['schemas']['KubernetesWorkloadSnapshotContainer'];
 export type KubernetesWorkloadSnapshot = components['schemas']['KubernetesWorkloadSnapshot'];

package/openapi/soha-api.json

@@ -24126,6 +24126,29 @@
         ],
         "type": "object"
       },
+      "KubernetesWorkloadSnapshotInheritance": {
+        "enum": [
+          "environment",
+          "storage",
+          "resources",
+          "securityContext",
+          "scheduling",
+          "initContainers",
+          "templateMetadata",
+          "serviceRuntime"
+        ],
+        "type": "string",
+        "x-enum-varnames": [
+          "KubernetesWorkloadSnapshotInheritanceEnvironment",
+          "KubernetesWorkloadSnapshotInheritanceStorage",
+          "KubernetesWorkloadSnapshotInheritanceResources",
+          "KubernetesWorkloadSnapshotInheritanceSecurityContext",
+          "KubernetesWorkloadSnapshotInheritanceScheduling",
+          "KubernetesWorkloadSnapshotInheritanceInitContainers",
+          "KubernetesWorkloadSnapshotInheritanceTemplateMetadata",
+          "KubernetesWorkloadSnapshotInheritanceServiceRuntime"
+        ]
+      },
       "KubernetesWorkloadSnapshotRequest": {
         "additionalProperties": false,
         "if": {
@@ -24183,6 +24206,15 @@
             "maxLength": 512,
             "type": "string"
           },
+          "inherit": {
+            "description": "Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.",
+            "items": {
+              "$ref": "#/components/schemas/KubernetesWorkloadSnapshotInheritance"
+            },
+            "maxItems": 8,
+            "type": "array",
+            "uniqueItems": true
+          },
           "labels": {
             "additionalProperties": {
               "type": "string"
@@ -41393,7 +41425,7 @@
   "info": {
     "description": "Public OpenSoha core API contract. This first contract focuses on stable cross-repository boundaries: auth, health, runner-facing control-plane callbacks, AI Gateway, and MCP capability discovery.\n",
     "title": "Soha API",
-    "version": "0.1.13"
+    "version": "0.1.14"
   },
   "openapi": "3.1.0",
   "paths": {

package/openapi/soha-api.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Soha API
-  version: 0.1.13
+  version: 0.1.14
   description: >
     Public OpenSoha core API contract. This first contract focuses on stable
     cross-repository boundaries: auth, health, runner-facing control-plane
@@ -27776,6 +27776,18 @@ components:
       x-enum-varnames:
         - KubernetesWorkloadSnapshotRestartPolicyNever
         - KubernetesWorkloadSnapshotRestartPolicyOnFailure
+    KubernetesWorkloadSnapshotInheritance:
+      type: string
+      enum: [environment, storage, resources, securityContext, scheduling, initContainers, templateMetadata, serviceRuntime]
+      x-enum-varnames:
+        - KubernetesWorkloadSnapshotInheritanceEnvironment
+        - KubernetesWorkloadSnapshotInheritanceStorage
+        - KubernetesWorkloadSnapshotInheritanceResources
+        - KubernetesWorkloadSnapshotInheritanceSecurityContext
+        - KubernetesWorkloadSnapshotInheritanceScheduling
+        - KubernetesWorkloadSnapshotInheritanceInitContainers
+        - KubernetesWorkloadSnapshotInheritanceTemplateMetadata
+        - KubernetesWorkloadSnapshotInheritanceServiceRuntime
     KubernetesWorkloadSnapshotRequest:
       type: object
       required: [namespace, sourceKind, sourceName, targetKind, targetName, restartPolicy]
@@ -27817,6 +27829,13 @@ components:
           type: array
           maxItems: 128
           items: { type: string, maxLength: 4096 }
+        inherit:
+          type: array
+          maxItems: 8
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/KubernetesWorkloadSnapshotInheritance"
+          description: Runtime modules copied from the source Pod template. Omitting this field preserves the legacy full-template snapshot; an explicit array copies only the selected modules while always retaining the selected container name, image, imagePullPolicy, command, args, and working directory.
         restartPolicy:
           $ref: "#/components/schemas/KubernetesWorkloadSnapshotRestartPolicy"
         parallelism:

package/openapi/spec_generated.go

@@ -5,9 +5,9 @@ package openapi
 import _ "embed"
 
 const (
-	Version    = "0.1.13"
-	YAMLSHA256 = "480571290460492a4f422ecf2c2098720989c31a4413c1bf29fc45b1ecaa5c7b"
-	JSONSHA256 = "8327233124b473bdfe2a57582eb66ed9c844630bedd0c947eefb707b71f7d3cf"
+	Version    = "0.1.14"
+	YAMLSHA256 = "231a8b25b830df7c602c1356494502235ca8c00f23a4aea56c87c0fd79438663"
+	JSONSHA256 = "35983758f2bf5d2b4c2e918ee32f34f384218d882edf42d86c310f2820e2a82f"
 )
 
 //go:embed soha-api.yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensoha/contracts",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "private": false,
   "description": "Shared OpenSoha API, agent, MCP, skill, event, and auth contracts.",
   "license": "Apache-2.0",