@opensoha/contracts 0.1.24 → 0.1.26

package/COMPATIBILITY.md

@@ -530,3 +530,27 @@ only synchronize their release-version metadata to satisfy their existing
 guards. Candidate matrices use the packed/local contracts source. Consumers
 must still pin the published version and validate the registry/proxy package
 before claiming released-version acceptance.
+
+
+## 0.1.26 delivery workbench contracts
+
+This release candidate adds optional stable Kubernetes resource identities,
+generic root-CR relationships and publication control, immutable template
+versions/adoption previews, migration declarations, and create-only first-release
+initialization. Existing request fields, operation IDs, action enums and client
+methods remain compatible. Published version snapshots and fixed consumer
+revisions are preserved.
+
+Template adoption is configuration, not proof of deployment. Runtime baselines
+require matching original resource UIDs and healthy execution/observation
+receipts. Unknown existing deployments remain blocked; initialization cannot
+adopt existing resources or replay uncertain writes. Migration guides are
+review information and are not executed as scripts.
+
+Core and Agent must implement the matching capability/provider protocols before
+using root-CR or initialization tasks. Old runtimes must reject unsupported
+protocols rather than interpret them as ordinary SSA or Helm updates. Publishing
+this SDK alone does not enable the feature or validate a production deployment.
+Consumers must pin the actually published npm/Go artifacts and validate the
+released combination; local tarballs and provenance policy files do not prove
+registry publication or an npm provenance attestation.

package/README.md

@@ -118,7 +118,7 @@ calling code in the consumer until those APIs are promoted into the supported
 client surface. Redirect-oriented flows such as OIDC provider redirects should
 not use the JSON-only `doJSON` helper until a non-JSON client mode is added.
 
-The Go generator and generated DTO checks run with Go 1.27.2 in CI.
+The Go generator and generated DTO checks run with Go 1.27.3 in CI.
 
 ## Validation
 

package/agent/environment/export.go

@@ -86,6 +86,7 @@ func (w *ExportWriter) Finish(request Request) (ExportResult, error) {
 	if err := binary.Write(w.Writer, binary.BigEndian, uint32(0)); err != nil {
 		return ExportResult{}, err
 	}
+	// #nosec G115 -- ValidateFor bounds all three lease IDs to 128 runes and the remaining receipt fields are fixed or bounded.
 	if err := binary.Write(w.Writer, binary.BigEndian, uint32(len(data))); err != nil {
 		return ExportResult{}, err
 	}

package/agent/environment/protocol_test.go

@@ -16,7 +16,7 @@ func TestRequestFixturesMatchRuntimeBoundary(t *testing.T) {
 		}
 		for _, file := range files {
 			t.Run(kind+"/"+filepath.Base(file), func(t *testing.T) {
-				data, err := os.ReadFile(file)
+				data, err := os.ReadFile(file) // #nosec G304 -- Glob is rooted in repository fixtures with fixed valid/invalid categories.
 				if err != nil {
 					t.Fatal(err)
 				}

package/agent/guest/protocol_test.go

@@ -35,7 +35,7 @@ func TestSchemaFixtures(t *testing.T) {
 			}
 			for _, file := range files {
 				t.Run(name+"/"+kind+"/"+filepath.Base(file), func(t *testing.T) {
-					data, err := os.ReadFile(file)
+					data, err := os.ReadFile(file) // #nosec G304 -- Glob uses only the fixed repository fixture names and valid/invalid categories above.
 					if err != nil {
 						t.Fatal(err)
 					}
@@ -50,7 +50,7 @@ func TestSchemaFixtures(t *testing.T) {
 
 func guestFixture[T any](t *testing.T, name string) T {
 	t.Helper()
-	data, err := os.ReadFile("../../fixtures/json-schema/personal-guest-" + name + "/valid/minimal.json")
+	data, err := os.ReadFile("../../fixtures/json-schema/personal-guest-" + name + "/valid/minimal.json") // #nosec G304 -- All callers pass constant test fixture names, never external input.
 	if err != nil {
 		t.Fatal(err)
 	}

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2"
-	PermissionCatalogSHA256 = "e89a89c109f4dca0ba3a5bea754df659aa8d9bf0298344e5f0b9c5cc7520a2d2"
+	PermissionCatalogContentSHA256 = "2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c"
+	PermissionCatalogSHA256 = "ae344007ad96fa0b24a0bf74121e1db762a1b904e58b8c8b53a8ac9168abea80"
 )
 
 //go:embed permission-catalog.json

package/auth/gateway_permissions_test.go

@@ -0,0 +1,48 @@
+package auth
+
+import (
+	"encoding/json"
+	"slices"
+	"testing"
+)
+
+func TestGatewayRouteMutationPermissionsAreExplicit(t *testing.T) {
+	var catalog struct {
+		Permissions []struct {
+			Key            string   `json:"key"`
+			Resource       string   `json:"resource"`
+			Action         string   `json:"action"`
+			RiskLevel      string   `json:"riskLevel"`
+			ScopeKinds     []string `json:"scopeKinds"`
+			ApprovalPolicy string   `json:"approvalPolicy"`
+			LegacyAliases  []string `json:"legacyAliases"`
+		}
+	}
+	if err := json.Unmarshal(PermissionCatalogJSON(), &catalog); err != nil {
+		t.Fatal(err)
+	}
+	for _, resource := range []string{"http-routes", "grpc-routes", "backend-tls-policies", "reference-grants"} {
+		for _, action := range []string{"create", "update", "delete"} {
+			key := "platform.network." + resource + "." + action
+			var index = -1
+			for i, permission := range catalog.Permissions {
+				if permission.Key == key {
+					index = i
+					break
+				}
+			}
+			if index < 0 {
+				t.Fatalf("missing %s", key)
+			}
+			p := catalog.Permissions[index]
+
+			risk, approval := "mutate", "never"
+			if action == "delete" {
+				risk, approval = "high", "eligible"
+			}
+			if p.Resource != "network."+resource || p.Action != action || p.RiskLevel != risk || p.ApprovalPolicy != approval || !slices.Contains(p.ScopeKinds, "namespace") || len(p.LegacyAliases) != 0 {
+				t.Fatalf("invalid explicit mutation permission: %+v", p)
+			}
+		}
+	}
+}

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:b1a07eef4c26f91735b65ec18799e530271a47d0eed1de60f9a955d11208f9a2",
+  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -8504,6 +8504,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.network.backend-tls-policies.create",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "create",
+      "displayName": "创建 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.delete",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "delete",
+      "displayName": "删除 Kubernetes BackendTLSPolicy",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.backend-tls-policies.update",
+      "domain": "platform",
+      "resource": "network.backend-tls-policies",
+      "action": "update",
+      "displayName": "修改 Kubernetes BackendTLSPolicy",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.backend-tls-policies.view",
       "domain": "platform",
@@ -8755,6 +8803,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.grpc-routes.create",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.delete",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes GRPCRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.grpc-routes.update",
+      "domain": "platform",
+      "resource": "network.grpc-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes GRPCRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.grpc-routes.view",
       "domain": "platform",
@@ -8775,6 +8871,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.http-routes.create",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "create",
+      "displayName": "创建 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.delete",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "delete",
+      "displayName": "删除 Kubernetes HTTPRoute",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.http-routes.update",
+      "domain": "platform",
+      "resource": "network.http-routes",
+      "action": "update",
+      "displayName": "修改 Kubernetes HTTPRoute",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.http-routes.view",
       "domain": "platform",
@@ -9084,6 +9228,54 @@
         "platform.network.view"
       ]
     },
+    {
+      "key": "platform.network.reference-grants.create",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "create",
+      "displayName": "创建 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.delete",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReferenceGrant",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.network.reference-grants.update",
+      "domain": "platform",
+      "resource": "network.reference-grants",
+      "action": "update",
+      "displayName": "修改 Kubernetes ReferenceGrant",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.network.reference-grants.view",
       "domain": "platform",
@@ -9358,6 +9550,22 @@
         "enable"
       ]
     },
+    {
+      "key": "platform.pods.create",
+      "domain": "platform",
+      "resource": "pods",
+      "action": "create",
+      "displayName": "创建 Kubernetes Pod",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.pods.delete",
       "domain": "platform",
@@ -9537,6 +9745,81 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "platform.resource-monitoring.conntrack.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.conntrack",
+      "action": "view",
+      "displayName": "查看资源监控连接跟踪",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.cpu.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.cpu",
+      "action": "view",
+      "displayName": "查看资源监控CPU",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.memory.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.memory",
+      "action": "view",
+      "displayName": "查看资源监控内存",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.overview.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.overview",
+      "action": "view",
+      "displayName": "查看资源监控总览",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "platform.resource-monitoring.pods.view",
+      "domain": "platform",
+      "resource": "resource-monitoring.pods",
+      "action": "view",
+      "displayName": "查看资源监控Pod 容量",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "workspace",
+        "cluster"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.storage.persistent-volume-claims.create",
       "domain": "platform",
@@ -10183,6 +10466,22 @@
         "create"
       ]
     },
+    {
+      "key": "platform.workloads.replication-controllers.delete",
+      "domain": "platform",
+      "resource": "workloads.replication-controllers",
+      "action": "delete",
+      "displayName": "删除 Kubernetes ReplicationController",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "cluster",
+        "namespace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "platform.workloads.replication-controllers.update",
       "domain": "platform",

package/compat/consumer-revisions.json

@@ -1,5 +1,5 @@
 {
-  "soha": "c29cc6294dd4b7cb69db1187d728c227475fdf7c",
+  "soha": "57bfa94873ff2825bccc6312842859011c1ec23a",
   "soha-web": "447cbe5358802ef40d86ac67b7b59c5afe9c846a",
   "soha-app": "0c3c76c373246f7d2218b48f68b89bf3097f777b",
   "soha-cli": "1c9b760c986a9c1a5148db55b72ab99d23edd7a3",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.26",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.26",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {