@opensoha/contracts 0.1.14 → 0.1.15

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609"
-	PermissionCatalogSHA256 = "5f1d8b49fb4155473f61ff255002ec7a13e3f63d718d5f9fc592daa93da610df"
+	PermissionCatalogContentSHA256 = "58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a"
+	PermissionCatalogSHA256 = "38ac1a2e7087ff4831e8f6390b804e32f918b49b9af3165fdf2df286d64fe3c8"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:0efe8f496fa0fb29703584586f9306d04fdb5b9a38eaea78532107698230f609",
+  "contentHash": "sha256:58321138575c22b20933cf2c1db2742b741a123bb8f6a2983bb436e84be4e58a",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -943,6 +943,70 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "ai.data-sources.create",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "create",
+      "displayName": "创建 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.update",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "update",
+      "displayName": "修改 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.validate",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "validate",
+      "displayName": "校验 AI 数据源",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "ai.data-sources.view",
+      "domain": "ai",
+      "resource": "data-sources",
+      "action": "view",
+      "displayName": "查看 AI 数据源",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "ai.environments.create",
       "domain": "ai",
@@ -5456,6 +5520,26 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.access-control.access-reviews.execute",
+      "domain": "platform",
+      "resource": "access-control.access-reviews",
+      "action": "execute",
+      "displayName": "执行 Kubernetes 有效权限检查",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true,
+      "legacyAliases": [
+        "platform.access-control.view"
+      ]
+    },
     {
       "key": "platform.access-control.cluster-role-bindings.create",
       "domain": "platform",
@@ -5897,6 +5981,7 @@
       "status": "legacy",
       "assignable": false,
       "replacedBy": [
+        "platform.access-control.access-reviews.execute",
         "platform.access-control.cluster-role-bindings.view",
         "platform.access-control.cluster-roles.view",
         "platform.access-control.role-bindings.view",
@@ -7266,6 +7351,25 @@
         "delete"
       ]
     },
+    {
+      "key": "platform.helm.releases.rollback",
+      "domain": "platform",
+      "resource": "helm.releases",
+      "action": "rollback",
+      "displayName": "回滚 Kubernetes HelmRelease",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true,
+      "legacyCapabilities": [
+        "rollback"
+      ]
+    },
     {
       "key": "platform.helm.releases.update",
       "domain": "platform",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.14",
+  "version": "0.1.15",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.14",
+  "version": "0.1.15",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/fixtures/openapi/AISkillsSettingsEnvelope/invalid/missing-registry.json

@@ -0,0 +1,3 @@
+{
+  "data": {}
+}

package/fixtures/openapi/AISkillsSettingsEnvelope/valid/registry.json

@@ -0,0 +1,13 @@
+{
+  "data": {
+    "skillsRegistry": [
+      {
+        "id": "observability-summary",
+        "name": "Observability Summary",
+        "category": "observability",
+        "enabled": true,
+        "scopes": ["cluster"]
+      }
+    ]
+  }
+}

package/fixtures/openapi/AlertEventStreamSignal/invalid/missing-observed-at.json

@@ -0,0 +1,4 @@
+{
+  "type": "changed",
+  "eventId": "alert-1"
+}

package/fixtures/openapi/AlertEventStreamSignal/valid/changed.json

@@ -0,0 +1,9 @@
+{
+  "type": "changed",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "clusterId": "cluster-a",
+  "namespace": "team-a",
+  "eventId": "alert-1",
+  "eventStatus": "firing",
+  "resyncRequired": false
+}

package/fixtures/openapi/ComputeOverviewEnvelope/valid/partial.json

@@ -27,6 +27,12 @@
         "checkedAt": "2026-07-14T02:00:00Z"
       }
     ],
+    "generatedAt": "2026-07-14T02:00:01Z",
+    "freshness": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:00Z",
+      "maxAgeSeconds": 120
+    },
     "partial": true,
     "warnings": [{ "code": "runtime_section_unavailable" }]
   }

package/fixtures/openapi/ComputeTaskListEnvelope/invalid/progress-overflow.json

@@ -0,0 +1,21 @@
+{
+  "items": [
+    {
+      "id": "virtualization:task-1",
+      "domain": "virtualization",
+      "sourceType": "virtualization_task",
+      "sourceId": "task-1",
+      "kind": "vm.create",
+      "category": "lifecycle",
+      "normalizedStatus": "running",
+      "rawStatus": "running",
+      "resources": [],
+      "attemptCount": 1,
+      "cancelable": true,
+      "retryable": false,
+      "availableActions": ["cancel"],
+      "progress": 1.5,
+      "createdAt": "2026-07-14T02:00:00Z"
+    }
+  ]
+}

package/fixtures/openapi/ComputeTaskListEnvelope/valid/running.json

@@ -23,6 +23,21 @@
       "cancelable": true,
       "retryable": false,
       "availableActions": ["logs", "cancel"],
+      "progress": 0.65,
+      "heartbeat": {
+        "status": "fresh",
+        "observedAt": "2026-07-14T02:00:08Z",
+        "timeoutSeconds": 30
+      },
+      "result": {
+        "status": "accepted",
+        "summary": "Provider accepted the VM create request."
+      },
+      "verification": {
+        "status": "pending",
+        "summary": "Waiting for the VM to become observable."
+      },
+      "auditRef": "audit-virtualization-task-1",
       "createdAt": "2026-07-14T02:00:00Z",
       "startedAt": "2026-07-14T02:00:01Z"
     }

package/fixtures/openapi/ComputeTaskStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,3 @@
+{
+  "type": "heartbeat"
+}

package/fixtures/openapi/ComputeTaskStreamEvent/valid/snapshot.json

@@ -0,0 +1,27 @@
+{
+  "type": "snapshot",
+  "observedAt": "2026-07-14T02:00:08Z",
+  "sequence": 1,
+  "task": {
+    "id": "virtualization:task-1",
+    "domain": "virtualization",
+    "sourceType": "virtualization_task",
+    "sourceId": "task-1",
+    "kind": "vm.create",
+    "category": "lifecycle",
+    "normalizedStatus": "running",
+    "rawStatus": "running",
+    "resources": [],
+    "attemptCount": 1,
+    "cancelable": true,
+    "retryable": false,
+    "availableActions": ["logs", "cancel"],
+    "progress": 0.65,
+    "heartbeat": {
+      "status": "fresh",
+      "observedAt": "2026-07-14T02:00:08Z",
+      "timeoutSeconds": 30
+    },
+    "createdAt": "2026-07-14T02:00:00Z"
+  }
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/invalid/edge-without-target.json

@@ -0,0 +1,16 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "nodes": [],
+    "edges": [
+      {
+        "id": "broken",
+        "sourceId": "a",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceGraphEnvelope/valid/deployment.json

@@ -0,0 +1,53 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "namespace": "team-a",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "rootId": "apps/v1:Deployment:team-a/api",
+    "nodes": [
+      {
+        "id": "apps/v1:Deployment:team-a/api",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "healthy"
+      },
+      {
+        "id": "v1:Pod:team-a/api-1",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-1",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        },
+        "status": "Running"
+      }
+    ],
+    "edges": [
+      {
+        "id": "owns:deployment-api:pod-api-1",
+        "sourceId": "apps/v1:Deployment:team-a/api",
+        "targetId": "v1:Pod:team-a/api-1",
+        "relation": "owns"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "event/team-a/api-1-scheduled",
+        "type": "kubernetes-event",
+        "severity": "info",
+        "summary": "Pod scheduled",
+        "observedAt": "2026-08-23T07:59:58Z",
+        "resourceId": "v1:Pod:team-a/api-1"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/invalid/missing-resource.json

@@ -0,0 +1,10 @@
+{
+  "data": {
+    "items": [
+      {
+        "status": "Running"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceSearchEnvelope/valid/mixed.json

@@ -0,0 +1,29 @@
+{
+  "data": {
+    "items": [
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Pod",
+          "name": "api-7c8d9f",
+          "namespace": "production",
+          "scopeMode": "namespace",
+          "uid": "pod-uid"
+        },
+        "status": "Running"
+      },
+      {
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "Node",
+          "name": "worker-1",
+          "scopeMode": "cluster"
+        },
+        "status": "Ready"
+      }
+    ],
+    "truncated": false
+  }
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/invalid/missing-observed-at.json

@@ -0,0 +1,5 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "source": "informer"
+}

package/fixtures/openapi/KubernetesResourceStreamEvent/valid/modified.json

@@ -0,0 +1,18 @@
+{
+  "type": "modified",
+  "clusterId": "cluster-a",
+  "observedAt": "2026-08-23T08:00:00Z",
+  "source": "informer",
+  "resourceVersion": "42",
+  "cacheStatus": "live",
+  "resyncRequired": false,
+  "resource": {
+    "clusterId": "cluster-a",
+    "apiVersion": "v1",
+    "kind": "Pod",
+    "name": "api-1",
+    "namespace": "team-a",
+    "scopeMode": "namespace",
+    "uid": "pod-uid"
+  }
+}

package/fixtures/openapi/KubernetesSecurityPostureEnvelope/invalid/finding-without-severity.json

@@ -0,0 +1,24 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "provider": "kubescape",
+    "status": "available",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "counts": {
+      "critical": 0,
+      "high": 1,
+      "medium": 0,
+      "low": 0,
+      "unknown": 0
+    },
+    "findings": [
+      {
+        "id": "broken",
+        "category": "configuration",
+        "title": "Missing severity",
+        "status": "failed"
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesSecurityPostureEnvelope/valid/kubescape.json

@@ -0,0 +1,34 @@
+{
+  "data": {
+    "clusterId": "cluster-a",
+    "provider": "kubescape",
+    "status": "available",
+    "generatedAt": "2026-08-23T08:00:00Z",
+    "counts": {
+      "critical": 1,
+      "high": 2,
+      "medium": 3,
+      "low": 4,
+      "unknown": 0
+    },
+    "findings": [
+      {
+        "id": "configuration:C-001:team-a:Deployment:api",
+        "category": "configuration",
+        "severity": "high",
+        "title": "Privileged container",
+        "status": "failed",
+        "controlId": "C-001",
+        "resource": {
+          "clusterId": "cluster-a",
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "team-a",
+          "scopeMode": "namespace"
+        }
+      }
+    ],
+    "warnings": []
+  }
+}

package/fixtures/openapi/KubernetesService/invalid/node-port-out-of-range.json

@@ -0,0 +1,14 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "NodePort",
+  "ageSeconds": 0,
+  "portMappings": [
+    {
+      "protocol": "TCP",
+      "targetPort": "8080",
+      "port": 80,
+      "nodePort": 70000
+    }
+  ]
+}

package/fixtures/openapi/KubernetesService/valid/port-mappings.json

@@ -0,0 +1,22 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "NodePort",
+  "ageSeconds": 0,
+  "ports": ["http:80/tcp (nodePort:30001)"],
+  "portMappings": [
+    {
+      "name": "http",
+      "protocol": "TCP",
+      "targetPort": "8080",
+      "port": 80,
+      "nodePort": 30001
+    },
+    {
+      "name": "metrics",
+      "protocol": "TCP",
+      "targetPort": "metrics",
+      "port": 9090
+    }
+  ]
+}

package/fixtures/openapi/KubernetesServiceDetail/invalid/empty-target-port.json

@@ -0,0 +1,13 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "ClusterIP",
+  "ageSeconds": 60,
+  "portMappings": [
+    {
+      "protocol": "TCP",
+      "targetPort": "",
+      "port": 80
+    }
+  ]
+}

package/fixtures/openapi/KubernetesServiceDetail/valid/port-mappings.json

@@ -0,0 +1,22 @@
+{
+  "name": "web",
+  "namespace": "default",
+  "type": "ClusterIP",
+  "clusterIp": "10.43.0.10",
+  "ageSeconds": 60,
+  "ports": ["http:80/tcp"],
+  "portMappings": [
+    {
+      "name": "http",
+      "protocol": "TCP",
+      "targetPort": "http",
+      "port": 80
+    }
+  ],
+  "endpoints": [
+    {
+      "address": "10.42.0.10",
+      "ready": true
+    }
+  ]
+}

package/fixtures/openapi/OperationalPlanEnvelope/invalid/kubernetes-owner-without-manager.json

@@ -0,0 +1,29 @@
+{
+  "data": {
+    "capability": "k8s.resources.update",
+    "target": "cluster-a/team-a/Deployment/api",
+    "ready": false,
+    "riskLevel": "mutate",
+    "requiresApproval": false,
+    "changes": [
+      {
+        "action": "apply",
+        "resource": "Deployment/api",
+        "summary": "apply the reviewed manifest"
+      }
+    ],
+    "warnings": [],
+    "kubernetesResourceUpdate": {
+      "fieldManager": "opensoha-resource-edit/v1",
+      "changedFields": ["/spec/replicas"],
+      "owners": [
+        {
+          "operation": "Apply",
+          "apiVersion": "apps/v1",
+          "fields": ["/spec/template"]
+        }
+      ],
+      "conflicts": []
+    }
+  }
+}

package/fixtures/openapi/OperationalPlanEnvelope/valid/kubernetes-resource-update.json

@@ -0,0 +1,30 @@
+{
+  "data": {
+    "capability": "k8s.resources.update",
+    "target": "cluster-a/team-a/Deployment/api",
+    "ready": true,
+    "riskLevel": "mutate",
+    "requiresApproval": false,
+    "changes": [
+      {
+        "action": "apply",
+        "resource": "Deployment/api",
+        "summary": "apply the reviewed manifest"
+      }
+    ],
+    "warnings": [],
+    "kubernetesResourceUpdate": {
+      "fieldManager": "opensoha-resource-edit/v1",
+      "changedFields": ["/spec/replicas"],
+      "owners": [
+        {
+          "manager": "helm",
+          "operation": "Apply",
+          "apiVersion": "apps/v1",
+          "fields": ["/spec/template"]
+        }
+      ],
+      "conflicts": []
+    }
+  }
+}

package/fixtures/openapi/WorkbenchAgentRunListEnvelope/invalid/callback-token.json

@@ -0,0 +1,17 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "providerId": "external-agent",
+      "providerKind": "general",
+      "capabilityId": "root-cause-analysis",
+      "createdBy": "user-1",
+      "status": "running",
+      "callbackToken": "must-not-cross-the-user-api-boundary",
+      "timeoutSeconds": 600,
+      "queuedAt": "2026-08-19T08:00:00Z",
+      "createdAt": "2026-08-19T08:00:00Z",
+      "updatedAt": "2026-08-19T08:01:00Z"
+    }
+  ]
+}

package/fixtures/openapi/WorkbenchAgentRunListEnvelope/valid/session-scoped.json

@@ -0,0 +1,17 @@
+{
+  "items": [
+    {
+      "id": "run-1",
+      "providerId": "external-agent",
+      "providerKind": "general",
+      "capabilityId": "root-cause-analysis",
+      "sessionId": "session-1",
+      "createdBy": "user-1",
+      "status": "running",
+      "timeoutSeconds": 600,
+      "queuedAt": "2026-08-19T08:00:00Z",
+      "createdAt": "2026-08-19T08:00:00Z",
+      "updatedAt": "2026-08-19T08:01:00Z"
+    }
+  ]
+}