@opensoha/contracts 0.1.23 → 0.1.25

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:be2c1caf05e680f75b40e6ce017e55f1c35f7977cf045ca3ec562adbd6cb37dc",
+  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -8504,6 +8504,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.network.backend-tls-policies.create",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "create",
+      "displayName": "创建 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.delete",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "delete",
+      "displayName": "删除 Kubernetes BackendTLSPolicy",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.update",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "update",
+      "displayName": "修改 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.backend-tls-policies.view",
       "domain": "platform",
@@ -8755,6 +8803,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.grpc-routes.create",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.delete",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes GRPCRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.update",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.grpc-routes.view",
       "domain": "platform",
@@ -8775,6 +8871,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.http-routes.create",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.delete",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes HTTPRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.update",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.http-routes.view",
       "domain": "platform",
@@ -9084,6 +9228,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.reference-grants.create",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "create",
+      "displayName": "创建 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.delete",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReferenceGrant",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.update",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "update",
+      "displayName": "修改 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.reference-grants.view",
       "domain": "platform",
@@ -9358,6 +9550,22 @@
         "enable"
       ]
     },
+    {
+      "key": "platform.pods.create",
+      "domain": "platform",
+      "resource": "pods",
+      "action": "create",
+      "displayName": "创建 Kubernetes Pod",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.pods.delete",
       "domain": "platform",
@@ -9537,6 +9745,81 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.resource-monitoring.conntrack.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.conntrack",
+      "action": "view",
+      "displayName": "查看资源监控连接跟踪",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.cpu.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.cpu",
+      "action": "view",
+      "displayName": "查看资源监控CPU",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.memory.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.memory",
+      "action": "view",
+      "displayName": "查看资源监控内存",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.overview.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.overview",
+      "action": "view",
+      "displayName": "查看资源监控总览",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.pods.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.pods",
+      "action": "view",
+      "displayName": "查看资源监控Pod 容量",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.storage.persistent-volume-claims.create",
       "domain": "platform",
@@ -10183,6 +10466,22 @@
         "create"
       ]
     },
+    {
+      "key": "platform.workloads.replication-controllers.delete",
+      "domain": "platform",
+      "resource": "workloads.replication-controllers",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReplicationController",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.workloads.replication-controllers.update",
       "domain": "platform",
@@ -11886,6 +12185,37 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "virtualization.vm_access.update",
+      "domain": "virtualization",
+      "resource": "vm_access",
+      "action": "update",
+      "displayName": "管理虚拟机登录绑定",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true,
+      "legacyAliases": []
+    },
+    {
+      "key": "virtualization.vms.connect",
+      "domain": "virtualization",
+      "resource": "vms",
+      "action": "connect",
+      "displayName": "连接虚拟机 SSH",
+      "riskLevel": "execute",
+      "scopeKinds": [
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "virtualization.vms.console",
       "domain": "virtualization",

package/auth/token-claims.schema.json

@@ -41,6 +41,11 @@
       ]
     },
     "sessionId": { "type": "string" },
+    "authzVersion": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Authorization version at session access-token issuance. A version mismatch invalidates this token even after its session refreshes. Legacy tokens without this field require an authoritative current-identity lookup; their embedded roles must not restore revoked grants."
+    },
     "subjectType": {
       "type": "string",
       "enum": ["user", "service_account", "runner", "anonymous"]

package/compat/consumer-revisions.json

@@ -1,6 +1,7 @@
 {
-  "soha": "e022021d9f8da8917c135671f92248ef19f2b5b4",
-  "soha-web": "816ec0fb82e6e804f0f66d47d3446a7b5baeabc1",
+  "soha": "57bfa94873ff2825bccc6312842859011c1ec23a",
+  "soha-web": "447cbe5358802ef40d86ac67b7b59c5afe9c846a",
+  "soha-app": "0c3c76c373246f7d2218b48f68b89bf3097f777b",
   "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",
   "soha-agent": "af1efc0b0cd6bb544153429fa28244dd6cc81ac7",
   "soha-skills": "bc115fab583d00d4cc7350d8f314077d11bb5488"

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.23",
+  "version": "0.1.25",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.23",
+  "version": "0.1.25",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {

package/connectors/connector-action.schema.json

@@ -0,0 +1,138 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://contracts.opensoha.dev/connectors/connector-action.schema.json",
+  "title": "OpenSoha credential-bearing connector action v1",
+  "description": "Only over authenticated HTTPS or loopback transport, after an action explicitly declares credentialProtocol and aliases. Core pins and authorizes references. Credentials are invocation-local; never persist them in logs, queues, events or results. Actions without credentials keep the unversioned envelope. Runtime additionally rejects a canonical UTF-8 JSON envelope exceeding 1 MiB before dispatch. Cancellation signals and response rejection are cooperative, not proof that an external side effect stopped; action implementations must honor the signal and reconcile effects. All string material including structured keys is confidential.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "action",
+    "input",
+    "credentials"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "opensoha.dev/connector-action/v1"
+    },
+    "action": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "input": {
+      "type": "object"
+    },
+    "requestId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "credentials": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "expiresAt",
+        "entries"
+      ],
+      "properties": {
+        "expiresAt": {
+          "type": "string",
+          "format": "date-time",
+          "description": "Reject expired or more than two minutes in the future; signal cancellation and reject late responses when reached or caller disconnects. The connector must cooperate; this does not prove external effects stopped."
+        },
+        "entries": {
+          "type": "object",
+          "minProperties": 1,
+          "maxProperties": 16,
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
+          },
+          "additionalProperties": {
+            "$ref": "#/$defs/Credential"
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "Credential": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "reference",
+        "value"
+      ],
+      "properties": {
+        "reference": {
+          "type": "string",
+          "maxLength": 512,
+          "pattern": "^soha://secrets/[A-Za-z0-9._-]+/versions/[1-9][0-9]*$"
+        },
+        "value": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 65536,
+          "description": "Runtime additionally enforces a 64 KiB UTF-8 byte limit; structured material is bounded to depth 16 and 64 distinct nonempty strings including keys and the opaque value for redaction."
+        }
+      }
+    },
+    "ActionDefinition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "name",
+        "description",
+        "inputSchema"
+      ],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1
+        },
+        "inputSchema": {
+          "type": "object"
+        },
+        "credentialProtocol": {
+          "const": "opensoha.dev/connector-action/v1",
+          "description": "Opt-in support for per-call delivery, not a requirement for every action call. Without credentials the existing envelope remains valid; actions requiring authentication must reject missing credentials themselves."
+        },
+        "credentialAliases": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Z][A-Z0-9_]{0,63}$"
+          }
+        }
+      },
+      "dependentRequired": {
+        "credentialProtocol": [
+          "credentialAliases"
+        ],
+        "credentialAliases": [
+          "credentialProtocol"
+        ]
+      },
+      "if": {
+        "required": [
+          "credentialProtocol"
+        ]
+      },
+      "then": {
+        "properties": {
+          "name": {
+            "maxLength": 128
+          }
+        }
+      }
+    }
+  }
+}

package/fixtures/json-schema/connector-action/invalid/empty-values.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {}
+  }
+}

package/fixtures/json-schema/connector-action/invalid/invalid-expiry.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "tomorrow",
+    "entries": {
+      "SOURCE": {
+        "reference": "soha://secrets/source-fixture/versions/2",
+        "value": "synthetic-fixture-value"
+      }
+    }
+  }
+}

package/fixtures/json-schema/connector-action/invalid/lowercase-alias.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {
+      "source": {
+        "reference": "soha://secrets/source-fixture/versions/2",
+        "value": "synthetic-fixture-value"
+      }
+    }
+  }
+}

package/fixtures/json-schema/connector-action/invalid/unknown-entry-field.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {
+      "SOURCE": {
+        "reference": "soha://secrets/source-fixture/versions/2",
+        "value": "synthetic-fixture-value",
+        "role": "admin"
+      }
+    }
+  }
+}

package/fixtures/json-schema/connector-action/invalid/unknown-frame-field.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {
+      "SOURCE": {
+        "reference": "soha://secrets/source-fixture/versions/2",
+        "value": "synthetic-fixture-value"
+      }
+    }
+  },
+  "owner": "untrusted"
+}

package/fixtures/json-schema/connector-action/invalid/unknown-version.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v9",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {
+      "SOURCE": {
+        "reference": "soha://secrets/source-fixture/versions/2",
+        "value": "synthetic-fixture-value"
+      }
+    }
+  }
+}

package/fixtures/json-schema/connector-action/invalid/unversioned-reference.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "opensoha.dev/connector-action/v1",
+  "action": "knowledge.connector.http.fetch",
+  "input": {
+    "cursor": ""
+  },
+  "credentials": {
+    "expiresAt": "2026-10-10T00:00:10Z",
+    "entries": {
+      "SOURCE": {
+        "reference": "soha://secrets/source-fixture",
+        "value": "synthetic-fixture-value"
+      }
+    }
+  }
+}