tracegrove 0.0.0-stage → 0.3.1

package/samples/django-notes/notesite/settings.py

@@ -0,0 +1,17 @@
+"""Tracegrove sample: minimal Django notes API. The database lives in the per-run data dir."""
+import os
+
+SECRET_KEY = "tracegrove-sample-not-secret"
+DEBUG = True
+ALLOWED_HOSTS = ["127.0.0.1", "localhost"]
+INSTALLED_APPS = ["notes"]
+MIDDLEWARE = ["notes.auth.tracegrove_auth"]
+ROOT_URLCONF = "notesite.urls"
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": os.path.join(os.environ.get("TRACEGROVE_DATA_DIR", "."), "db.sqlite3"),
+    }
+}
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+USE_TZ = True

package/samples/django-notes/notesite/urls.py

@@ -0,0 +1,9 @@
+from django.urls import path
+
+from notes import views
+
+urlpatterns = [
+    path("health", views.health),
+    path("notes", views.notes),
+    path("notes/<uuid:note_id>", views.note),
+]

package/samples/django-notes/requirements.txt

@@ -0,0 +1 @@
+django==6.1.2

package/samples/django-notes/tracegrove/notes/crud.flow.yaml

@@ -0,0 +1,27 @@
+title: Create, read, deny a stranger and delete a note
+tags: [notes]
+steps:
+  - name: create
+    POST: /notes
+    json: { title: Fresh note, body: from Django }
+    expect: 201
+    save: { noteId: note.id }
+
+  - name: read back
+    GET: /notes/{noteId}
+    observe: true
+    expect: { status: 200, json: { note.title: Fresh note } }
+
+  - name: intruder is denied
+    GET: /notes/{noteId}
+    as: intruder
+    expect: { status: 403, absent: [note] }
+
+  - name: delete
+    DELETE: /notes/{noteId}
+    expect: 204
+
+  - name: gone
+    GET: /notes/{noteId}
+    observe: true
+    expect: 404

package/samples/django-notes/tracegrove.config.yaml

@@ -0,0 +1,7 @@
+project: django-notes
+app:
+  adapter: django
+  sources: ["**/*.py"]
+personas:
+  owner: { subject: alice }
+  intruder: { subject: bob }

package/samples/fastapi-notes/app/main.py

@@ -0,0 +1,69 @@
+"""Tracegrove sample: a FastAPI notes API backed by SQLite in the per-run data dir."""
+import json
+import os
+import sqlite3
+import uuid
+
+from fastapi import Depends, FastAPI, Header, HTTPException, Response
+from pydantic import BaseModel
+
+DB = os.path.join(os.environ.get("TRACEGROVE_DATA_DIR", "."), "notes.sqlite3")
+# Test-mode auth: tracegrove issues one random bearer token per persona per run.
+TRACEGROVE_TOKENS = json.loads(os.environ.get("TRACEGROVE_TOKENS", "{}"))
+
+app = FastAPI()
+
+
+def db() -> sqlite3.Connection:
+    conn = sqlite3.connect(DB)
+    conn.row_factory = sqlite3.Row
+    conn.execute("create table if not exists notes (id text primary key, owner text, title text, body text)")
+    return conn
+
+
+def current_user(authorization: str = Header("")) -> str:
+    subject = TRACEGROVE_TOKENS.get(authorization.removeprefix("Bearer "))
+    if not subject:
+        raise HTTPException(status_code=401, detail="unauthorized")
+    return subject
+
+
+class NoteIn(BaseModel):
+    title: str
+    body: str
+
+
+@app.get("/health")
+def health():
+    return {"ok": True}
+
+
+@app.post("/notes", status_code=201)
+def create(note: NoteIn, user: str = Depends(current_user)):
+    row = {"id": str(uuid.uuid4()), "owner": user, "title": note.title, "body": note.body}
+    with db() as conn:
+        conn.execute("insert into notes values (:id, :owner, :title, :body)", row)
+    return {"note": row}
+
+
+def owned(note_id: str, user: str) -> dict:
+    with db() as conn:
+        row = conn.execute("select * from notes where id = ?", (note_id,)).fetchone()
+    if row is None:
+        raise HTTPException(status_code=404, detail="not_found")
+    if row["owner"] != user:
+        raise HTTPException(status_code=403, detail="forbidden")
+    return dict(row)
+
+
+@app.get("/notes/{note_id}")
+def read(note_id: str, user: str = Depends(current_user)):
+    return {"note": owned(note_id, user)}
+
+
+@app.delete("/notes/{note_id}", status_code=204)
+def delete(note_id: str, user: str = Depends(current_user)):
+    owned(note_id, user)
+    with db() as conn:
+        conn.execute("delete from notes where id = ?", (note_id,))
+    return Response(status_code=204)

package/samples/fastapi-notes/requirements.txt

@@ -0,0 +1,2 @@
+fastapi==0.143.3
+uvicorn==0.54.0

package/samples/fastapi-notes/tracegrove/notes/crud.flow.yaml

@@ -0,0 +1,27 @@
+title: Create, read, deny a stranger and delete a note
+tags: [notes]
+steps:
+  - name: create
+    POST: /notes
+    json: { title: Fresh note, body: from FastAPI }
+    expect: 201
+    save: { noteId: note.id }
+
+  - name: read back
+    GET: /notes/{noteId}
+    observe: true
+    expect: { status: 200, json: { note.title: Fresh note } }
+
+  - name: intruder is denied
+    GET: /notes/{noteId}
+    as: intruder
+    expect: { status: 403, absent: [note] }
+
+  - name: delete
+    DELETE: /notes/{noteId}
+    expect: 204
+
+  - name: gone
+    GET: /notes/{noteId}
+    observe: true
+    expect: 404

package/samples/fastapi-notes/tracegrove.config.yaml

@@ -0,0 +1,8 @@
+project: fastapi-notes
+app:
+  adapter: fastapi
+  entry: app.main:app
+  sources: [app/**/*.py]
+personas:
+  owner: { subject: alice }
+  intruder: { subject: bob }

package/samples/notes-api/app/app.mjs

@@ -0,0 +1,67 @@
+// Tracegrove sample: a real file-backed notes API. No dependencies. Not a mock.
+// Env: PORT, NOTES_DIR, NOTES_TOKENS (JSON object token -> userId), NOTES_BUILD (display only).
+import { createServer } from 'node:http';
+import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, readdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { send, readBody } from './http.mjs';
+
+const port = Number(process.env.PORT ?? 0);
+const dir = process.env.NOTES_DIR ?? './notes-data';
+const tokens = JSON.parse(process.env.NOTES_TOKENS ?? '{}');
+const build = process.env.NOTES_BUILD ?? 'dev';
+mkdirSync(dir, { recursive: true });
+
+function notePath(id) { if (!/^[0-9a-f-]{36}$/.test(id)) return null; return join(dir, `${id}.json`); }
+function readNote(id) { const p = notePath(id); if (!p || !existsSync(p)) return null; return JSON.parse(readFileSync(p, 'utf8')); }
+function writeNote(note) { const p = notePath(note.id); const tmp = `${p}.tmp`; writeFileSync(tmp, JSON.stringify(note)); renameSync(tmp, p); }
+
+const server = createServer(async (req, res) => {
+  const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+  if (req.method === 'GET' && url.pathname === '/health') {
+    const count = readdirSync(dir).filter((f) => f.endsWith('.json')).length;
+    return send(res, 200, { ok: true, build, notes: count });
+  }
+  const auth = req.headers.authorization ?? '';
+  const token = auth.startsWith('Bearer ') ? auth.slice(7) : null;
+  const userId = token ? tokens[token] : undefined;
+  if (!userId) return send(res, 401, { error: 'unauthorized' });
+  if (req.method === 'GET' && url.pathname === '/ui') {
+    res.writeHead(200, { 'content-type': 'text/html' });
+    res.end(`<!doctype html><html lang="en"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Notes</title>
+      <main><h1>Notes</h1><button onclick="fetch('/notes').then(r=>r.json()).then(data=>document.querySelector('[role=status]').textContent=data.notes.map(n=>n.title).join(', '))">Refresh</button>
+      <p role="status" data-testid="notes">Not loaded</p></main></html>`);
+    return;
+  }
+  const match = url.pathname.match(/^\/notes(?:\/([^/]+))?$/);
+  if (!match) return send(res, 404, { error: 'not_found' });
+  const id = match[1];
+  try {
+    if (req.method === 'POST' && !id) {
+      const body = await readBody(req);
+      if (typeof body.title !== 'string' || typeof body.body !== 'string') return send(res, 400, { error: 'invalid_note' });
+      const note = { id: randomUUID(), title: body.title, body: body.body, ownerId: userId, createdAt: new Date().toISOString() };
+      writeNote(note);
+      return send(res, 201, { note });
+    }
+    if (req.method === 'GET' && !id) {
+      const notes = readdirSync(dir).filter((f) => f.endsWith('.json')).map((f) => JSON.parse(readFileSync(join(dir, f), 'utf8'))).filter((n) => n.ownerId === userId);
+      return send(res, 200, { notes });
+    }
+    if (id) {
+      const note = readNote(id);
+      if (!note) return send(res, 404, { error: 'not_found' });
+      if (note.ownerId !== userId) return send(res, 403, { error: 'forbidden' });
+      if (req.method === 'GET') return send(res, 200, { note });
+      if (req.method === 'DELETE') { unlinkSync(notePath(id)); return send(res, 204); }
+    }
+    return send(res, 405, { error: 'method_not_allowed' });
+  } catch (error) {
+    return send(res, 400, { error: 'bad_request', detail: String(error && error.message) });
+  }
+});
+server.listen(port, '127.0.0.1', () => {
+  const address = server.address();
+  process.stdout.write(`listening ${typeof address === 'object' && address ? address.port : port}\n`);
+});
+process.on('SIGTERM', () => server.close(() => process.exit(0)));

package/samples/notes-api/app/http.mjs

@@ -0,0 +1,16 @@
+import { randomUUID } from 'node:crypto';
+
+export function send(res, status, body) {
+  const text = body === undefined ? '' : JSON.stringify(body);
+  res.writeHead(status, { 'content-type': 'application/json', 'x-request-id': randomUUID(), 'content-length': Buffer.byteLength(text) });
+  res.end(text);
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = ''; req.setEncoding('utf8');
+    req.on('data', chunk => { data += chunk; if (data.length > 65536) { reject(new Error('too large')); req.destroy(); } });
+    req.on('end', () => { try { resolve(data ? JSON.parse(data) : {}); } catch (error) { reject(error); } });
+    req.on('error', reject);
+  });
+}

package/samples/notes-api/tracegrove/fixtures/existing-note.fixture.yaml

@@ -0,0 +1,12 @@
+create:
+  POST: /notes
+  json: { title: Existing note, body: { words: 6 } }
+  expect: 201
+save: { noteId: note.id }
+readback:
+  GET: /notes/{noteId}
+  expect: { status: 200, json: { note.title: Existing note } }
+cleanup:
+  DELETE: /notes/{noteId}
+  expect: 204
+  gone: { GET: "/notes/{noteId}", status: 404 }

package/samples/notes-api/tracegrove/notes/create-read-delete.flow.yaml

@@ -0,0 +1,35 @@
+title: Create a note, read it back, deny a stranger, delete it and keep other notes intact
+risk: critical
+tags: [notes, authz]
+given:
+  existing: existing-note
+steps:
+  - name: create
+    POST: /notes
+    json: { title: Fresh note, body: Written through the real API. }
+    expect: { status: 201 }
+    save: { noteId: note.id }
+
+  - name: read back
+    GET: /notes/{noteId}
+    observe: true
+    expect: { status: 200, json: { note.title: Fresh note, note.body: Written through the real API. } }
+
+  - name: intruder is denied
+    GET: /notes/{noteId}
+    as: intruder
+    expect: { status: 403, absent: [note] }
+
+  - name: delete
+    DELETE: /notes/{noteId}
+    expect: 204
+
+  - name: gone
+    GET: /notes/{noteId}
+    observe: true
+    expect: 404
+
+  - name: existing note untouched
+    GET: /notes/{existing.noteId}
+    observe: true
+    expect: { status: 200, json: { note.title: Existing note } }

package/samples/notes-api/tracegrove/notes/list.flow.yaml

@@ -0,0 +1,25 @@
+title: A new note shows up in the owner's list and nowhere else
+tags: [notes, smoke]
+steps:
+  - name: create
+    POST: /notes
+    json: { title: Listed note, body: visible to its owner }
+    expect: 201
+    save: { noteId: note.id }
+
+  - name: owner sees it
+    GET: /notes
+    expect:
+      status: 200
+      count: { notes: 1 }
+      json: { "notes[0].title": Listed note }
+
+  - name: stranger sees an empty list
+    GET: /notes
+    as: intruder
+    expect: { status: 200, count: { notes: 0 } }
+
+  - name: anonymous is rejected
+    GET: /notes
+    as: none
+    expect: 401

package/samples/notes-api/tracegrove.config.yaml

@@ -0,0 +1,15 @@
+project: notes
+app:
+  adapter: node
+  entry: app/app.mjs
+  health: /health
+  sources: [app/**]
+  env:
+    NOTES_BUILD: sample
+  inject:
+    port: PORT
+    dataDir: NOTES_DIR
+    tokens: NOTES_TOKENS
+personas:
+  owner: { subject: alice }
+  intruder: { subject: bob }

package/samples/notes-api/verification/actions/notes.registry.yaml

@@ -0,0 +1,6 @@
+schemaVersion: workflow.action-registry/v1
+ref: { id: example.actions.notes, revision: "1" }
+actions:
+  - { actionId: notes.create/v1, kind: http.request, effect: create, method: POST, path: /notes, body: { title: "{title}", body: "{body}" }, auth: { kind: persona }, expectStatus: 201, captures: [ { name: noteId, from: json, path: note.id } ] }
+  - { actionId: notes.read/v1, kind: http.request, effect: read, method: GET, path: "/notes/{noteId}", body: null, auth: { kind: persona }, expectStatus: null, captures: [] }
+  - { actionId: notes.delete/v1, kind: http.request, effect: delete, method: DELETE, path: "/notes/{noteId}", body: null, auth: { kind: persona }, expectStatus: 204, captures: [] }

package/samples/notes-api/verification/auth/host-issued-owner.yaml

@@ -0,0 +1,6 @@
+schemaVersion: workflow.auth-recipe/v1
+ref: { id: example.auth.owner, revision: "1" }
+kind: host_issued
+credentialName: owner_token
+header: authorization
+scheme: Bearer

package/samples/notes-api/verification/cases/notes.contract.yaml

@@ -0,0 +1,51 @@
+schemaVersion: workflow.case/v1
+ref: { id: example.notes.contract, revision: "1" }
+purpose: Exercise the declared notes contract against a loopback stub. Teaches the schema; proves nothing about the real application.
+workflowId: notes.create
+requirementRefs: []
+sourceRefs: []
+sourceAnalysisRef: null
+risk: exploratory
+surface: api
+surfaceBindingRef: { $file: ../surfaces/http-api.binding.yaml }
+proofClaim: The case contract and reducer behave as declared under a stubbed application boundary. No live product claim.
+environmentClasses: [isolated_candidate]
+requiredCapabilities: [http.request, observe]
+requiredBoundaries:
+  - { boundaryId: application, mode: stubbed }
+dependencyCases: []
+personaRef: { $file: ../personas/owner.yaml }
+datasetRef: null
+fixturePlanRef: null
+navigationRef: null
+preconditions: []
+steps:
+  - id: create
+    kind: http.request
+    timeoutMs: 5000
+    inputs: { title: { kind: literal, value: Stub note } }
+    retry: { attempts: 1 }
+    method: POST
+    path: /notes
+    headers: {}
+    body: { title: "{title}", body: stub }
+    auth: { kind: persona }
+    expectStatus: 201
+    captures: [ { name: noteId, from: json, path: note.id } ]
+  - id: read_back
+    kind: observe
+    timeoutMs: 5000
+    inputs: { noteId: { kind: capture, stepId: create, name: noteId } }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate: { kind: status_equals, value: 200 }
+    pollIntervalMs: 100
+    captures: []
+assertions:
+  - { id: a.created, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: create, predicate: { kind: step_result, value: completed }, coverageTags: [notes.contract] }
+  - { id: a.readback, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: read_back, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_present, path: body.note.id } ] }, coverageTags: [notes.contract] }
+effects: { mode: designated_writes, allowedHosts: ["launch://notes-api"], allowedMethods: [GET, POST], allowedResourcePrefixes: ["/notes"], maxCreates: 1, maxMessages: 0, maxJobs: 0, cleanupRecipeRef: null }
+limits: { deadlineMs: 20000, maxProviderRequests: 0, maxTokens: 0, costCeilingCents: 0, maxBrowserActions: 0, maxArtifactBytes: 1048576, diagnosticRetries: 0, concurrencyGroup: notes }
+capture: { stepEvents: true, networkMetadata: true, trace: optional, video: optional, redactionPolicyRef: null, retentionPolicyRef: null }
+baselineRef: null
+generation: null

package/samples/notes-api/verification/cases/notes.create.yaml

@@ -0,0 +1,123 @@
+schemaVersion: workflow.case/v1
+ref: { id: example.notes.create, revision: "1" }
+purpose: Create a note through the real API, read it back independently, confirm a foreign principal is denied, delete only that note and confirm absence while a seeded note stays intact.
+workflowId: notes.create
+requirementRefs: []
+sourceRefs: []
+sourceAnalysisRef: null
+risk: critical
+surface: api
+surfaceBindingRef: { $file: ../surfaces/http-api.binding.yaml }
+proofClaim: The locally launched notes application, at the attested source digest, persists and authorizes notes through its normal HTTP API. This establishes local application behavior, not production deployment identity.
+environmentClasses: [isolated_candidate]
+requiredCapabilities: [http.request, observe, fixture.http]
+requiredBoundaries:
+  - { boundaryId: application, mode: real }
+  - { boundaryId: storage, mode: real }
+dependencyCases: []
+personaRef: { $file: ../personas/owner.yaml }
+datasetRef: null
+fixturePlanRef: { $file: ../fixtures/existing-note.plan.yaml }
+navigationRef: null
+preconditions: []
+steps:
+  - id: create
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      title: { kind: literal, value: Fresh note }
+      body: { kind: literal, value: Written through the real API. }
+    retry: { attempts: 1 }
+    method: POST
+    path: /notes
+    headers: {}
+    body: { title: "{title}", body: "{body}" }
+    auth: { kind: persona }
+    expectStatus: 201
+    captures:
+      - { name: noteId, from: json, path: note.id }
+  - id: read_back
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate:
+      kind: all
+      predicates:
+        - { kind: status_equals, value: 200 }
+        - { kind: json_path_equals, path: body.note.title, value: Fresh note }
+    pollIntervalMs: 100
+    captures: []
+  - id: intruder_read
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+      intruder: { kind: credential, name: intruder_token }
+    retry: { attempts: 1 }
+    method: GET
+    path: "/notes/{noteId}"
+    headers: {}
+    body: null
+    auth: { kind: credential, name: intruder_token }
+    expectStatus: null
+    captures: []
+  - id: delete
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    method: DELETE
+    path: "/notes/{noteId}"
+    headers: {}
+    body: null
+    auth: { kind: persona }
+    expectStatus: 204
+    captures: []
+  - id: confirm_absent
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate: { kind: status_equals, value: 404 }
+    pollIntervalMs: 100
+    captures: []
+  - id: existing_intact
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      existingId: { kind: fixture, entityKey: existing_note, outputName: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{existingId}", auth: { kind: persona } }
+    predicate:
+      kind: all
+      predicates:
+        - { kind: status_equals, value: 200 }
+        - { kind: json_path_equals, path: body.note.title, value: Existing note }
+    pollIntervalMs: 100
+    captures: []
+assertions:
+  - { id: a.created, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: create, predicate: { kind: step_result, value: completed }, coverageTags: [notes.create] }
+  - { id: a.readback, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: read_back, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_equals, path: body.note.title, value: Fresh note }, { kind: json_path_equals, path: body.note.body, value: Written through the real API. } ] }, coverageTags: [notes.read] }
+  - { id: a.denied, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: intruder_read, predicate: { kind: all, predicates: [ { kind: status_equals, value: 403 }, { kind: json_path_absent, path: body.note } ] }, coverageTags: [notes.authz] }
+  - { id: a.deleted, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: delete, predicate: { kind: step_result, value: completed }, coverageTags: [notes.delete] }
+  - { id: a.absent, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: confirm_absent, predicate: { kind: status_equals, value: 404 }, coverageTags: [notes.delete] }
+  - { id: a.existing_intact, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: existing_intact, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_equals, path: body.note.title, value: Existing note } ] }, coverageTags: [notes.isolation] }
+effects:
+  mode: designated_writes
+  allowedHosts: ["launch://notes-api"]
+  allowedMethods: [GET, POST, DELETE]
+  allowedResourcePrefixes: ["/notes"]
+  maxCreates: 2
+  maxMessages: 0
+  maxJobs: 0
+  cleanupRecipeRef: null
+limits: { deadlineMs: 30000, maxProviderRequests: 0, maxTokens: 0, costCeilingCents: 0, maxBrowserActions: 0, maxArtifactBytes: 1048576, diagnosticRetries: 0, concurrencyGroup: notes }
+capture: { stepEvents: true, networkMetadata: true, trace: optional, video: optional, redactionPolicyRef: null, retentionPolicyRef: null }
+baselineRef: null
+generation: null

package/samples/notes-api/verification/cases/notes.suite.yaml

@@ -0,0 +1,5 @@
+schemaVersion: workflow.suite/v1
+id: notes.suite
+cases:
+  - { caseRef: ./notes.create.yaml, required: true, profiles: [native-real] }
+  - { caseRef: ./notes.contract.yaml, required: true, profiles: [offline-contract] }

package/samples/notes-api/verification/components/notes-api-stub.profile.yaml

@@ -0,0 +1,8 @@
+schemaVersion: workflow.component-profile/v1
+ref: { id: example.components.notes-api-stub, revision: "1" }
+components:
+  - componentId: notes-api
+    kind: application
+    required: true
+    expectedIdentity: { kind: declared_release, release: stub }
+    exclusionReason: null

package/samples/notes-api/verification/components/notes-api.profile.yaml

@@ -0,0 +1,15 @@
+schemaVersion: workflow.component-profile/v1
+ref:
+  id: example.components.notes-api
+  revision: "1"
+components:
+  - componentId: notes-api
+    kind: application
+    required: true
+    expectedIdentity:
+      kind: source_digest
+      sourceDigest:
+        algorithm: sha256
+        hex: e5218f7d91fbd86adac23fad45a169bc5827bc7a1aa673447aab0221e6918d03
+      runtime: node22
+    exclusionReason: null

package/samples/notes-api/verification/environments/local-notes.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.environment-plan/v1
+ref: { id: example.env.local-notes, revision: "1" }
+class: isolated_candidate
+origins: ["launch://notes-api"]
+componentProfileRef: { $file: ../components/notes-api.profile.yaml }
+credentialRecipeRef: { $file: ../auth/host-issued-owner.yaml }
+actionEnvelopeRef: null
+personaLeasePolicyRef: null
+budgetPolicyRef: null
+networkProfileRef: null
+clockProfileRef: null

package/samples/notes-api/verification/environments/mock-notes.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.environment-plan/v1
+ref: { id: example.env.mock-notes, revision: "1" }
+class: isolated_candidate
+origins: ["launch://notes-api"]
+componentProfileRef: { $file: ../components/notes-api-stub.profile.yaml }
+credentialRecipeRef: { $file: ../auth/host-issued-owner.yaml }
+actionEnvelopeRef: null
+personaLeasePolicyRef: null
+budgetPolicyRef: null
+networkProfileRef: null
+clockProfileRef: null

package/samples/notes-api/verification/fidelity/full-live-sandbox.yaml

@@ -0,0 +1,7 @@
+schemaVersion: workflow.fidelity-profile/v1
+ref: { id: example.fidelity.full-live-sandbox, revision: "1" }
+lane: full_live_sandbox
+boundaryProfileRef: null
+boundaryRules:
+  - { boundaryId: application, adapterRef: null, mode: real, required: true, exclusionReasonRef: null, accountClass: local, readbackOracleRef: null, interceptorRef: null }
+  - { boundaryId: storage, adapterRef: null, mode: real, required: true, exclusionReasonRef: null, accountClass: local, readbackOracleRef: null, interceptorRef: null }

package/samples/notes-api/verification/fidelity/mock-contract.yaml

@@ -0,0 +1,6 @@
+schemaVersion: workflow.fidelity-profile/v1
+ref: { id: example.fidelity.mock-contract, revision: "1" }
+lane: mock_contract
+boundaryProfileRef: null
+boundaryRules:
+  - { boundaryId: application, adapterRef: null, mode: stubbed, required: true, exclusionReasonRef: null, accountClass: none, readbackOracleRef: null, interceptorRef: null }

package/samples/notes-api/verification/fixtures/existing-note.payload.yaml

@@ -0,0 +1,15 @@
+schemaVersion: workflow.logical-payload/v1
+ref:
+  id: example.recipe.existing-note.payload
+  revision: "1"
+seedRecipeRef:
+  id: example.recipe.existing-note
+  revision: "1"
+  digest:
+    algorithm: sha256
+    hex: 1e858b98f27166343a5d7a7140840f1bab76df97b8cda1a439b13c40c71b1a9f
+entities:
+  - entityKey: existing_note
+    values:
+      title: Existing note
+      body: zephyr pebble nectar velvet quartz thistle

package/samples/notes-api/verification/fixtures/existing-note.plan.yaml

@@ -0,0 +1,9 @@
+schemaVersion: workflow.fixture-plan/v1
+kind: case
+ref: { id: example.fixture-plan.existing-note, revision: "1" }
+seedRecipeRef: { $file: ./existing-note.recipe.yaml }
+modelCatalogRef: null
+logicalPayloadRef: { $file: ./existing-note.payload.yaml }
+outputBindingsSchemaRef: null
+effectEnvelopeRef: null
+limitPolicyRef: null