@taskforcehq/taskforce 0.3.329 → 0.3.332

package/dist/shared/executorPhaseASchemas/approval-receipt.schema.json

@@ -0,0 +1,106 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-approval-receipt-v3.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "schema", "receiptId", "receiptKind", "originalCapabilityId", "residualInventorySha256",
+                "issuer", "audience", "environment", "workspaceId",
+                "taskId", "taskReference", "actorUserId", "runId", "preflightSha256",
+                "logicalEnvelopeSha256", "accountId", "readPrincipalArn", "mutationRoles", "roleMapSha256",
+                "oidcIssuer", "oidcAudience", "brokerPublicKeySpkiBase64", "brokerKeyFingerprint",
+                "region", "availabilityZone", "budgets", "sourceCommit", "approvedAt", "expiresAt",
+                "mutationDeadline", "cleanupDeadline"
+            ],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-approval-receipt-payload/v3" },
+                "receiptId": { "type": "string", "pattern": "^(?:approval-receipt|taskforce-approval)-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "receiptKind": { "enum": ["main", "cleanup-only"] },
+                "originalCapabilityId": { "oneOf": [{ "type": "null" }, { "type": "string", "pattern": "^run-capability-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" }] },
+                "residualInventorySha256": { "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/sha256" }] },
+                "issuer": { "type": "string", "pattern": "^https://[A-Za-z0-9.-]+(?::[0-9]+)?$", "maxLength": 240 },
+                "audience": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,100}$" },
+                "environment": { "const": "performance" },
+                "workspaceId": { "const": "workspace-019c771a-b6d7-7bc8-b837-c1133f3ba7a2" },
+                "taskId": { "const": "task-62fecb296bbe07ca535b6e6630fc458f" },
+                "taskReference": { "const": "T-1653" },
+                "actorUserId": { "type": "string", "pattern": "^user-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "runId": { "type": "string", "pattern": "^phase-a-[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$" },
+                "preflightSha256": { "$ref": "#/$defs/sha256" },
+                "logicalEnvelopeSha256": { "$ref": "#/$defs/sha256" },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "readPrincipalArn": { "$ref": "#/$defs/principalArn" },
+                "mutationRoles": { "$ref": "#/$defs/roleMap" },
+                "roleMapSha256": { "$ref": "#/$defs/sha256" },
+                "oidcIssuer": { "$ref": "#/$defs/httpsIssuer" },
+                "oidcAudience": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{2,100}$" },
+                "brokerPublicKeySpkiBase64": { "type": "string", "pattern": "^MCowBQYDK2VwAyEA[A-Za-z0-9+/]{43}=$" },
+                "brokerKeyFingerprint": { "$ref": "#/$defs/sha256" },
+                "region": { "const": "us-west-2" },
+                "availabilityZone": { "type": "string", "pattern": "^us-west-2[a-z]$" },
+                "budgets": { "$ref": "#/$defs/budgets" },
+                "sourceCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+                "approvedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" },
+                "mutationDeadline": { "$ref": "#/$defs/timestamp" },
+                "cleanupDeadline": { "$ref": "#/$defs/timestamp" }
+            },
+            "allOf": [
+                {
+                    "if": { "properties": { "receiptKind": { "const": "main" } } },
+                    "then": { "properties": { "originalCapabilityId": { "type": "null" }, "residualInventorySha256": { "type": "null" } } }
+                },
+                {
+                    "if": { "properties": { "receiptKind": { "const": "cleanup-only" } } },
+                    "then": { "properties": {
+                            "originalCapabilityId": { "type": "string", "pattern": "^run-capability-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                            "residualInventorySha256": { "$ref": "#/$defs/sha256" }
+                        } }
+                }
+            ]
+        },
+        "envelope": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    },
+    "$defs": {
+        "timestamp": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]{1,3})?Z$" },
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "principalArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:(?:user|role)/[A-Za-z0-9+=,.@_/-]{1,512}$|^arn:aws:sts::[0-9]{12}:assumed-role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "roleArn": { "type": "string", "pattern": "^arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9+=,.@_/-]{1,512}$" },
+        "httpsIssuer": { "type": "string", "pattern": "^https://[A-Za-z0-9.-]+(?::[0-9]+)?(?:/[A-Za-z0-9._~!$&'()*+,;=:@%-]+)*$", "maxLength": 240 },
+        "roleMap": {
+            "type": "object", "additionalProperties": false,
+            "required": ["bootstrap", "ami-build", "provenance", "runtime", "cleanup"],
+            "properties": {
+                "bootstrap": { "$ref": "#/$defs/roleArn" },
+                "ami-build": { "$ref": "#/$defs/roleArn" },
+                "provenance": { "$ref": "#/$defs/roleArn" },
+                "runtime": { "$ref": "#/$defs/roleArn" },
+                "cleanup": { "$ref": "#/$defs/roleArn" }
+            }
+        },
+        "budgets": {
+            "type": "object", "additionalProperties": false,
+            "required": ["temporaryUsdMicros", "alarmUsdMicros", "foundationMonthlyCeilingUsdMicros"],
+            "properties": {
+                "temporaryUsdMicros": { "type": "integer", "minimum": 1 },
+                "alarmUsdMicros": { "type": "integer", "minimum": 1 },
+                "foundationMonthlyCeilingUsdMicros": { "type": "integer", "minimum": 1 }
+            }
+        }
+    }
+}

package/dist/shared/executorPhaseASchemas/drift-attestation.schema.json

@@ -0,0 +1,54 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-drift-attestation-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "requestId", "runId", "accountId", "region", "status", "findings", "observedStateSha256", "collectedAt", "expiresAt"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-drift-attestation-payload/v1" },
+                "requestId": { "type": "string", "maxLength": 160 },
+                "runId": { "type": "string", "maxLength": 72 },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "region": { "const": "us-west-2" },
+                "status": { "enum": ["pass", "fail"] },
+                "findings": {
+                    "type": "array",
+                    "maxItems": 64,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["code", "expectedSha256", "observedSha256"],
+                        "properties": {
+                            "code": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{2,63}$" },
+                            "expectedSha256": { "$ref": "#/$defs/sha256" },
+                            "observedSha256": { "$ref": "#/$defs/sha256" }
+                        }
+                    }
+                },
+                "observedStateSha256": { "$ref": "#/$defs/sha256" },
+                "collectedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "RS256" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{342}$" }
+            }
+        }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$", "maxLength": 32 }
+    }
+}

package/dist/shared/executorPhaseASchemas/drift-request.schema.json

@@ -0,0 +1,47 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-drift-request-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "requestId", "capabilityId", "capabilitySha256", "receiptId", "receiptSha256", "workspaceId", "taskId", "runId", "accountId", "region", "sourceCommit", "logicalEnvelopeSha256", "budgetsSha256", "issuedAt", "expiresAt"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-drift-request-payload/v1" },
+                "requestId": { "type": "string", "pattern": "^drift-request-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "capabilityId": { "type": "string", "maxLength": 160 },
+                "capabilitySha256": { "$ref": "#/$defs/sha256" },
+                "receiptId": { "type": "string", "maxLength": 160 },
+                "receiptSha256": { "$ref": "#/$defs/sha256" },
+                "workspaceId": { "type": "string", "maxLength": 160 },
+                "taskId": { "type": "string", "maxLength": 160 },
+                "runId": { "type": "string", "maxLength": 72 },
+                "accountId": { "type": "string", "pattern": "^[0-9]{12}$" },
+                "region": { "const": "us-west-2" },
+                "sourceCommit": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+                "logicalEnvelopeSha256": { "$ref": "#/$defs/sha256" },
+                "budgetsSha256": { "$ref": "#/$defs/sha256" },
+                "issuedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$", "maxLength": 32 }
+    }
+}

package/dist/shared/executorPhaseASchemas/foundation-manifest.schema.json

@@ -0,0 +1,29 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-foundation-manifest-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["schema", "accountId", "region", "deploymentAuthorized", "templateSha256", "policySha256", "logicalIds", "expectedNames", "endpoints", "roles", "permissionBoundaries", "keys", "tables", "logs", "alarms", "rollbackInventory"],
+    "properties": {
+        "schema": { "const": "taskforce.executor-phase-a-foundation-manifest/v1" },
+        "accountId": { "const": "773989293823" },
+        "region": { "const": "us-west-2" },
+        "deploymentAuthorized": { "const": false },
+        "templateSha256": { "$ref": "#/$defs/sha256" },
+        "policySha256": { "$ref": "#/$defs/sha256" },
+        "logicalIds": { "$ref": "#/$defs/stringMap" },
+        "expectedNames": { "$ref": "#/$defs/stringMap" },
+        "endpoints": { "$ref": "#/$defs/stringMap" },
+        "roles": { "$ref": "#/$defs/stringMap" },
+        "permissionBoundaries": { "$ref": "#/$defs/stringMap" },
+        "keys": { "$ref": "#/$defs/stringMap" },
+        "tables": { "$ref": "#/$defs/stringMap" },
+        "logs": { "$ref": "#/$defs/stringMap" },
+        "alarms": { "$ref": "#/$defs/stringMap" },
+        "rollbackInventory": { "type": "array", "maxItems": 128, "items": { "type": "string", "minLength": 1, "maxLength": 256 } }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "stringMap": { "type": "object", "maxProperties": 128, "additionalProperties": { "type": "string", "minLength": 1, "maxLength": 1024 } }
+    }
+}

package/dist/shared/executorPhaseASchemas/issuer-audit-record.schema.json

@@ -0,0 +1,24 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-issuer-audit-record-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["schema", "requestId", "grantId", "grantSha256", "senderProofSha256", "status", "tokenId", "kmsKeyId", "errorCategory", "createdAt", "updatedAt"],
+    "properties": {
+        "schema": { "const": "taskforce.executor-phase-a-issuer-audit-record/v1" },
+        "requestId": { "type": "string", "maxLength": 160 },
+        "grantId": { "type": "string", "maxLength": 160 },
+        "grantSha256": { "$ref": "#/$defs/sha256" },
+        "senderProofSha256": { "$ref": "#/$defs/sha256" },
+        "status": { "enum": ["pending", "signed", "failed"] },
+        "tokenId": { "oneOf": [{ "type": "null" }, { "type": "string", "maxLength": 160 }] },
+        "kmsKeyId": { "oneOf": [{ "type": "null" }, { "type": "string", "maxLength": 256 }] },
+        "errorCategory": { "oneOf": [{ "type": "null" }, { "type": "string", "pattern": "^[a-z][a-z0-9_]{2,63}$" }] },
+        "createdAt": { "$ref": "#/$defs/timestamp" },
+        "updatedAt": { "$ref": "#/$defs/timestamp" }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$", "maxLength": 32 }
+    }
+}

package/dist/shared/executorPhaseASchemas/issuer-proof.schema.json

@@ -0,0 +1,43 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-issuer-proof-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "method", "path", "requestSha256", "grantId", "grantSha256", "senderProofSha256", "requestId", "issuedAt", "expiresAt"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-issuer-proof-payload/v1" },
+                "method": { "const": "POST" },
+                "path": { "const": "/api/taskforce/internal/executor/phase-a/redemptions" },
+                "requestSha256": { "$ref": "#/$defs/sha256" },
+                "grantId": { "type": "string", "pattern": "^workload-grant-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "grantSha256": { "$ref": "#/$defs/sha256" },
+                "senderProofSha256": { "$ref": "#/$defs/sha256" },
+                "requestId": { "type": "string", "pattern": "^issuer-request-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "issuedAt": { "$ref": "#/$defs/timestamp" },
+                "expiresAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "typ", "algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-issuer-proof/v1" },
+                "typ": { "const": "TF-ISSUER-PROOF" },
+                "algorithm": { "const": "RS256" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{342}$" }
+            }
+        }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$", "maxLength": 32 }
+    }
+}

package/dist/shared/executorPhaseASchemas/issuer-redemption-request.schema.json

@@ -0,0 +1,18 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-issuer-redemption-request-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["schema", "requestId", "approvalReceipt", "runCapability", "workloadGrant", "senderProof", "brokerRequestSha256", "expectedPolicySha256", "issuerProof"],
+    "properties": {
+        "schema": { "const": "taskforce.executor-phase-a-issuer-redemption-request/v1" },
+        "requestId": { "type": "string", "pattern": "^issuer-request-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+        "approvalReceipt": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-approval-receipt-v3.json" },
+        "runCapability": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-run-capability-v1.json" },
+        "workloadGrant": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-workload-grant-v1.json" },
+        "senderProof": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-sender-proof-v1.json" },
+        "brokerRequestSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "expectedPolicySha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "issuerProof": { "$ref": "https://taskforcehq.ai/schemas/executor-phase-a-issuer-proof-v1.json" }
+    }
+}

package/dist/shared/executorPhaseASchemas/issuer-redemption-response.schema.json

@@ -0,0 +1,39 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-issuer-redemption-response-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["payload", "envelope"],
+    "properties": {
+        "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["schema", "decision", "requestId", "grantId", "grantSha256", "senderProofSha256", "auditSha256", "redeemedAt"],
+            "properties": {
+                "schema": { "const": "taskforce.executor-phase-a-issuer-redemption-response-payload/v1" },
+                "decision": { "const": "redeemed" },
+                "requestId": { "type": "string", "pattern": "^issuer-request-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "grantId": { "type": "string", "pattern": "^workload-grant-[A-Za-z0-9][A-Za-z0-9_-]{7,127}$" },
+                "grantSha256": { "$ref": "#/$defs/sha256" },
+                "senderProofSha256": { "$ref": "#/$defs/sha256" },
+                "auditSha256": { "$ref": "#/$defs/sha256" },
+                "redeemedAt": { "$ref": "#/$defs/timestamp" }
+            }
+        },
+        "envelope": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["algorithm", "keyId", "payloadSha256", "signature"],
+            "properties": {
+                "algorithm": { "const": "Ed25519" },
+                "keyId": { "type": "string", "pattern": "^[A-Za-z0-9_-]{1,64}$" },
+                "payloadSha256": { "$ref": "#/$defs/sha256" },
+                "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+            }
+        }
+    },
+    "$defs": {
+        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "timestamp": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,3})?Z$", "maxLength": 32 }
+    }
+}

package/dist/shared/executorPhaseASchemas/logical-envelope.schema.json

@@ -0,0 +1,149 @@
+{
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "$id": "https://taskforcehq.ai/schemas/executor-phase-a-logical-envelope-v1.json",
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["resources", "network", "iam", "storage", "ports", "tags", "cleanupInventory"],
+    "properties": {
+        "resources": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["logicalId", "type", "name", "count", "purpose"],
+                "properties": {
+                    "logicalId": { "$ref": "#/$defs/logicalName" },
+                    "type": {
+                        "enum": [
+                            "cloudformation-stack", "ecr-repository", "iam-role", "iam-instance-profile",
+                            "kms-key", "vpc", "subnet", "route-table", "route", "network-acl",
+                            "security-group", "internet-gateway", "nat-gateway", "elastic-ip",
+                            "vpc-endpoint", "ecs-cluster", "ecs-task-definition", "ecs-service",
+                            "ec2-launch-template", "ec2-instance", "ebs-volume", "load-balancer",
+                            "listener", "target-group", "resolver-firewall", "dynamodb-table",
+                            "log-group", "budget", "alarm"
+                        ]
+                    },
+                    "name": { "$ref": "#/$defs/resourceName" },
+                    "count": { "type": "integer", "minimum": 1, "maximum": 100 },
+                    "purpose": { "type": "string", "minLength": 1, "maxLength": 160 }
+                }
+            }
+        },
+        "network": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["vpcCidr", "subnets", "routes", "sandboxHasPublicIp", "sandboxHasNat", "ipv6Enabled"],
+            "properties": {
+                "vpcCidr": { "$ref": "#/$defs/cidr" },
+                "subnets": {
+                    "type": "array", "minItems": 3, "uniqueItems": true,
+                    "items": {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["name", "purpose", "cidr", "availabilityZone"],
+                        "properties": {
+                            "name": { "$ref": "#/$defs/resourceName" },
+                            "purpose": { "enum": ["sandbox", "control", "tunnel-egress", "builder"] },
+                            "cidr": { "$ref": "#/$defs/cidr" },
+                            "availabilityZone": { "type": "string", "pattern": "^us-west-2[a-z]$" }
+                        }
+                    }
+                },
+                "routes": {
+                    "type": "array", "minItems": 1, "uniqueItems": true,
+                    "items": {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["subnetPurpose", "destination", "target"],
+                        "properties": {
+                            "subnetPurpose": { "enum": ["sandbox", "control", "tunnel-egress", "builder"] },
+                            "destination": { "$ref": "#/$defs/cidr" },
+                            "target": { "enum": ["local", "internet-gateway", "nat-gateway", "vpc-endpoint"] }
+                        }
+                    }
+                },
+                "sandboxHasPublicIp": { "const": false },
+                "sandboxHasNat": { "const": false },
+                "ipv6Enabled": { "const": false }
+            }
+        },
+        "iam": {
+            "type": "object", "additionalProperties": false, "required": ["roles"],
+            "properties": {
+                "roles": {
+                    "type": "array", "minItems": 1, "uniqueItems": true,
+                    "items": {
+                        "type": "object", "additionalProperties": false,
+                        "required": ["name", "purpose", "trustedService", "allowedActions", "resourcePatterns"],
+                        "properties": {
+                            "name": { "$ref": "#/$defs/resourceName" },
+                            "purpose": { "type": "string", "minLength": 1, "maxLength": 120 },
+                            "trustedService": { "enum": ["ec2.amazonaws.com", "ecs-tasks.amazonaws.com", "cloudformation.amazonaws.com"] },
+                            "allowedActions": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9-]+:[A-Za-z0-9*]+$" } },
+                            "resourcePatterns": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 512 } }
+                        }
+                    }
+                }
+            }
+        },
+        "storage": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false,
+                "required": ["purpose", "type", "sizeGiB", "encrypted", "deleteOnTermination", "iops", "throughputMiBps"],
+                "properties": {
+                    "purpose": { "enum": ["builder-root", "sandbox-host-root"] },
+                    "type": { "const": "gp3" },
+                    "sizeGiB": { "type": "integer", "minimum": 8, "maximum": 1024 },
+                    "encrypted": { "const": true },
+                    "deleteOnTermination": { "const": true },
+                    "iops": { "type": "integer", "minimum": 3000, "maximum": 16000 },
+                    "throughputMiBps": { "type": "integer", "minimum": 125, "maximum": 1000 }
+                }
+            }
+        },
+        "ports": {
+            "type": "array", "minItems": 2, "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false,
+                "required": ["purpose", "protocol", "port"],
+                "properties": {
+                    "purpose": { "enum": ["control", "provider-tunnel"] },
+                    "protocol": { "const": "tcp" },
+                    "port": { "type": "integer", "minimum": 1024, "maximum": 65535 }
+                }
+            }
+        },
+        "tags": {
+            "type": "array", "minItems": 2, "uniqueItems": true,
+            "items": {
+                "type": "object", "additionalProperties": false,
+                "required": ["key", "value"],
+                "properties": {
+                    "key": { "enum": ["TaskforcePhase", "TaskforceRunId", "TaskforceManaged"] },
+                    "value": { "type": "string", "minLength": 1, "maxLength": 128 }
+                }
+            }
+        },
+        "cleanupInventory": {
+            "type": "array", "minItems": 1, "uniqueItems": true,
+            "items": {
+                "enum": [
+                    "cloudformation-stacks", "packer-builders", "instance-profiles", "candidate-amis",
+                    "snapshots", "ec2-instances", "enis", "ebs-volumes", "ecs-tasks",
+                    "ecs-container-instances", "ecr-images", "ecr-repositories", "vpcs", "subnets",
+                    "route-tables", "routes", "network-acls", "security-groups", "nat-gateways",
+                    "elastic-ips", "load-balancers", "listeners", "target-groups", "resolver-firewalls",
+                    "vpc-endpoints", "dynamodb-tables", "log-groups", "kms-keys", "iam-resources",
+                    "alarms", "budgets"
+                ]
+            }
+        }
+    },
+    "$defs": {
+        "logicalName": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9]{1,127}$" },
+        "resourceName": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{1,126}[a-z0-9]$" },
+        "cidr": { "type": "string", "pattern": "^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}/(?:[0-9]|[12][0-9]|3[0-2])$" }
+    }
+}