cohorte 2.10.1 → 3.0.0-dev.0

package/assets/schemas/manifest.schema.json

@@ -0,0 +1,79 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://cohorte.dev/schemas/3/manifest.schema.json",
+  "title": "Cohorte installation manifest (.cohorte/manifest.yaml)",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "cohorteVersion",
+    "createdWith",
+    "protocol",
+    "stateSchemaVersion",
+    "generated"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "type": "number",
+      "const": 1
+    },
+    "cohorteVersion": {
+      "type": "string",
+      "minLength": 1
+    },
+    "createdWith": {
+      "type": "string",
+      "minLength": 1
+    },
+    "protocol": {
+      "type": "object",
+      "required": [
+        "min",
+        "max"
+      ],
+      "properties": {
+        "min": {
+          "type": "string",
+          "minLength": 1
+        },
+        "max": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "stateSchemaVersion": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "generated": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "path",
+          "templateId",
+          "templateSha256",
+          "renderedSha256"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "templateId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "templateSha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          },
+          "renderedSha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$"
+          }
+        }
+      }
+    }
+  }
+}

package/assets/schemas/ownership.schema.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://cohorte.dev/schemas/3/ownership.schema.json",
+  "title": "Cohorte surface ownership map (.cohorte/ownership.yaml)",
+  "type": "object",
+  "required": [
+    "surfaces"
+  ],
+  "properties": {
+    "surfaces": {
+      "type": "object",
+      "patternProperties": {
+        "^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$": {
+          "type": "object",
+          "required": [
+            "paths",
+            "owners",
+            "reviewers"
+          ],
+          "properties": {
+            "paths": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "minItems": 1
+            },
+            "owners": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "reviewers": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "approval": {
+              "type": "string",
+              "const": "human"
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/assets/schemas/policy-verdict.schema.json

@@ -0,0 +1,282 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://cohorte.dev/schemas/3/policy-verdict.schema.json",
+  "title": "Cohorte policy verdict (policy explain)",
+  "type": "object",
+  "required": [
+    "decision",
+    "stage",
+    "ruleId",
+    "reason",
+    "modelFacingReason",
+    "overridable",
+    "securityViolation",
+    "asks",
+    "evaluatedRules",
+    "normalized"
+  ],
+  "properties": {
+    "decision": {
+      "type": "string",
+      "enum": [
+        "allow",
+        "deny",
+        "ask",
+        "allow-once",
+        "allow-for-run"
+      ]
+    },
+    "stage": {
+      "type": "string",
+      "enum": [
+        "liveness",
+        "schema",
+        "capability",
+        "path",
+        "command",
+        "network",
+        "budget",
+        "approval"
+      ]
+    },
+    "ruleId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "reason": {
+      "type": "string"
+    },
+    "modelFacingReason": {
+      "type": "string"
+    },
+    "overridable": {
+      "type": "boolean"
+    },
+    "securityViolation": {
+      "type": "boolean"
+    },
+    "asks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "stage",
+          "ruleId",
+          "reason"
+        ],
+        "properties": {
+          "stage": {
+            "type": "string",
+            "enum": [
+              "liveness",
+              "schema",
+              "capability",
+              "path",
+              "command",
+              "network",
+              "budget",
+              "approval"
+            ]
+          },
+          "ruleId": {
+            "type": "string"
+          },
+          "reason": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "evaluatedRules": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "normalized": {
+      "anyOf": [
+        {
+          "type": "object",
+          "required": [
+            "tool",
+            "paths",
+            "input",
+            "grantKeyMaterial"
+          ],
+          "properties": {
+            "tool": {
+              "type": "string"
+            },
+            "paths": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": [
+                  "arg",
+                  "resolved",
+                  "intent"
+                ],
+                "properties": {
+                  "arg": {
+                    "type": "string"
+                  },
+                  "resolved": {
+                    "type": "object",
+                    "required": [
+                      "canonical",
+                      "relative",
+                      "root",
+                      "exists",
+                      "viaSymlink"
+                    ],
+                    "properties": {
+                      "canonical": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "relative": {
+                        "type": "string"
+                      },
+                      "root": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "exists": {
+                        "type": "boolean"
+                      },
+                      "identity": {
+                        "type": "object",
+                        "required": [
+                          "dev",
+                          "ino",
+                          "nlink"
+                        ],
+                        "properties": {
+                          "dev": {
+                            "type": "number"
+                          },
+                          "ino": {
+                            "type": "number"
+                          },
+                          "nlink": {
+                            "type": "number"
+                          }
+                        }
+                      },
+                      "viaSymlink": {
+                        "type": "boolean"
+                      }
+                    }
+                  },
+                  "intent": {
+                    "type": "string",
+                    "enum": [
+                      "read",
+                      "write",
+                      "create",
+                      "list",
+                      "exec-cwd"
+                    ]
+                  }
+                }
+              }
+            },
+            "command": {
+              "type": "object",
+              "required": [
+                "file",
+                "args",
+                "cwd",
+                "ruleId",
+                "replay",
+                "network",
+                "timeoutMs"
+              ],
+              "properties": {
+                "file": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "args": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "cwd": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "ruleId": {
+                  "type": "string"
+                },
+                "replay": {
+                  "type": "string",
+                  "enum": [
+                    "idempotent",
+                    "at-most-once"
+                  ]
+                },
+                "network": {
+                  "type": "boolean"
+                },
+                "timeoutMs": {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              }
+            },
+            "input": {
+              "$ref": "#/$defs/JsonValue"
+            },
+            "grantKeyMaterial": {
+              "$ref": "#/$defs/JsonValue"
+            }
+          }
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "approvalId": {
+      "type": "string",
+      "pattern": "^apr_[0-9a-f]{32}$"
+    },
+    "grantId": {
+      "type": "string"
+    }
+  },
+  "$defs": {
+    "JsonValue": {
+      "anyOf": [
+        {
+          "type": "null"
+        },
+        {
+          "type": "boolean"
+        },
+        {
+          "type": "number"
+        },
+        {
+          "type": "string"
+        },
+        {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/JsonValue"
+          }
+        },
+        {
+          "type": "object",
+          "patternProperties": {
+            "^.*$": {
+              "$ref": "#/$defs/JsonValue"
+            }
+          }
+        }
+      ]
+    }
+  }
+}