@opensoha/contracts 0.1.4

package/fixtures/openapi/GovernanceStatusEnvelope/valid/minimal.json

@@ -0,0 +1,81 @@
+{
+  "data": {
+    "generatedAt": "2026-06-09T12:00:00Z",
+    "windowHours": 24,
+    "health": {
+      "status": "ok",
+      "message": "healthy"
+    },
+    "metrics": {
+      "totalCalls": 0,
+      "successCount": 0,
+      "denyCount": 0,
+      "failureCount": 0,
+      "pendingApprovalCount": 0,
+      "dryRunCount": 0
+    },
+    "tokens": {
+      "personalAccessTokens": {
+        "total": 0,
+        "active": 0,
+        "revoked": 0,
+        "expired": 0,
+        "expiringSoon": 0,
+        "stale": 0,
+        "neverUsed": 0
+      },
+      "serviceAccountTokens": {
+        "total": 0,
+        "active": 0,
+        "revoked": 0,
+        "expired": 0,
+        "expiringSoon": 0,
+        "stale": 0,
+        "neverUsed": 0
+      },
+      "lastUsedTrackingState": "enabled"
+    },
+    "clients": {
+      "total": 0,
+      "active": 0,
+      "disabled": 0,
+      "pendingApproval": 0,
+      "registrationApproval": "disabled"
+    },
+    "approvals": {
+      "pending": 0,
+      "dueSoon": 0,
+      "stalePending": 0,
+      "overdue": 0
+    },
+    "policyCoverage": {
+      "accessPolicies": 0,
+      "toolGrants": 0,
+      "skillBindings": 0,
+      "activeAccessPolicies": 0,
+      "activeToolGrants": 0,
+      "activeSkillBindings": 0,
+      "budgetPolicies": 0,
+      "rateLimitPolicies": 0,
+      "redactionPolicies": 0,
+      "resourceScopedAccessPolicies": 0,
+      "resourceScopedToolGrants": 0,
+      "budgetState": "not_configured",
+      "rateLimitState": "not_configured",
+      "redactionPolicyState": "not_configured",
+      "resourceScopeState": "not_configured"
+    },
+    "redaction": {
+      "totalMatches": 0,
+      "auditsWithRedaction": 0,
+      "inputAudits": 0,
+      "outputAudits": 0,
+      "fieldMatches": 0,
+      "sensitiveKeyMatches": 0,
+      "sensitiveTextMatches": 0,
+      "valuePatternMatches": 0,
+      "secretClassifierMatches": 0,
+      "structuredSecretMatches": 0
+    }
+  }
+}

package/fixtures/openapi/IdentityErrorEnvelope/invalid/raw-assertion.json

@@ -0,0 +1,7 @@
+{
+  "error": {
+    "code": "invalid_signature",
+    "message": "SAML response signature validation failed",
+    "assertion": "PHNhbWxwOlJlc3BvbnNlPg=="
+  }
+}

package/fixtures/openapi/IdentityErrorEnvelope/valid/invalid-signature.json

@@ -0,0 +1,7 @@
+{
+  "error": {
+    "code": "invalid_signature",
+    "message": "SAML response signature validation failed",
+    "request_id": "req-123"
+  }
+}

package/fixtures/openapi/IdentityOutpostClaimRequest/invalid/missing-protocol-version.json

@@ -0,0 +1,4 @@
+{
+  "agentId": "agent-01",
+  "currentConfigurationVersion": 7
+}

package/fixtures/openapi/IdentityOutpostClaimRequest/valid/current-version.json

@@ -0,0 +1,5 @@
+{
+  "agentId": "agent-01",
+  "supportedProtocolVersion": "1",
+  "currentConfigurationVersion": 7
+}

package/fixtures/openapi/IdentityRuntimeCapabilityEnvelope/invalid/missing-runtime-state.json

@@ -0,0 +1,17 @@
+{
+  "data": {
+    "samlLoginSource": { "available": true },
+    "samlApplicationProvider": { "available": true, "status": "available" },
+    "totp": { "available": true, "status": "available" },
+    "webauthn": { "available": false, "status": "unavailable" },
+    "recoveryCodes": { "available": true, "status": "available" },
+    "stepUp": { "available": true, "status": "available" },
+    "outpost": {
+      "controlPlane": { "available": true, "status": "available" },
+      "embeddedRuntime": { "available": true, "status": "available" },
+      "agentRuntime": { "available": true, "status": "available" },
+      "kubernetesArtifact": { "available": false, "status": "unavailable" },
+      "externalProtocol": { "available": true, "status": "available" }
+    }
+  }
+}

package/fixtures/openapi/IdentityRuntimeCapabilityEnvelope/valid/available.json

@@ -0,0 +1,17 @@
+{
+  "data": {
+    "samlLoginSource": { "available": true, "status": "available", "version": "1" },
+    "samlApplicationProvider": { "available": true, "status": "available", "version": "1" },
+    "totp": { "available": true, "status": "available" },
+    "webauthn": { "available": false, "status": "unavailable", "reason": "not configured" },
+    "recoveryCodes": { "available": true, "status": "available" },
+    "stepUp": { "available": true, "status": "available" },
+    "outpost": {
+      "controlPlane": { "available": true, "status": "available" },
+      "embeddedRuntime": { "available": true, "status": "available" },
+      "agentRuntime": { "available": true, "status": "available", "version": "1" },
+      "kubernetesArtifact": { "available": false, "status": "unavailable", "reason": "artifact not installed" },
+      "externalProtocol": { "available": true, "status": "available", "version": "1" }
+    }
+  }
+}

package/fixtures/openapi/KnowledgeIngestionJobInput/invalid/missing-source.json

@@ -0,0 +1 @@
+{}

package/fixtures/openapi/KnowledgeIngestionJobInput/valid/source.json

@@ -0,0 +1,3 @@
+{
+  "sourceId": "source-docs"
+}

package/fixtures/openapi/KubernetesResourceAgentCreateRequest/invalid/unresolved-target.json

@@ -0,0 +1,18 @@
+{
+  "operationId": "resource-create-01",
+  "documents": [
+    {
+      "document": {
+        "index": 0,
+        "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+      },
+      "resourceRef": {
+        "clusterId": "cluster-a",
+        "apiVersion": "v1",
+        "kind": "ConfigMap",
+        "scopeMode": "namespace"
+      },
+      "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app\n"
+    }
+  ]
+}

package/fixtures/openapi/KubernetesResourceAgentCreateRequest/valid/resolved-target.json

@@ -0,0 +1,25 @@
+{
+  "operationId": "resource-create-01",
+  "documents": [
+    {
+      "document": {
+        "index": 0,
+        "apiVersion": "v1",
+        "kind": "ConfigMap",
+        "name": "app",
+        "namespace": "minio",
+        "scopeMode": "namespace",
+        "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+      },
+      "resourceRef": {
+        "clusterId": "cluster-a",
+        "apiVersion": "v1",
+        "kind": "ConfigMap",
+        "name": "app",
+        "namespace": "minio",
+        "scopeMode": "namespace"
+      },
+      "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app\n  namespace: minio\n"
+    }
+  ]
+}

package/fixtures/openapi/KubernetesResourceCreateRequest/invalid/unknown-source.json

@@ -0,0 +1,5 @@
+{
+  "source": "admin_bypass",
+  "defaultNamespace": "minio",
+  "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app\n"
+}

package/fixtures/openapi/KubernetesResourceCreateRequest/valid/global-multi-document.json

@@ -0,0 +1,5 @@
+{
+  "source": "global_yaml",
+  "defaultNamespace": "minio",
+  "content": "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: app\n---\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: api\n  namespace: ops\n"
+}

package/fixtures/openapi/KubernetesResourceCreateResultEnvelope/invalid/bad-document-index.json

@@ -0,0 +1,21 @@
+{
+  "data": {
+    "operationId": "resource-create-01",
+    "status": "failed",
+    "contentHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "items": [
+      {
+        "document": {
+          "index": "first",
+          "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        },
+        "status": "failed",
+        "warnings": [],
+        "error": {
+          "code": "resource_create_denied",
+          "message": "Create access is denied."
+        }
+      }
+    ]
+  }
+}

package/fixtures/openapi/KubernetesResourceCreateResultEnvelope/valid/partial.json

@@ -0,0 +1,62 @@
+{
+  "data": {
+    "operationId": "resource-create-01",
+    "status": "partial",
+    "contentHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "items": [
+      {
+        "document": {
+          "index": 0,
+          "apiVersion": "v1",
+          "kind": "ConfigMap",
+          "name": "app",
+          "scopeMode": "namespace",
+          "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        },
+        "status": "succeeded",
+        "resourceRef": {
+          "clusterId": "cluster-a",
+          "apiVersion": "v1",
+          "kind": "ConfigMap",
+          "name": "app",
+          "namespace": "minio",
+          "scopeMode": "namespace",
+          "uid": "2d8494c5-df2a-4d95-aa1b-8e19998cf502"
+        },
+        "warnings": [],
+        "operationId": "resource-create-01-0"
+      },
+      {
+        "document": {
+          "index": 1,
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "ops",
+          "scopeMode": "namespace",
+          "contentHash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+        },
+        "status": "failed",
+        "warnings": [],
+        "error": {
+          "code": "resource_dry_run_failed",
+          "message": "The resource changed after preflight."
+        },
+        "operationId": "resource-create-01-1"
+      },
+      {
+        "document": {
+          "index": 2,
+          "apiVersion": "v1",
+          "kind": "Service",
+          "name": "api",
+          "namespace": "ops",
+          "scopeMode": "namespace",
+          "contentHash": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        },
+        "status": "not_started",
+        "warnings": []
+      }
+    ]
+  }
+}

package/fixtures/openapi/KubernetesResourceCreateScopeDecisionEnvelope/invalid/missing-capability.json

@@ -0,0 +1,12 @@
+{
+  "data": {
+    "allowed": true,
+    "allowedActions": ["create"],
+    "resourceScope": {
+      "clusterIds": ["cluster-a"],
+      "namespaces": ["minio"],
+      "resourceGroups": ["configuration"],
+      "resourceKinds": ["ConfigMap"]
+    }
+  }
+}

package/fixtures/openapi/KubernetesResourceCreateScopeDecisionEnvelope/valid/allowed.json

@@ -0,0 +1,17 @@
+{
+  "data": {
+    "allowed": true,
+    "allowedActions": ["list", "view", "create", "update", "delete"],
+    "resourceScope": {
+      "clusterIds": ["cluster-a"],
+      "namespaces": ["minio", "ops"],
+      "resourceGroups": ["configuration"],
+      "resourceKinds": ["ConfigMap", "Secret"]
+    },
+    "capability": {
+      "key": "resource.yaml.apply",
+      "status": "available",
+      "mode": "direct"
+    }
+  }
+}

package/fixtures/openapi/KubernetesResourcePreflightEnvelope/invalid/warning-without-message.json

@@ -0,0 +1,32 @@
+{
+  "data": {
+    "ready": true,
+    "contentHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "items": [
+      {
+        "document": {
+          "index": 0,
+          "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        },
+        "warnings": [{ "code": "cluster_scoped_namespace_ignored" }],
+        "authorization": {
+          "allowed": true,
+          "allowedActions": ["create"],
+          "resourceScope": {
+            "clusterIds": ["cluster-a"],
+            "namespaces": [],
+            "resourceGroups": ["access_control"],
+            "resourceKinds": ["ClusterRole"]
+          }
+        },
+        "capability": {
+          "key": "resource.yaml.apply",
+          "status": "available",
+          "mode": "direct"
+        },
+        "dryRun": { "status": "passed" },
+        "errors": []
+      }
+    ]
+  }
+}

package/fixtures/openapi/KubernetesResourcePreflightEnvelope/valid/mixed-diagnostics.json

@@ -0,0 +1,83 @@
+{
+  "data": {
+    "ready": false,
+    "contentHash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "items": [
+      {
+        "document": {
+          "index": 0,
+          "apiVersion": "rbac.authorization.k8s.io/v1",
+          "kind": "ClusterRole",
+          "name": "reader",
+          "namespace": "minio",
+          "scopeMode": "cluster",
+          "contentHash": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+        },
+        "warnings": [
+          {
+            "code": "cluster_scoped_namespace_ignored",
+            "message": "metadata.namespace is ignored for this cluster-scoped resource.",
+            "field": "metadata.namespace"
+          }
+        ],
+        "authorization": {
+          "allowed": true,
+          "allowedActions": ["create"],
+          "resourceScope": {
+            "clusterIds": ["cluster-a"],
+            "namespaces": [],
+            "resourceGroups": ["access_control"],
+            "resourceKinds": ["ClusterRole"]
+          }
+        },
+        "capability": {
+          "key": "resource.yaml.apply",
+          "status": "available",
+          "mode": "direct"
+        },
+        "dryRun": { "status": "passed" },
+        "errors": []
+      },
+      {
+        "document": {
+          "index": 1,
+          "apiVersion": "apps/v1",
+          "kind": "Deployment",
+          "name": "api",
+          "namespace": "ops",
+          "scopeMode": "namespace",
+          "contentHash": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+        },
+        "resolvedNamespace": "ops",
+        "warnings": [],
+        "authorization": {
+          "allowed": false,
+          "reason": "Create access is not granted in namespace ops.",
+          "allowedActions": ["list", "view"],
+          "resourceScope": {
+            "clusterIds": ["cluster-a"],
+            "namespaces": ["minio"],
+            "resourceGroups": ["workloads"],
+            "resourceKinds": []
+          },
+          "error": {
+            "code": "resource_create_denied",
+            "message": "Create access is not granted in namespace ops."
+          }
+        },
+        "capability": {
+          "key": "resource.yaml.apply",
+          "status": "available",
+          "mode": "direct"
+        },
+        "dryRun": { "status": "skipped" },
+        "errors": [
+          {
+            "code": "resource_create_denied",
+            "message": "Create access is not granted in namespace ops."
+          }
+        ]
+      }
+    ]
+  }
+}

package/fixtures/openapi/LogPage/invalid/missing-entry-source.json

@@ -0,0 +1,12 @@
+{
+  "entries": [
+    {
+      "timestamp": "2026-07-31T08:14:59Z",
+      "message": "request failed",
+      "sourceMode": "runtime"
+    }
+  ],
+  "partial": false,
+  "truncated": false,
+  "scopeRestricted": false
+}

package/fixtures/openapi/LogPage/valid/partial-runtime.json

@@ -0,0 +1,42 @@
+{
+  "entries": [
+    {
+      "timestamp": "2026-07-31T08:14:59.123456789Z",
+      "observedAt": "2026-07-31T08:14:59.200000000Z",
+      "message": "request failed",
+      "severity": "error",
+      "stream": "stderr",
+      "source": {
+        "domain": "kubernetes",
+        "clusterId": "cluster-a",
+        "namespace": "payments",
+        "workloadKind": "Deployment",
+        "workloadName": "checkout-api",
+        "workloadUid": "workload-uid",
+        "podName": "checkout-api-7f9d8",
+        "podUid": "pod-uid",
+        "containerName": "api"
+      },
+      "traceId": "4bf92f3577b34da6a3ce929d0e0e4736",
+      "attributes": {
+        "restartCount": "1"
+      },
+      "sourceMode": "runtime"
+    }
+  ],
+  "partial": true,
+  "truncated": false,
+  "scopeRestricted": false,
+  "coverage": {
+    "resolvedSources": 3,
+    "successfulSources": 2,
+    "failedSources": 1
+  },
+  "warnings": [
+    {
+      "code": "source_unavailable",
+      "message": "One authorized source was unavailable."
+    }
+  ],
+  "retentionHint": "Runtime logs are limited by kubelet retention."
+}

package/fixtures/openapi/LogQuery/invalid/missing-selector.json

@@ -0,0 +1,3 @@
+{
+  "sourceMode": "runtime"
+}

package/fixtures/openapi/LogQuery/invalid/unknown-source-mode.json

@@ -0,0 +1,6 @@
+{
+  "sourceMode": "archive",
+  "selector": {
+    "namespace": "payments"
+  }
+}

package/fixtures/openapi/LogQuery/valid/docker-project.json

@@ -0,0 +1,12 @@
+{
+  "sourceMode": "runtime",
+  "selector": {
+    "dockerService": "api"
+  },
+  "tail": 200,
+  "limit": 2000,
+  "direction": "forward",
+  "runtimeOptions": {
+    "sinceSeconds": 900
+  }
+}

package/fixtures/openapi/LogQuery/valid/runtime-workload.json

@@ -0,0 +1,21 @@
+{
+  "sourceMode": "runtime",
+  "selector": {
+    "namespace": "payments",
+    "workloadKind": "Deployment",
+    "workloadName": "checkout-api",
+    "containers": ["api"],
+    "allContainers": false
+  },
+  "from": "2026-07-31T08:00:00Z",
+  "to": "2026-07-31T08:15:00Z",
+  "tail": 200,
+  "limit": 1000,
+  "direction": "backward",
+  "text": "request failed",
+  "severities": ["error", "warn"],
+  "runtimeOptions": {
+    "previous": false,
+    "sinceSeconds": 900
+  }
+}

package/fixtures/openapi/LogStreamEvent/invalid/missing-entry.json

@@ -0,0 +1,3 @@
+{
+  "type": "entry"
+}

package/fixtures/openapi/LogStreamEvent/invalid/unknown-event-type.json

@@ -0,0 +1,3 @@
+{
+  "type": "log"
+}

package/fixtures/openapi/LogStreamEvent/valid/live-entry.json

@@ -0,0 +1,16 @@
+{
+  "type": "entry",
+  "entry": {
+    "timestamp": "2026-07-31T08:14:59Z",
+    "message": "ready",
+    "source": {
+      "domain": "kubernetes",
+      "clusterId": "cluster-a",
+      "namespace": "payments",
+      "podName": "checkout-api-7f9d8",
+      "containerName": "api"
+    },
+    "sourceMode": "runtime"
+  },
+  "cursor": "opaque-cursor"
+}

package/fixtures/openapi/MCPCapabilityListEnvelope/invalid/missing-scopes.json

@@ -0,0 +1,9 @@
+{
+  "items": [
+    {
+      "adapterID": "builtin",
+      "name": "k8s.list_pods",
+      "description": "List pods."
+    }
+  ]
+}

package/fixtures/openapi/MCPCapabilityListEnvelope/valid/minimal.json

@@ -0,0 +1,10 @@
+{
+  "items": [
+    {
+      "adapterID": "builtin",
+      "name": "k8s.list_pods",
+      "description": "List pods.",
+      "scopes": ["k8s:read"]
+    }
+  ]
+}

package/fixtures/openapi/MFAAdminResetRequest/invalid/missing-reason.json

@@ -0,0 +1,3 @@
+{
+  "revokeSessions": true
+}

package/fixtures/openapi/MFAAdminResetRequest/valid/security-incident.json

@@ -0,0 +1,4 @@
+{
+  "reason": "Credential reported compromised",
+  "revokeSessions": true
+}

package/fixtures/openapi/MFAWebAuthnRequestOptionsEnvelope/invalid/missing-challenge-id.json

@@ -0,0 +1,9 @@
+{
+  "data": {
+    "challenge": "b25lLXRpbWUtY2hhbGxlbmdl",
+    "rpId": "soha.example.com",
+    "timeoutMilliseconds": 60000,
+    "userVerification": "required",
+    "expiresAt": "2026-07-27T10:01:00Z"
+  }
+}

package/fixtures/openapi/MFAWebAuthnRequestOptionsEnvelope/valid/step-up.json

@@ -0,0 +1,11 @@
+{
+  "data": {
+    "challengeId": "challenge-01",
+    "challenge": "b25lLXRpbWUtY2hhbGxlbmdl",
+    "rpId": "soha.example.com",
+    "timeoutMilliseconds": 60000,
+    "userVerification": "required",
+    "allowCredentialIds": ["credential-01"],
+    "expiresAt": "2026-07-27T10:01:00Z"
+  }
+}