@warpgogol/werkstatt-shared 0.14.1 → 0.16.0

package/src/ontology/operations/mission.ts

@@ -0,0 +1,111 @@
+/*
+<MODULE_CONTRACT>
+<purpose>RFC-0355: Zod schemas for Mission lifecycle and Bordbuch (hash-chain logbook).</purpose>
+<non-goals>
+  <item>Does not define materialization — that is RFC-0356.</item>
+  <item>Does not define release discipline — that is RFC-0357.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0517: add preflight-skipped kind for preflight gate bypass audit trail.</item>
+  <item>RFC-0706: add nachweis-record and nachweis-consent kinds for Nachweisregister trust lifecycle (ADR-0028).</item>
+  <item>RFC-0715: add nachweis-signed and nachweis-timestamped kinds for N3 cryptographic verification.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — werkstatt-engine clean
+
+Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
+  <history>RFC-0355, RFC-0473, RFC-0479, RFC-0480</history>
+</CHANGE_SUMMARY>
+*/
+
+import { z } from "zod";
+
+const missionIdRegex = /^[a-z0-9]+(-[a-z0-9]+)*-m\d{6}$/;
+const systemIdRegex = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const eventIdRegex = /^event-\d{6}$/;
+
+export const missionStateSchema = z.enum(["open", "closed", "aborted"]);
+
+export const missionManifestSchema = z.object({
+  schemaVersion: z.string().min(1),
+  missionId: z.string().regex(missionIdRegex),
+  systemId: z.string().regex(systemIdRegex),
+  state: missionStateSchema,
+  brief: z.string().min(1),
+  openedAt: z.string().datetime(),
+  openedBy: z.string().min(1),
+  closedAt: z.string().datetime().nullable(),
+  closedBy: z.string().nullable(),
+  pinAtOpen: z.string().min(1),
+  materializedAt: z.string().datetime().nullable(),
+  reconciledAt: z.string().datetime().nullable(),
+  migratedAt: z.string().datetime().nullable(),
+  releaseId: z.string().nullable(),
+  rfcId: z.string().nullable().default(null),
+  operationId: z.string().min(1),
+});
+
+// When renaming or removing a value from this enum, add the old value to
+// DEPRECATED_KIND_MIGRATIONS in packages/os/site-kernel-handoff/src/bordbuch/bordbuch-io.ts
+// so that existing bordbuch entries on disk are normalized during readBordbuch.
+export const bordbuchEntryKindSchema = z.enum([
+  "mission-open",
+  "mission-close",
+  "mission-abort",
+  "mission-open-rolled-back",
+  "release-ready",
+  "release-rolled-back",
+  "pin-update",
+  "deployment",
+  "notausgang-export",
+  "operator-note",
+  "erratum",
+  "mirror-sync",
+  "pseo",
+  "indexnow.submit",
+  "mission-migrate",
+  "preflight-skipped",
+  // RFC-0706 / ADR-0028: Nachweisregister trust lifecycle
+  "nachweis-record",
+  "nachweis-consent",
+  // RFC-0715: N3 cryptographic verification (operator signature + RFC 3161 timestamp)
+  "nachweis-signed",
+  "nachweis-timestamped",
+  // RFC-0888: Sichtpass lifecycle audit trail
+  "sichtpass",
+  // RFC-0968: Sternsystem handover protocol
+  "handover",
+  // RFC-1031: Evolution controller candidate lifecycle
+  "candidate",
+  // RFC-1037: External-effect compensation verification
+  "effect",
+  // RFC-1035: Isolation controller sandbox lifecycle events
+  "isolation",
+]);
+
+export const bordbuchEntryStatusSchema = z.enum(["done", "failed", "waiting", "escalated"]);
+
+export const bordbuchEntrySchema = z.object({
+  schemaVersion: z.literal("1.0.0"),
+  id: z.string().regex(eventIdRegex),
+  systemId: z.string().min(1),
+  occurredAt: z.string().datetime(),
+  kind: bordbuchEntryKindSchema,
+  status: bordbuchEntryStatusSchema,
+  missionId: z.string().nullable(),
+  releaseId: z.string().nullable(),
+  actor: z.string().min(1),
+  summary: z.string().min(1),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  previousHash: z.string().nullable(),
+  hash: z.string().min(1),
+  erratumOf: z.string().optional(),
+});
+
+export type MissionState = z.infer<typeof missionStateSchema>;
+export type MissionManifest = z.infer<typeof missionManifestSchema>;
+export type BordbuchEntryKind = z.infer<typeof bordbuchEntryKindSchema>;
+export type BordbuchEntryStatus = z.infer<typeof bordbuchEntryStatusSchema>;
+export type BordbuchEntry = z.infer<typeof bordbuchEntrySchema>;

package/src/ontology/operations/naming-policy.ts

@@ -0,0 +1,132 @@
+/*
+<MODULE_CONTRACT>
+<purpose>RFC-0361: Centralized naming policy regexes and policy descriptors for Sternsystem, Mission, Release, and Bordbuch ids. RFC-0902: add KNOWN_TLDS and hasTldSuffix() for TLD-suffix detection.</purpose>
+<non-goals>
+  <item>Does not define filename policies — that is DNA-6 / RFC-0360.</item>
+  <item>Does not define content-level naming — that is RFC-0047.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0361: initial centralized naming policy regexes and descriptors.</item>
+  <item>RFC-0902: add KNOWN_TLDS set and hasTldSuffix() function; update examples to TLD-free IDs.</item>
+</CHANGE_SUMMARY>
+*/
+
+export const STERNSYSTEM_ID_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+export const MISSION_ID_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*-m\d{6}$/;
+export const RELEASE_ID_REGEX = /^[a-z0-9]+(-[a-z0-9]+)*-r\d{6}$/;
+export const BORDBUCH_EVENT_ID_REGEX = /^event-\d{6}$/;
+
+export const NON_ASCII_REGEX = /[^\x00-\x7F]/;
+
+// RFC-0902: Known TLD suffixes that must not appear as the last segment of a Sternsystem ID.
+// Conservative list — add TLDs as needed. Removing a TLD from this set is a code change, not an RFC.
+export const KNOWN_TLDS: ReadonlySet<string> = new Set([
+  "com",
+  "org",
+  "net",
+  "de",
+  "at",
+  "ch",
+  "it",
+  "fr",
+  "es",
+  "nl",
+  "be",
+  "pl",
+  "se",
+  "no",
+  "dk",
+  "fi",
+  "pt",
+  "cz",
+  "sk",
+  "hu",
+  "ro",
+  "bg",
+  "hr",
+  "si",
+  "lt",
+  "lv",
+  "ee",
+  "ie",
+  "lu",
+  "mt",
+  "cy",
+  "gr",
+  "uk",
+  "us",
+  "ca",
+  "au",
+  "nz",
+  "io",
+  "co",
+  "ai",
+  "dev",
+  "app",
+  "eu",
+  "info",
+  "biz",
+  "me",
+  "tv",
+  "gg",
+  "to",
+  "xyz",
+  "site",
+  "online",
+  "store",
+  "shop",
+  "blog",
+  "cloud",
+]);
+
+// RFC-0902: Returns true if the last hyphen-separated segment of the id is a known TLD.
+// Single-segment IDs (e.g. "com", "warpgogol") return false — the concern is suffix segments.
+export function hasTldSuffix(id: string): boolean {
+  const segments = id.split("-");
+  if (segments.length < 2) return false;
+  return KNOWN_TLDS.has(segments[segments.length - 1]);
+}
+
+export const STERNSYSTEM_ID_POLICY = {
+  regex: STERNSYSTEM_ID_REGEX,
+  charset: "ASCII lowercase letters (a-z), digits (0-9), hyphens (-)",
+  description: "kebab-case, lowercase, latin-only",
+  examples: ["warpgogol", "nicaragua-projekt"],
+  counterExamples: [
+    "Warpgogol-Com",
+    "nicaragüa-projekt",
+    "warpgogol--com",
+    "-warpgogol",
+    "warpgogol-",
+  ],
+  tldCounterExamples: ["warpgogol-com", "nicaragua-projekt-org", "example-de"],
+} as const;
+
+export const MISSION_ID_POLICY = {
+  regex: MISSION_ID_REGEX,
+  format: "<system-id>-m<NNNNNN>",
+  description: "system id + literal -m + zero-padded six-digit sequence",
+  examples: ["warpgogol-m000001", "nicaragua-projekt-m000042"],
+  counterExamples: ["warpgogol-com-m1", "warpgogol-com-M000001", "warpgogol-com-m0000001"],
+} as const;
+
+export const RELEASE_ID_POLICY = {
+  regex: RELEASE_ID_REGEX,
+  format: "<system-id>-r<NNNNNN>",
+  description: "system id + literal -r + zero-padded six-digit sequence",
+  examples: ["warpgogol-r000001", "nicaragua-projekt-r000042"],
+  counterExamples: ["warpgogol-com-r1", "warpgogol-com-R000001", "warpgogol-com-r0000001"],
+} as const;
+
+export const BORDBUCH_EVENT_ID_POLICY = {
+  regex: BORDBUCH_EVENT_ID_REGEX,
+  format: "event-<NNNNNN>",
+  description: "literal 'event-' + zero-padded six-digit sequence",
+  examples: ["event-000001", "event-000042"],
+  counterExamples: ["event-1", "event-0000001", "EVENT-000001"],
+} as const;
+
+export function isLatinOnly(value: string): boolean {
+  return !NON_ASCII_REGEX.test(value);
+}

package/src/ontology/operations/notausgang.ts

@@ -0,0 +1,108 @@
+/*
+<MODULE_CONTRACT>
+<purpose>RFC-0359 + RFC-0380: Zod schemas for Notausgang export manifest and integration manifest. RFC-0380 deepens the manifest schema for deep integrity verification by notausgang.validate.</purpose>
+<non-goals>
+  <item>Do not introduce app-specific runtime composition or deployment behavior into this reusable package source file.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0359: initial notausgang and integration manifest schemas.</item>
+  <item>RFC-0380: schema validated by notausgang.validate for deep integrity verification (schema shape unchanged, already uses STERNSYSTEM_ID_REGEX and RELEASE_ID_REGEX).</item>
+</CHANGE_SUMMARY>
+*/
+
+import { z } from "zod";
+import { STERNSYSTEM_ID_REGEX, RELEASE_ID_REGEX } from "./naming-policy.ts";
+import { starNameSchema } from "@warpgogol/werkstatt-shared/ontology/cosmic";
+
+export const integrationSecretLocationSchema = z.object({
+  file: z.string(),
+  jsonPath: z.string(),
+  envVar: z.string().optional(),
+});
+
+export const integrationManifestSchema = z.object({
+  schemaVersion: z.string().min(1),
+  integrations: z.record(z.string(), z.array(integrationSecretLocationSchema)),
+});
+
+export const integrationNullingSchema = z.object({
+  nulled: z.array(z.string()),
+  exceptions: z.array(
+    z.object({
+      name: z.string(),
+      reason: z.string(),
+    }),
+  ),
+});
+
+// RFC-1120: per-artifact record inside an evidence bundle verdict
+export const notausgangEvidenceArtifactSchema = z.object({
+  itemKey: z.string().min(1),
+  filename: z.string().min(1).optional(),
+  sha256: z
+    .string()
+    .regex(/^[a-f0-9]{64}$/)
+    .optional(),
+  recordedSha256: z
+    .string()
+    .regex(/^[a-f0-9]{64}$/)
+    .optional(),
+  r2Path: z.string().min(1).optional(),
+  external: z.boolean().optional(),
+  url: z.string().min(1).optional(),
+});
+
+// RFC-1120: per-source verdict — "bundled" | "external-reference" | "excluded:<reason>"
+export const notausgangEvidenceVerdictSchema = z.object({
+  verdict: z.string().regex(/^(bundled|external-reference|excluded:.+)$/),
+  artifacts: z.array(notausgangEvidenceArtifactSchema).optional(),
+});
+
+// RFC-1120: dynamic-feature disclosure entry
+export const notausgangFeatureNoteSchema = z.object({
+  feature: z.string().min(1),
+  verdict: z.enum(["static-ok", "frozen-at-export", "needs-backend"]),
+  detail: z.string(),
+});
+
+export const notausgangManifestSchema = z.object({
+  schemaVersion: z.string().min(1),
+  systemId: z.string().regex(STERNSYSTEM_ID_REGEX),
+  cosmicStar: starNameSchema,
+  releaseId: z.string().regex(RELEASE_ID_REGEX),
+  exportedAt: z.string().datetime(),
+  platformVersion: z.string(),
+  platformSemanticHash: z.string(),
+  semver: z.string(),
+  source: z.object({
+    releaseManifestHash: z.string(),
+    artifactManifestHash: z.string(),
+    distArtifactHash: z.string(),
+    siteContentHash: z.string(),
+    behaviorSnapshotHash: z.string(),
+  }),
+  integrationNulling: integrationNullingSchema,
+  distHash: z.string(),
+  siteHash: z.string(),
+  bordbuchHash: z.string(),
+  // RFC-1120: optional in schema (granular NA-* rules report absence);
+  // mandatory in packages produced by notausgang.export.
+  evidence: z.record(z.string(), notausgangEvidenceVerdictSchema).optional(),
+  features: z.array(notausgangFeatureNoteSchema).optional(),
+  verifier: z
+    .object({
+      script: z.literal("verify.py"),
+      runtime: z.literal("python3-stdlib"),
+      manifestFile: z.literal("notausgang-manifest.json"),
+    })
+    .optional(),
+});
+
+export type IntegrationSecretLocation = z.infer<typeof integrationSecretLocationSchema>;
+export type IntegrationManifest = z.infer<typeof integrationManifestSchema>;
+export type IntegrationNulling = z.infer<typeof integrationNullingSchema>;
+export type NotausgangEvidenceArtifact = z.infer<typeof notausgangEvidenceArtifactSchema>;
+export type NotausgangEvidenceVerdict = z.infer<typeof notausgangEvidenceVerdictSchema>;
+export type NotausgangFeatureNote = z.infer<typeof notausgangFeatureNoteSchema>;
+export type NotausgangManifest = z.infer<typeof notausgangManifestSchema>;

package/src/ontology/operations/release.ts

@@ -0,0 +1,121 @@
+/*
+<MODULE_CONTRACT>
+<purpose>RFC-0357/RFC-0851: Zod schemas for release manifest (artifact-only prepared|ready), behavior snapshot wrapper, snapshot diff, and legacy release diagnostics.</purpose>
+<non-goals>
+  <item>Do not introduce app-specific runtime composition or deployment behavior into this reusable package source file.</item>
+  <item>Do not reintroduce legacy deployment states (published, dev-deployed, alt-deployed, promoted, main-deployed, rolled-back) into the artifact state schema.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0357: initial release and behavior snapshot schemas.</item>
+  <item>RFC-0608: extend releaseStateSchema with alt-deployed and promoted; add buildIdentitySchema.</item>
+  <item>RFC-0627: add dev-deployed state (precedes alt-deployed in the three-channel deployment chain).</item>
+  <item>RFC-0628: remove dev-deployed state (workpiece-based dev deploy does not enter the release state machine).</item>
+  <item>RFC-0851: replace legacy state enum with artifact-only prepared|ready; make manifest strict; replace publishedAt with readyAt; add legacyReleaseStateSchema and legacyReleaseDiagnosticSchema.</item>
+</CHANGE_SUMMARY>
+*/
+
+import { z } from "zod";
+import { STERNSYSTEM_ID_REGEX, MISSION_ID_REGEX, RELEASE_ID_REGEX } from "./naming-policy.ts";
+import { releaseArtifactRefSchema as artifactRefSchema } from "./artifact-store.ts";
+
+export const releaseArtifactStateSchema = z.enum(["prepared", "ready"]);
+
+export const releaseStateSchema = releaseArtifactStateSchema;
+
+export const legacyReleaseStateSchema = z.enum([
+  "published",
+  "dev-deployed",
+  "alt-deployed",
+  "promoted",
+  "main-deployed",
+  "rolled-back",
+]);
+
+export const legacyReleaseDiagnosticSchema = z
+  .object({
+    schema: z.literal("werkstatt/legacy-release-diagnostic@1"),
+    releaseId: z.string().regex(RELEASE_ID_REGEX),
+    legacyState: legacyReleaseStateSchema,
+    ruleId: z.literal("CERT-LEGACY-STATE-01"),
+    message: z.string().min(1),
+    fixHint: z.string().min(1),
+  })
+  .strict();
+
+export const releaseManifestSchema = z
+  .object({
+    schemaVersion: z.string().min(1),
+    releaseId: z.string().regex(RELEASE_ID_REGEX),
+    systemId: z.string().regex(STERNSYSTEM_ID_REGEX),
+    missionId: z.string().regex(MISSION_ID_REGEX),
+    semver: z.string(),
+    platformVersion: z.string(),
+    createdAt: z.string().datetime(),
+    readyAt: z.string().datetime().nullable(),
+    state: releaseArtifactStateSchema,
+    commitSha: z.string(),
+    platformSemanticHash: z.string(),
+    siteContentHash: z.string(),
+    distTreeHash: z.string(),
+    distArtifactHash: z.string().nullable(),
+    artifact: artifactRefSchema.nullable(),
+    behaviorSnapshotHash: z.string(),
+    readableSnapshotHash: z.string(),
+    qualityReportHash: z.string().nullable(),
+    snapshotDiffVerdict: z.enum(["pass", "fail"]),
+    migratorVerdict: z.enum(["pass", "fail"]),
+    versionCompareVerdict: z.enum(["in-sync", "catch-up", "refuse-downgrade"]),
+    bootSmokeVerdict: z.enum(["pass", "fail"]),
+  })
+  .strict();
+
+export const releaseArtifactRefSchema = z.object({
+  store: z.literal("werkstatt-local"),
+  algorithm: z.literal("sha256"),
+  digest: z.string(),
+  uri: z.string(),
+  manifestHash: z.string(),
+});
+
+export const behaviorSnapshotDifferenceSchema = z.object({
+  field: z.string(),
+  kind: z.enum(["added", "removed", "changed"]),
+  detail: z.string(),
+});
+
+export const behaviorSnapshotDiffSchema = z.object({
+  schemaVersion: z.string().min(1),
+  baselineHash: z.string(),
+  candidateHash: z.string(),
+  verdict: z.enum(["pass", "fail"]),
+  differences: z.array(behaviorSnapshotDifferenceSchema),
+});
+
+export const buildIdentitySchema = z.object({
+  releaseId: z.string().regex(/^(workpiece-)?[a-z0-9]+(-[a-z0-9]+)*(-r\d{6}|-m\d{6})$/),
+  systemId: z.string().regex(STERNSYSTEM_ID_REGEX),
+  missionId: z.string().regex(MISSION_ID_REGEX),
+  semver: z.string(),
+  distTreeHash: z.string(),
+  behaviorSnapshotHash: z.string(),
+  siteContentHash: z.string(),
+  platformVersion: z.string(),
+  platformSemanticHash: z.string(),
+  commitSha: z.string(),
+  buildTimestamp: z.string().datetime(),
+  targetPlatform: z.string(),
+  // --- RFC-0931 signature fields (optional, added during signing phase) ---
+  signature: z.string().optional(),
+  publicKeyUrl: z.string().optional(),
+  signedAt: z.string().datetime().optional(),
+});
+
+export type ReleaseArtifactState = z.infer<typeof releaseArtifactStateSchema>;
+export type ReleaseState = z.infer<typeof releaseStateSchema>;
+export type LegacyReleaseState = z.infer<typeof legacyReleaseStateSchema>;
+export type LegacyReleaseDiagnostic = z.infer<typeof legacyReleaseDiagnosticSchema>;
+export type ReleaseManifest = z.infer<typeof releaseManifestSchema>;
+export type BuildIdentity = z.infer<typeof buildIdentitySchema>;
+export type BehaviorSnapshotDifference = z.infer<typeof behaviorSnapshotDifferenceSchema>;
+export type BehaviorSnapshotDiff = z.infer<typeof behaviorSnapshotDiffSchema>;

package/src/ontology/operations/sternsystem.ts

@@ -0,0 +1,192 @@
+/*
+<MODULE_CONTRACT>
+<purpose>
+RFC-0354: Zod schemas for the Sternsystem bundle contract — the durable site unit,
+fleet registry, and version pin. These schemas are the machine-checkable contract
+for all Sternsystem operations.
+RFC-0561: fleetRegistryEntrySchema gains optional owner field (did:web VC subject id).
+RFC-0574: replace repo/mirror with parameterized mirrors[] array.
+RFC-0752: add cloudflareZoneId to fleetRegistryEntrySchema, services[] with subdomains to fleetRegistrySchema.
+RFC-0751: extend serviceEntrySchema with deployment fields (kind, url, publicEndpoints, routes, upstreams, lastDeployed, healthCheckPath).
+RFC-0790: add systemConfigSchema, systemStateSchema, servicesRegistrySchema for convention-based discovery (replaces fleetRegistrySchema).
+</purpose>
+<non-goals>
+  <item>Do not perform file IO or git operations — pure shape only.</item>
+  <item>Do not define mission or release schemas — those live in subsequent RFCs.</item>
+</non-goals>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0966: add passportRequired to systemStateSchema for passport enforcement gating.</item>
+  <item>RFC-0967: add ownershipRequired to systemStateSchema for ownership enforcement gating.</item>
+  <item>RFC-1065: add lagebild to systemStateSchema for Lagebild connection metadata.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — werkstatt-engine clean
+
+Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
+  <history>RFC-0354, RFC-0479, RFC-0561, RFC-0574, RFC-0751, RFC-0752, RFC-0790, RFC-0806, RFC-0902, RFC-0964</history>
+</CHANGE_SUMMARY>
+*/
+
+import { z } from "zod";
+import { starNameSchema } from "@warpgogol/werkstatt-shared/ontology/cosmic";
+import { deploymentStaticConfigSchema, lastPropagatedChannelSchema } from "./leitstand.ts";
+
+const semverRe = /^\d+\.\d+\.\d+$/;
+const sha256Re = /^sha256:[0-9a-f]{64}$/;
+const kebabRe = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const didWebRe = /^did:web:[a-z0-9.-]+#.+$/;
+
+export const systemPinSchema = z.object({
+  schemaVersion: z.string().min(1),
+  systemId: z
+    .string()
+    .regex(kebabRe, "systemId must be kebab-case, lowercase, latin-only, no TLD suffix"),
+  cosmicStar: starNameSchema,
+  pinnedAt: z.string().datetime(),
+  platform: z.object({
+    version: z.string().regex(semverRe, "platform.version must be x.y.z"),
+    commit: z.string().min(7),
+    rfcHead: z.string().regex(/^RFC-\d{4}$/, "rfcHead must be RFC-NNNN"),
+    platformSemanticHash: z
+      .string()
+      .regex(sha256Re, "platformSemanticHash must be sha256: prefixed hex"),
+  }),
+  migratorCursor: z.array(z.string()),
+  capabilities: z.array(
+    z.object({
+      semanticId: z.string().min(1),
+      version: z.string().min(1),
+      intent: z.array(z.string()),
+    }),
+  ),
+});
+
+export const mirrorStorageTypeSchema = z.enum(["non-bare", "bare", "bundle"]);
+
+export type MirrorStorageType = z.infer<typeof mirrorStorageTypeSchema>;
+
+export const mirrorEntrySchema = z.object({
+  path: z.string().min(1, "mirror path must be non-empty"),
+  storageType: mirrorStorageTypeSchema,
+});
+
+export type MirrorEntry = z.infer<typeof mirrorEntrySchema>;
+
+export const serviceSubdomainSchema = z.object({
+  domain: z.string().min(1, "subdomain domain must be non-empty"),
+  zone: z.string().min(1, "subdomain zone must be non-empty"),
+});
+
+export const serviceEntrySchema = z.object({
+  id: z
+    .string()
+    .regex(kebabRe, "service id must be kebab-case, lowercase, latin-only, no TLD suffix"),
+  kind: z.enum(["proxy-worker", "scheduled-worker", "cloudflare-worker"]),
+  workerName: z.string().min(1, "workerName must be non-empty"),
+  hostedBy: z.enum(["studio"]),
+  url: z.string().min(1, "url must be non-empty"),
+  workersDevUrl: z.string().min(1, "workersDevUrl must be non-empty").optional(),
+  publicEndpoints: z.boolean().default(false),
+  routes: z.array(z.string()).optional(),
+  upstreams: z.array(z.string()).optional(),
+  subdomains: z.array(serviceSubdomainSchema).default([]),
+  lastDeployed: z
+    .object({
+      at: z.string().datetime().nullable(),
+      state: z.enum(["succeeded", "failed"]).nullable(),
+      operationId: z.string().nullable(),
+    })
+    .default({ at: null, state: null, operationId: null }),
+  lastDevDeployed: z
+    .object({
+      at: z.string().datetime().nullable(),
+      state: z.enum(["succeeded", "failed"]).nullable(),
+      operationId: z.string().nullable(),
+    })
+    .default({ at: null, state: null, operationId: null })
+    .describe("RFC-0806: last dev-channel deployment state"),
+  healthCheckPath: z.string().optional(),
+});
+
+// RFC-0790: Convention-based discovery schemas (replaces fleet registry)
+
+export const systemConfigSchema = z.object({
+  schemaVersion: z.string().min(1),
+  id: z.string().regex(kebabRe, "id must be kebab-case, lowercase, latin-only, no TLD suffix"),
+  cosmicStar: starNameSchema,
+  mirrors: z.array(mirrorEntrySchema).min(1, "mirrors must contain at least 1 entry"),
+  pinnedPlatform: z.string().regex(semverRe, "pinnedPlatform must be x.y.z"),
+  status: z.enum(["registered", "active", "paused", "archived"]),
+  registeredAt: z.string().datetime(),
+  deployment: deploymentStaticConfigSchema.optional(),
+  cloudflareZoneId: z
+    .string()
+    .min(1, "cloudflareZoneId must be non-empty")
+    .optional()
+    .describe("Cloudflare zone ID for DNS and Workers route management (RFC-0752)"),
+  owner: z
+    .string()
+    .regex(didWebRe, "owner must be a did:web identifier (did:web:<domain>#<key-version>)")
+    .optional()
+    .describe("VC subject id of the site owner (RFC-0558, RFC-0561)"),
+  notes: z.string().default(""),
+  fleet: z
+    .object({
+      canary: z.boolean().default(false),
+    })
+    .optional()
+    .describe("RFC-0964: fleet wave orchestration config"),
+});
+
+export const systemStateSchema = z.object({
+  schemaVersion: z.string().min(1),
+  systemId: z
+    .string()
+    .regex(kebabRe, "systemId must be kebab-case, lowercase, latin-only, no TLD suffix"),
+  currentMission: z.string().nullable().default(null),
+  lastRelease: z.string().nullable().default(null),
+  lastPropagated: z
+    .object({
+      dev: lastPropagatedChannelSchema.optional(),
+      alt: lastPropagatedChannelSchema.optional(),
+      main: lastPropagatedChannelSchema.optional(),
+    })
+    .default({}),
+  // RFC-0899: 4-digit PIN for dev/alt subdomain access protection. Null when not set.
+  accessPin: z
+    .string()
+    .regex(/^\d{4}$/, "accessPin must be a 4-digit numeric string")
+    .nullable()
+    .default(null),
+  // RFC-0966: Controls PASSPORT-01 warning vs blocking. false during rollout,
+  // set to true by sternsystem.passport.generate after first successful generation.
+  passportRequired: z.boolean().default(false),
+  // RFC-0967: Controls OWNERSHIP-01 warning vs blocking. false during rollout,
+  // set to true per-site when ready for blocking enforcement.
+  ownershipRequired: z.boolean().default(false),
+  // RFC-1065: Lagebild connection metadata. Undefined when not connected.
+  lagebild: z
+    .object({
+      connected: z.boolean(),
+      apiUrl: z.string(),
+      tenantId: z.string(),
+      sourceSystemId: z.string(),
+      connectedAt: z.string(),
+      channel: z.string(),
+    })
+    .optional(),
+});
+
+export const servicesRegistrySchema = z.object({
+  schemaVersion: z.string().min(1),
+  services: z.array(serviceEntrySchema),
+});
+
+export type SystemPin = z.infer<typeof systemPinSchema>;
+export type ServiceSubdomain = z.infer<typeof serviceSubdomainSchema>;
+export type ServiceEntry = z.infer<typeof serviceEntrySchema>;
+export type SystemConfig = z.infer<typeof systemConfigSchema>;
+export type SystemState = z.infer<typeof systemStateSchema>;
+export type ServicesRegistry = z.infer<typeof servicesRegistrySchema>;