@opensoha/contracts 0.1.17 → 0.1.18

package/fixtures/openapi/ManifestDeploymentEnvelope/invalid/negative-resource-observation.json

@@ -0,0 +1,57 @@
+{
+  "data": {
+    "id": "manifest-deployment-prod",
+    "packageId": "manifest-package-ingress",
+    "bindingId": "manifest-binding-prod",
+    "generation": 7,
+    "spec": {
+      "desiredRevision": 12,
+      "desiredDigest": "sha256:0123456789abcdef",
+      "reconcilePolicy": "continuous",
+      "driftPolicy": "report",
+      "deletionPolicy": "orphan"
+    },
+    "status": {
+      "observedGeneration": 7,
+      "appliedRevision": 12,
+      "appliedDigest": "sha256:0123456789abcdef",
+      "lastKnownGoodRevision": 11,
+      "phase": "deleting",
+      "conditions": [
+        {
+          "type": "Healthy",
+          "status": "true",
+          "reason": "ResourcesHealthy",
+          "message": "All managed resources are healthy.",
+          "observedGeneration": 7,
+          "lastTransitionAt": "2026-07-30T00:00:00Z",
+          "evidenceRefs": []
+        }
+      ],
+      "inventory": [
+        {
+          "deploymentId": "manifest-deployment-prod",
+          "generation": 7,
+          "apiVersion": "workloads.soha.io/v1alpha1",
+          "kind": "WorkloadCronJob",
+          "namespace": "test",
+          "name": "periodic",
+          "uid": "operator-uid",
+          "resourceVersion": "42",
+          "resourceGeneration": 3,
+          "observedResourceGeneration": -1,
+          "deletingAt": "2026-09-14T00:00:00Z",
+          "finalizers": [
+            "test.soha.io/cleanup"
+          ],
+          "desiredObjectDigest": "sha256:desired",
+          "observedObjectDigest": "sha256:observed",
+          "health": "degraded",
+          "lastObservedAt": "2026-09-14T00:00:00Z"
+        }
+      ]
+    },
+    "createdAt": "2026-07-30T00:00:00Z",
+    "updatedAt": "2026-07-30T00:05:00Z"
+  }
+}

package/fixtures/openapi/ManifestDeploymentEnvelope/valid/operator-deleting.json

@@ -0,0 +1,57 @@
+{
+  "data": {
+    "id": "manifest-deployment-prod",
+    "packageId": "manifest-package-ingress",
+    "bindingId": "manifest-binding-prod",
+    "generation": 7,
+    "spec": {
+      "desiredRevision": 12,
+      "desiredDigest": "sha256:0123456789abcdef",
+      "reconcilePolicy": "continuous",
+      "driftPolicy": "report",
+      "deletionPolicy": "orphan"
+    },
+    "status": {
+      "observedGeneration": 7,
+      "appliedRevision": 12,
+      "appliedDigest": "sha256:0123456789abcdef",
+      "lastKnownGoodRevision": 11,
+      "phase": "deleting",
+      "conditions": [
+        {
+          "type": "Healthy",
+          "status": "true",
+          "reason": "ResourcesHealthy",
+          "message": "All managed resources are healthy.",
+          "observedGeneration": 7,
+          "lastTransitionAt": "2026-07-30T00:00:00Z",
+          "evidenceRefs": []
+        }
+      ],
+      "inventory": [
+        {
+          "deploymentId": "manifest-deployment-prod",
+          "generation": 7,
+          "apiVersion": "workloads.soha.io/v1alpha1",
+          "kind": "WorkloadCronJob",
+          "namespace": "test",
+          "name": "periodic",
+          "uid": "operator-uid",
+          "resourceVersion": "42",
+          "resourceGeneration": 3,
+          "observedResourceGeneration": 0,
+          "deletingAt": "2026-09-14T00:00:00Z",
+          "finalizers": [
+            "test.soha.io/cleanup"
+          ],
+          "desiredObjectDigest": "sha256:desired",
+          "observedObjectDigest": "sha256:observed",
+          "health": "degraded",
+          "lastObservedAt": "2026-09-14T00:00:00Z"
+        }
+      ]
+    },
+    "createdAt": "2026-07-30T00:00:00Z",
+    "updatedAt": "2026-07-30T00:05:00Z"
+  }
+}

package/fixtures/openapi/ManifestExecutionTaskPayload/invalid/gitops-empty.json

@@ -0,0 +1,7 @@
+{
+  "action": "apply",
+  "packageId": "package-1",
+  "generation": 1,
+  "idempotencyKey": "operation-1",
+  "gitOpsDocuments": []
+}

package/fixtures/openapi/ManifestExecutionTaskPayload/valid/gitops-frozen-children.json

@@ -0,0 +1,18 @@
+{
+  "action": "apply",
+  "packageId": "package-1",
+  "generation": 1,
+  "idempotencyKey": "operation-1",
+  "gitOpsDocuments": [
+    {
+      "index": 0,
+      "path": "deployment.yaml",
+      "apiVersion": "apps/v1",
+      "kind": "Deployment",
+      "namespace": "test",
+      "name": "web",
+      "content": "{}",
+      "contentDigest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  ]
+}

package/fixtures/openapi/ManifestKustomizeOptions/invalid/escaping-entry.json

@@ -0,0 +1 @@
+{"entryPath":"overlays/../../outside"}

package/fixtures/openapi/ManifestKustomizeOptions/invalid/mutable-image.json

@@ -0,0 +1 @@
+{"images":[{"name":"api","digest":"latest"}]}

package/fixtures/openapi/ManifestKustomizeOptions/valid/overlay-images.json

@@ -0,0 +1,7 @@
+{
+  "entryPath": "overlays/prod",
+  "images": [
+    { "name": "api", "newName": "registry.example.com/team/api", "digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" },
+    { "name": "worker", "digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" }
+  ]
+}

package/fixtures/openapi/ManifestRevisionInput/invalid/missing-version.json

@@ -0,0 +1 @@
+{"note":"No concurrency token"}

package/fixtures/openapi/ManifestRevisionInput/valid/current-draft.json

@@ -0,0 +1 @@
+{"expectedUpdatedAt":"2026-09-12T00:00:00Z","note":"Service configuration"}

package/fixtures/openapi/ManifestServiceTemplateInputs/invalid/mutable-image.json

@@ -0,0 +1,8 @@
+{
+  "serviceVersion": 3,
+  "templateId": "http",
+  "templateVersion": 1,
+  "templateDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "parameters": {},
+  "artifactImages": { "main": "registry.example/api:latest" }
+}

package/fixtures/openapi/ManifestServiceTemplateInputs/valid/frozen-service-image.json

@@ -0,0 +1,9 @@
+{
+  "serviceVersion": 3,
+  "templateId": "http",
+  "templateVersion": 1,
+  "templateDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "parameters": { "replicas": 0, "enabled": false },
+  "artifactImages": { "main": "registry.example/api@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" },
+  "releaseBundleId": "bundle"
+}

package/fixtures/openapi/NetworkVPNConnectionIntentInput/invalid/auto-with-gateway.json

@@ -0,0 +1,6 @@
+{
+  "deviceId": "device-1",
+  "profileId": "profile-1",
+  "selection": "auto",
+  "gatewayId": "gateway-a"
+}

package/fixtures/openapi/NetworkVPNConnectionIntentInput/invalid/missing-manual-gateway.json

@@ -0,0 +1,5 @@
+{
+  "deviceId": "device-1",
+  "profileId": "profile-1",
+  "selection": "manual"
+}

package/fixtures/openapi/NetworkVPNConnectionIntentInput/invalid/mode-override.json

@@ -0,0 +1,7 @@
+{
+  "deviceId": "device-1",
+  "profileId": "profile-1",
+  "selection": "manual",
+  "gatewayId": "gateway-a",
+  "mode": "external_vpn"
+}

package/fixtures/openapi/NetworkVPNConnectionIntentInput/valid/auto-intent.json

@@ -0,0 +1,5 @@
+{
+  "deviceId": "device-1",
+  "profileId": "profile-1",
+  "selection": "auto"
+}

package/fixtures/openapi/NetworkVPNConnectionIntentInput/valid/manual-intent.json

@@ -0,0 +1,6 @@
+{
+  "deviceId": "device-1",
+  "profileId": "profile-1",
+  "selection": "manual",
+  "gatewayId": "gateway-a"
+}

package/fixtures/openapi/NetworkVPNProfileInput/invalid/unknown-private-key.json

@@ -0,0 +1,25 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office network",
+    "siteId": "site-1",
+    "networkSpaceId": "space-1",
+    "mode": "external_vpn",
+    "resourceIds": [],
+    "gatewayIds": [
+      "gateway-a",
+      "gateway-b"
+    ],
+    "selectionPolicyId": "policy-1",
+    "allowManualSelection": true,
+    "enabled": true,
+    "assignments": {
+      "userIds": [
+        "user-1"
+      ],
+      "teamIds": [],
+      "deviceIds": []
+    },
+    "privateKey": "not-permitted"
+  }
+}

package/fixtures/openapi/NetworkVPNProfileInput/valid/assigned-profile.json

@@ -0,0 +1,24 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Office network",
+    "siteId": "site-1",
+    "networkSpaceId": "space-1",
+    "mode": "external_vpn",
+    "resourceIds": [],
+    "gatewayIds": [
+      "gateway-a",
+      "gateway-b"
+    ],
+    "selectionPolicyId": "policy-1",
+    "allowManualSelection": true,
+    "enabled": true,
+    "assignments": {
+      "userIds": [
+        "user-1"
+      ],
+      "teamIds": [],
+      "deviceIds": []
+    }
+  }
+}

package/fixtures/openapi/NetworkVPNSelectionPolicyInput/invalid/unbounded-attempts.json

@@ -0,0 +1,21 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Carrier preference",
+    "strategy": "provider",
+    "providerOrder": [
+      "telecom",
+      "unicom"
+    ],
+    "providerPreference": "prefer",
+    "maxLatencyMs": 200,
+    "maxTimeoutPercent": 50,
+    "maxSampleAgeSeconds": 60,
+    "minSamples": 2,
+    "missingMeasurements": "priority",
+    "maxAttempts": 999,
+    "retryCooldownSeconds": 30,
+    "failoverOnDisconnect": true,
+    "allowManualFallback": false
+  }
+}

package/fixtures/openapi/NetworkVPNSelectionPolicyInput/valid/provider-policy.json

@@ -0,0 +1,21 @@
+{
+  "expectedRevision": 0,
+  "configuration": {
+    "name": "Carrier preference",
+    "strategy": "provider",
+    "providerOrder": [
+      "telecom",
+      "unicom"
+    ],
+    "providerPreference": "prefer",
+    "maxLatencyMs": 200,
+    "maxTimeoutPercent": 50,
+    "maxSampleAgeSeconds": 60,
+    "minSamples": 2,
+    "missingMeasurements": "priority",
+    "maxAttempts": 3,
+    "retryCooldownSeconds": 30,
+    "failoverOnDisconnect": true,
+    "allowManualFallback": false
+  }
+}

package/fixtures/openapi/ObservabilityMetricAssessmentInput/invalid/arbitrary-expression.json

@@ -0,0 +1,10 @@
+{
+  "dataSourceId": "metrics-dev",
+  "metricKey": "error_rate",
+  "scope": {},
+  "windowStart": "2026-09-15T10:05:00Z",
+  "windowEnd": "2026-09-15T10:10:00Z",
+  "unit": "ratio",
+  "threshold": { "operator": "lte", "value": 0.01 },
+  "expression": "arbitrary_expression"
+}

package/fixtures/openapi/ObservabilityMetricAssessmentInput/valid/metric-window.json

@@ -0,0 +1,10 @@
+{
+  "dataSourceId": "metrics-dev",
+  "metricKey": "error_rate",
+  "scope": { "clusterId": "dev", "namespace": "web", "service": "api" },
+  "windowStart": "2026-09-15T10:05:00Z",
+  "windowEnd": "2026-09-15T10:10:00Z",
+  "notBefore": "2026-09-15T10:00:00Z",
+  "unit": "ratio",
+  "threshold": { "operator": "lte", "value": 0.01 }
+}

package/fixtures/openapi/PluginManifest/valid/hermes-api.json

@@ -0,0 +1,53 @@
+{
+  "id": "opensoha.hermes-api",
+  "name": "Hermes Chat",
+  "version": "0.1.0",
+  "publisher": "opensoha",
+  "type": "ai-provider-adapter",
+  "description": "Hermes Runs API adapter for governed chat sessions. Requires a chat-only API profile and an HTTPS endpoint.",
+  "compatibility": {
+    "soha": ">=0.1.8 <1.0.0",
+    "contracts": ">=0.1.17 <1.0.0"
+  },
+  "runtime": {
+    "mode": "manifest-only"
+  },
+  "configSchema": {
+    "type": "object",
+    "required": [
+      "endpoint"
+    ],
+    "properties": {
+      "endpoint": {
+        "type": "string",
+        "title": "Hermes HTTPS endpoint",
+        "pattern": "^https://[^/@]+(/[^?#]*)?$"
+      }
+    },
+    "additionalProperties": false
+  },
+  "extensionPoints": {
+    "ai": {
+      "agentProviders": [
+        {
+          "id": "hermes-api",
+          "label": "Hermes Chat",
+          "metadata": {
+            "providerId": "hermes-api",
+            "kind": "hermes-api",
+            "providerVersion": "0.1.0",
+            "adapterProtocol": "opensoha.agent-provider.hermes-api/v1",
+            "capabilities": [
+              "general"
+            ],
+            "runtime": {
+              "kind": "remote",
+              "endpointConfigKey": "endpoint",
+              "healthPath": "/health/detailed"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/fixtures/openapi/ProgressiveRolloutControlInput/invalid/missing-identity.json

@@ -0,0 +1,5 @@
+{
+  "action": "promote",
+  "uid": "",
+  "resourceVersion": "18"
+}

package/fixtures/openapi/ProgressiveRolloutControlInput/invalid/skip-analysis.json

@@ -0,0 +1,5 @@
+{
+  "action": "promote_full",
+  "uid": "rollout-uid",
+  "resourceVersion": "18"
+}

package/fixtures/openapi/ProgressiveRolloutControlInput/valid/pause.json

@@ -0,0 +1,5 @@
+{
+  "action": "pause",
+  "uid": "rollout-uid",
+  "resourceVersion": "18"
+}

package/fixtures/openapi/ReleaseTargetInput/invalid/missing-required-field.json

@@ -0,0 +1,15 @@
+{
+  "clusterId": "",
+  "namespace": "",
+  "workloadName": "project-1",
+  "targetKind": "host_service",
+  "executorKind": "docker_compose",
+  "enabled": true,
+  "docker": {
+    "hostId": "host-1",
+    "projectId": "project-1",
+    "imageMappings": {
+      "api": "main"
+    }
+  }
+}

package/fixtures/openapi/ReleaseTargetInput/valid/docker-compose.json

@@ -0,0 +1,16 @@
+{
+  "clusterId": "",
+  "namespace": "",
+  "workloadKind": "DockerProject",
+  "workloadName": "project-1",
+  "targetKind": "host_service",
+  "executorKind": "docker_compose",
+  "enabled": true,
+  "docker": {
+    "hostId": "host-1",
+    "projectId": "project-1",
+    "imageMappings": {
+      "api": "main"
+    }
+  }
+}

package/fixtures/openapi/RepositoryAnalysis/invalid/moving-ref.json

@@ -0,0 +1,11 @@
+{
+  "applicationId": "app",
+  "repositoryId": "repo",
+  "projectPath": ".",
+  "resolvedCommit": "main",
+  "ruleVersion": "1",
+  "status": "unrecognized",
+  "candidates": [],
+  "evidencePaths": [],
+  "warnings": []
+}

package/fixtures/openapi/RepositoryAnalysis/valid/go.json

@@ -0,0 +1,29 @@
+{
+  "applicationId": "app",
+  "repositoryId": "repo",
+  "projectPath": ".",
+  "resolvedCommit": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "ruleVersion": "1",
+  "status": "identified",
+  "candidates": [
+    {
+      "projectPath": ".",
+      "language": "go",
+      "packageManager": "go",
+      "versionRange": "1.26",
+      "buildMethods": [
+        "repo_dockerfile",
+        "repo_buildpacks"
+      ],
+      "evidencePaths": [
+        "go.mod",
+        "Dockerfile"
+      ]
+    }
+  ],
+  "evidencePaths": [
+    "go.mod",
+    "Dockerfile"
+  ],
+  "warnings": []
+}

package/fixtures/openapi/RepositoryAnalysisInput/invalid/arbitrary-source-url.json

@@ -0,0 +1,6 @@
+{
+  "repositoryId": "repo",
+  "refType": "branch",
+  "refName": "main",
+  "url": "https://unmapped.example/repo"
+}

package/fixtures/openapi/RepositoryAnalysisInput/invalid/missing-ref.json

@@ -0,0 +1,4 @@
+{
+  "repositoryId": "repo",
+  "refType": "branch"
+}

package/fixtures/openapi/RepositoryAnalysisInput/valid/nested-project.json

@@ -0,0 +1,6 @@
+{
+  "repositoryId": "repo",
+  "refType": "branch",
+  "refName": "main",
+  "projectPath": "services/api"
+}

package/fixtures/openapi/ServiceDeploymentTemplateBinding/invalid/invalid-unpinned.json

@@ -0,0 +1,4 @@
+{
+  "templateId": "http",
+  "parameters": {}
+}

package/fixtures/openapi/ServiceDeploymentTemplateBinding/valid/valid.json

@@ -0,0 +1,7 @@
+{
+  "templateId": "http",
+  "version": 1,
+  "parameters": {
+    "port": 80
+  }
+}

package/fixtures/openapi/ServiceDeploymentTemplateInput/invalid/invalid-executable-schema.json

@@ -0,0 +1,25 @@
+{
+  "key": "http",
+  "name": "HTTP service",
+  "source": {
+    "renderer": "raw_yaml",
+    "files": [
+      {
+        "path": "deployment.yaml",
+        "content": "kind: Deployment\napiVersion: apps/v1\n"
+      }
+    ]
+  },
+  "parameterSchema": {
+    "type": "object",
+    "$ref": "file:///etc/passwd"
+  },
+  "defaults": {
+    "port": 8080
+  },
+  "health": {
+    "mode": "workload_ready",
+    "timeoutSeconds": 300
+  },
+  "enabled": true
+}

package/fixtures/openapi/ServiceDeploymentTemplateInput/invalid/invalid-missing-schema.json

@@ -0,0 +1,21 @@
+{
+  "key": "http",
+  "name": "HTTP service",
+  "source": {
+    "renderer": "raw_yaml",
+    "files": [
+      {
+        "path": "deployment.yaml",
+        "content": "kind: Deployment\napiVersion: apps/v1\n"
+      }
+    ]
+  },
+  "defaults": {
+    "port": 8080
+  },
+  "health": {
+    "mode": "workload_ready",
+    "timeoutSeconds": 300
+  },
+  "enabled": true
+}

package/fixtures/openapi/ServiceDeploymentTemplateInput/invalid/invalid-mixed-renderers.json

@@ -0,0 +1,40 @@
+{
+  "key": "http",
+  "name": "HTTP service",
+  "source": {
+    "renderer": "raw_yaml",
+    "files": [
+      {
+        "path": "deployment.yaml",
+        "content": "kind: Deployment\napiVersion: apps/v1\n"
+      }
+    ],
+    "helm": {
+      "repositoryUrl": "https://charts.example.test",
+      "chart": "web",
+      "version": "1.0.0",
+      "values": {}
+    }
+  },
+  "parameterSchema": {
+    "type": "object",
+    "properties": {
+      "port": {
+        "type": "integer",
+        "minimum": 1,
+        "maximum": 65535
+      }
+    },
+    "required": [
+      "port"
+    ]
+  },
+  "defaults": {
+    "port": 8080
+  },
+  "health": {
+    "mode": "workload_ready",
+    "timeoutSeconds": 300
+  },
+  "enabled": true
+}