@opensoha/contracts 0.1.25 → 0.1.27

package/COMPATIBILITY.md

@@ -22,6 +22,16 @@ Current stream: `0.1.x`.
 - `1.0.0` starts the stable contract line. After `1.0.0`, breaking changes
   require a major version bump, a migration note, and consumer coordination.
 
+## Proxy Configuration Inputs
+
+The proxy configuration endpoint accepts partial updates through
+`NetworkProxyConfigurationPatchInput`. Its optional `content` distinguishes omission
+from an explicit empty value. Existing Go consumers retain
+`NetworkProxyConfigurationInput.Content` as a string and the full-input
+`UpdateNetworkProxyConfigurationJSONRequestBody` alias. New Go consumers that omit
+encrypted content must explicitly use the Patch input. TypeScript operation types
+follow the partial HTTP schema. Both full and partial requests use the same endpoint.
+
 ## Version Synchronization
 
 Each release must keep these values aligned:
@@ -530,3 +540,27 @@ only synchronize their release-version metadata to satisfy their existing
 guards. Candidate matrices use the packed/local contracts source. Consumers
 must still pin the published version and validate the registry/proxy package
 before claiming released-version acceptance.
+
+
+## 0.1.26 delivery workbench contracts
+
+This release candidate adds optional stable Kubernetes resource identities,
+generic root-CR relationships and publication control, immutable template
+versions/adoption previews, migration declarations, and create-only first-release
+initialization. Existing request fields, operation IDs, action enums and client
+methods remain compatible. Published version snapshots and fixed consumer
+revisions are preserved.
+
+Template adoption is configuration, not proof of deployment. Runtime baselines
+require matching original resource UIDs and healthy execution/observation
+receipts. Unknown existing deployments remain blocked; initialization cannot
+adopt existing resources or replay uncertain writes. Migration guides are
+review information and are not executed as scripts.
+
+Core and Agent must implement the matching capability/provider protocols before
+using root-CR or initialization tasks. Old runtimes must reject unsupported
+protocols rather than interpret them as ordinary SSA or Helm updates. Publishing
+this SDK alone does not enable the feature or validate a production deployment.
+Consumers must pin the actually published npm/Go artifacts and validate the
+released combination; local tarballs and provenance policy files do not prove
+registry publication or an npm provenance attestation.

package/README.md

@@ -118,7 +118,7 @@ calling code in the consumer until those APIs are promoted into the supported
 client surface. Redirect-oriented flows such as OIDC provider redirects should
 not use the JSON-only `doJSON` helper until a non-JSON client mode is added.
 
-The Go generator and generated DTO checks run with Go 1.27.2 in CI.
+The Go generator and generated DTO checks run with Go 1.27.3 in CI.
 
 ## Validation
 

package/agent/environment/export.go

@@ -86,6 +86,7 @@ func (w *ExportWriter) Finish(request Request) (ExportResult, error) {
 	if err := binary.Write(w.Writer, binary.BigEndian, uint32(0)); err != nil {
 		return ExportResult{}, err
 	}
+	// #nosec G115 -- ValidateFor bounds all three lease IDs to 128 runes and the remaining receipt fields are fixed or bounded.
 	if err := binary.Write(w.Writer, binary.BigEndian, uint32(len(data))); err != nil {
 		return ExportResult{}, err
 	}

package/agent/environment/protocol_test.go

@@ -16,7 +16,7 @@ func TestRequestFixturesMatchRuntimeBoundary(t *testing.T) {
 		}
 		for _, file := range files {
 			t.Run(kind+"/"+filepath.Base(file), func(t *testing.T) {
-				data, err := os.ReadFile(file)
+				data, err := os.ReadFile(file) // #nosec G304 -- Glob is rooted in repository fixtures with fixed valid/invalid categories.
 				if err != nil {
 					t.Fatal(err)
 				}

package/agent/guest/protocol_test.go

@@ -35,7 +35,7 @@ func TestSchemaFixtures(t *testing.T) {
 			}
 			for _, file := range files {
 				t.Run(name+"/"+kind+"/"+filepath.Base(file), func(t *testing.T) {
-					data, err := os.ReadFile(file)
+					data, err := os.ReadFile(file) // #nosec G304 -- Glob uses only the fixed repository fixture names and valid/invalid categories above.
 					if err != nil {
 						t.Fatal(err)
 					}
@@ -50,7 +50,7 @@ func TestSchemaFixtures(t *testing.T) {
 
 func guestFixture[T any](t *testing.T, name string) T {
 	t.Helper()
-	data, err := os.ReadFile("../../fixtures/json-schema/personal-guest-" + name + "/valid/minimal.json")
+	data, err := os.ReadFile("../../fixtures/json-schema/personal-guest-" + name + "/valid/minimal.json") // #nosec G304 -- All callers pass constant test fixture names, never external input.
 	if err != nil {
 		t.Fatal(err)
 	}

package/auth/catalog_generated.go

@@ -6,8 +6,8 @@ import _ "embed"
 
 const (
 	PermissionCatalogVersion = "2.0.0"
-	PermissionCatalogContentSHA256 = "2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c"
-	PermissionCatalogSHA256 = "ae344007ad96fa0b24a0bf74121e1db762a1b904e58b8c8b53a8ac9168abea80"
+	PermissionCatalogContentSHA256 = "bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150"
+	PermissionCatalogSHA256 = "835ccdfccfa955ae3ee9377fffb4c523b53d2eb647d01840f79cce5524d72c36"
 )
 
 //go:embed permission-catalog.json

package/auth/permission-catalog.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "authorization.opensoha.io/v1",
   "catalogVersion": "2.0.0",
-  "contentHash": "sha256:2d98b53189afa67c09a2917325e3b1b1b70aafe00d370bdabaef7d6b11ef493c",
+  "contentHash": "sha256:bd4a7240d34750d3fcf38b4649f6dbe67b17fb0f6ebeb96a32f8d874685e5150",
   "permissions": [
     {
       "key": "access.directory.create",
@@ -3624,6 +3624,86 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "docker.dlp-appeals.review",
+      "domain": "docker",
+      "resource": "dlp-appeals",
+      "action": "approve",
+      "displayName": "审查卷文件 DLP 申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-events.view",
+      "domain": "docker",
+      "resource": "dlp-events",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.publish",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "trigger",
+      "displayName": "发布卷文件 DLP 策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.update",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "update",
+      "displayName": "编辑卷文件 DLP 草稿",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "docker.dlp-policy.view",
+      "domain": "docker",
+      "resource": "dlp-policy",
+      "action": "view",
+      "displayName": "查看卷文件 DLP 策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "docker.hosts.create",
       "domain": "docker",
@@ -4742,6 +4822,214 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.content_destinations.publish",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "publish",
+      "displayName": "发布受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.update",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "update",
+      "displayName": "编辑受管内容目的连接",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_destinations.view",
+      "domain": "network_access",
+      "resource": "content_destinations",
+      "action": "view",
+      "displayName": "查看受管内容目的连接",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_appeals.review",
+      "domain": "network_access",
+      "resource": "content_transfer_appeals",
+      "action": "review",
+      "displayName": "审查受管内容申诉",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfer_events.view",
+      "domain": "network_access",
+      "resource": "content_transfer_events",
+      "action": "view",
+      "displayName": "查看受管内容安全事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.create",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "create",
+      "displayName": "提交受管内容传输",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.delete",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "delete",
+      "displayName": "删除自己的受管文件",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.download",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "download",
+      "displayName": "下载自己的受管文件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.content_transfers.view",
+      "domain": "network_access",
+      "resource": "content_transfers",
+      "action": "view",
+      "displayName": "查看自己的受管内容记录",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.dlp_linkage.manage",
+      "domain": "network_access",
+      "resource": "dlp_linkage",
+      "action": "update",
+      "displayName": "管理全主体 DLP 网络联动",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.publish",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "publish",
+      "displayName": "发布端点通道控制",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.update",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "update",
+      "displayName": "编辑端点通道策略",
+      "riskLevel": "high",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_controls.view",
+      "domain": "network_access",
+      "resource": "endpoint_controls",
+      "action": "view",
+      "displayName": "查看端点通道策略与回执",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "eligible",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.endpoint_devices.update",
       "domain": "network_access",
@@ -4774,6 +5062,150 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.endpoint_response_events.maintenance",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "maintenance",
+      "displayName": "管理终端维护例外",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.restore",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "restore",
+      "displayName": "解除终端联动限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_events.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_events",
+      "action": "view",
+      "displayName": "查看终端联动事件",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.create",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "create",
+      "displayName": "创建终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.delete",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "delete",
+      "displayName": "停用终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.preview",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "preview",
+      "displayName": "预览终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.publish",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "publish",
+      "displayName": "发布终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.update",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "update",
+      "displayName": "修改终端联动策略",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.endpoint_response_policies.view",
+      "domain": "network_access",
+      "resource": "endpoint_response_policies",
+      "action": "view",
+      "displayName": "查看终端联动策略",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "network_access.enrollments.create",
       "domain": "network_access",
@@ -5478,6 +5910,54 @@
       "status": "active",
       "assignable": true
     },
+    {
+      "key": "network_access.vpn_sessions.release",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "release",
+      "displayName": "解除 VPN 重连限制",
+      "riskLevel": "mutate",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.revoke",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "revoke",
+      "displayName": "撤销 VPN 会话与重连",
+      "riskLevel": "execute",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
+    {
+      "key": "network_access.vpn_sessions.view",
+      "domain": "network_access",
+      "resource": "vpn_sessions",
+      "action": "view",
+      "displayName": "查看 VPN 会话限制",
+      "riskLevel": "read",
+      "scopeKinds": [
+        "tenant",
+        "workspace",
+        "resource"
+      ],
+      "approvalPolicy": "never",
+      "status": "active",
+      "assignable": true
+    },
     {
       "key": "observe.ai.chat",
       "domain": "observe",

package/compat/json-schema-ecosystem-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.25",
+  "version": "0.1.27",
   "schemas": {
     "plugins/plugin-manifest.schema.json": {
       "rootRequired": ["id", "name", "publisher", "type", "version"],

package/compat/openapi-loose-boundaries-0.1.0.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.25",
+  "version": "0.1.27",
   "generatedFrom": "openapi/soha-api.yaml",
   "entries": [
     {