platformforge 0.1.0__py3-none-any.whl

platformforge/data/lab/fleets/acme/fleet.yaml

@@ -0,0 +1,51 @@
+schema: platformforge/fleet/v1
+fleet_id: acme
+organization: acme-corp
+environments: [prod, staging, dev]
+members:
+  clusters:
+    - {kind: cluster, canonical_id: prod-1, name: prod-1, environment: prod, region: us-east-1}
+    - {kind: cluster, canonical_id: prod-2, name: prod-2, environment: prod, region: eu-west-1}
+    - {kind: cluster, canonical_id: staging-1, name: staging-1, environment: staging}
+    - {kind: cluster, canonical_id: dev-1, name: dev-1, environment: dev}
+    - {kind: cluster, canonical_id: gpu-1, name: gpu-1, environment: prod, region: us-east-1}
+    - {kind: cluster, canonical_id: legacy-1, name: legacy-1, environment: prod}
+  cloud_accounts:
+    - {kind: cloud_account, canonical_id: aws-111111111111, name: prod-acct, environment: prod}
+    - {kind: cloud_account, canonical_id: aws-222222222222, name: staging-acct, environment: staging}
+    - {kind: cloud_account, canonical_id: aws-333333333333, name: data-acct, environment: prod}
+  repositories:
+    - {kind: repository, canonical_id: checkout-svc, name: checkout-svc}
+    - {kind: repository, canonical_id: payments-svc, name: payments-svc}
+    - {kind: repository, canonical_id: ml-inference, name: ml-inference}
+  services:
+    - {kind: service, canonical_id: checkout, name: checkout, environment: prod, team: payments}
+    - {kind: service, canonical_id: payments, name: payments, environment: prod, team: payments}
+    - {kind: service, canonical_id: search, name: search, environment: prod, team: discovery}
+    - {kind: service, canonical_id: ml-inference, name: ml-inference, environment: prod, team: ai-platform}
+    - {kind: service, canonical_id: batch-etl, name: batch-etl, environment: prod, team: data}
+  teams:
+    - {kind: team, canonical_id: payments, name: Payments}
+    - {kind: team, canonical_id: discovery, name: Discovery}
+    - {kind: team, canonical_id: ai-platform, name: AI Platform}
+    - {kind: team, canonical_id: data, name: Data}
+labels: {cost_center: cc-100}
+ownership: {}
+policies: [require-owner, prod-dual-approval]
+observations:
+  - {member_id: "cluster:prod-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:prod-2", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:staging-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:dev-1", status: observed, coverage: 0.9, freshness: fresh}
+  - {member_id: "cluster:gpu-1", status: observed, coverage: 1.0, freshness: fresh}
+  - {member_id: "cluster:legacy-1", status: permission-limited, coverage: 0.3, freshness: stale}
+federation:
+  node_id: pf-node-a
+  capabilities: [fleet, analytics]
+  exports:
+    - classification: internal
+      payload: {services: [checkout, payments, search], findings: 12}
+    - classification: public
+      payload: {api_key: "AKIAIOSFODNN7EXAMPLE"}
+    - classification: restricted
+      payload: {incident_details: "pii-ish"}

platformforge/data/lab/fleets/acme/graph.yaml

@@ -0,0 +1,45 @@
+nodes:
+  - {kind: team, id: "team:payments"}
+  - {kind: team, id: "team:discovery"}
+  - {kind: team, id: "team:ai-platform"}
+  - {kind: team, id: "team:data"}
+  - {kind: service, id: "service:checkout", attrs: {environment: prod, exposure: public, criticality: critical, slo: p99<500ms}, fact_ids: [f-ck-1]}
+  - {kind: service, id: "service:payments", attrs: {environment: prod, criticality: critical}, fact_ids: [f-pay-1]}
+  - {kind: service, id: "service:search", attrs: {environment: prod, exposure: public}, fact_ids: [f-srch-1]}
+  - {kind: service, id: "service:ml-inference", attrs: {environment: prod, criticality: high}, fact_ids: [f-ml-1]}
+  - {kind: service, id: "service:batch-etl", attrs: {environment: prod}}
+  - {kind: service, id: "service:orphan-api", attrs: {environment: dev, exposure: public}, fact_ids: [f-orph-1]}
+  - {kind: workload, id: "workload:checkout-web", attrs: {environment: prod}}
+  - {kind: workload, id: "workload:legacy-batch", attrs: {environment: prod, k8s_version: "1.24", supported: false}, fact_ids: [f-legacy-1]}
+  - {kind: cluster, id: "cluster:prod-1", attrs: {environment: prod}}
+  - {kind: cluster, id: "cluster:prod-2", attrs: {environment: prod}}
+  - {kind: cluster, id: "cluster:gpu-1", attrs: {environment: prod}}
+  - {kind: cluster, id: "cluster:staging-1", attrs: {environment: staging}}
+  - {kind: cluster, id: "cluster:legacy-1", attrs: {environment: prod}}
+  - {kind: database, id: "database:orders-pg", attrs: {environment: prod}, fact_ids: [f-db-1]}
+  - {kind: role, id: "role:wildcard-admin", attrs: {wildcard: true}, fact_ids: [f-iam-1]}
+  - {kind: golden_path, id: "web-svc"}
+  - {kind: golden_path, id: "batch-job"}
+  - {kind: cloud_account, id: "cloud_account:aws-111111111111"}
+  - {kind: environment, id: "environment:prod"}
+  - {kind: environment, id: "environment:staging"}
+  - {kind: slo, id: "slo:checkout"}
+edges:
+  - {src_id: "team/team-payments", dst_id: "service/service-checkout", kind: owns}
+  - {src_id: "team/team-payments", dst_id: "service/service-payments", kind: owns}
+  - {src_id: "team/team-discovery", dst_id: "service/service-search", kind: owns}
+  - {src_id: "service/service-checkout", dst_id: "golden_path/web-svc", kind: uses_golden_path}
+  - {src_id: "service/service-payments", dst_id: "golden_path/web-svc", kind: uses_golden_path}
+  - {src_id: "service/service-checkout", dst_id: "cluster/cluster-prod-1", kind: runs_on}
+  - {src_id: "service/service-payments", dst_id: "cluster/cluster-prod-1", kind: runs_on}
+  - {src_id: "service/service-search", dst_id: "cluster/cluster-prod-2", kind: runs_on}
+  - {src_id: "service/service-batch-etl", dst_id: "cluster/cluster-legacy-1", kind: runs_on}
+  - {src_id: "service/service-ml-inference", dst_id: "cluster/cluster-gpu-1", kind: runs_on}
+  - {src_id: "service/service-checkout", dst_id: "database/database-orders-pg", kind: depends_on}
+  - {src_id: "service/service-payments", dst_id: "database/database-orders-pg", kind: depends_on}
+  - {src_id: "service/service-search", dst_id: "database/database-orders-pg", kind: depends_on}
+  - {src_id: "service/service-batch-etl", dst_id: "database/database-orders-pg", kind: writes}
+  - {src_id: "workload/workload-legacy-batch", dst_id: "cluster/cluster-legacy-1", kind: runs_on}
+  - {src_id: "service/service-checkout", dst_id: "slo/slo-checkout", kind: observed_by}
+  - {src_id: "service/service-checkout", dst_id: "service/service-payments", kind: calls, fact_ids: [f-call-1]}
+  - {src_id: "service/service-orphan-api", dst_id: "cluster/cluster-staging-1", kind: runs_on}

platformforge/data/lab/fleets/acme/policies.yaml

@@ -0,0 +1,28 @@
+decisions:
+  - {policy: require-owner, decision: deny, subject: orphan-api}
+  - {policy: require-owner, decision: deny, subject: legacy-batch}
+  - {policy: require-owner, decision: deny, subject: unknown-svc}
+  - {policy: require-owner, decision: deny, subject: tmp-svc}
+  - {policy: require-owner, decision: allow, subject: checkout}
+  - {policy: require-owner, decision: allow, subject: payments}
+  - {policy: require-owner, decision: allow, subject: search}
+  - {policy: require-owner, decision: allow, subject: ml-inference}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-x, team: data}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-y, team: data}
+  - {policy: no-public-s3, decision: shadow-deny, subject: bucket-z, team: data}
+  - {policy: prod-dual-approval, decision: require-approval, subject: checkout}
+  - {policy: prod-dual-approval, decision: allow, subject: staging}
+  - {policy: unused-kyverno, decision: allow, subject: never-fired}
+exceptions:
+  - {policy: require-owner}
+  - {policy: require-owner}
+  - {policy: require-owner}
+  - {policy: require-owner}
+  - {policy: require-owner, expired: true}
+overrides:
+  - {policy: require-owner}
+  - {policy: require-owner}
+  - {policy: require-owner}
+outcomes:
+  require-owner: 4
+configured: [require-owner, no-public-s3, prod-dual-approval, unused-kyverno]

platformforge/data/lab/fleets/acme/requests.yaml

@@ -0,0 +1,24 @@
+requests:
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-01T09:00:00Z", ready_at: "2025-11-01T09:20:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-02T09:00:00Z", ready_at: "2025-11-02T09:18:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-03T09:00:00Z", ready_at: "2025-11-03T09:22:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-04T09:00:00Z", ready_at: "2025-11-04T09:19:00Z"}
+  - {path: web-svc, status: provisioned, requested_at: "2025-11-05T09:00:00Z", ready_at: "2025-11-05T09:21:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-05T09:00:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-06T09:00:00Z"}
+  - {path: batch-job, status: failed, requested_at: "2025-11-07T09:00:00Z"}
+  - {path: batch-job, status: provisioned, requested_at: "2025-11-08T09:00:00Z", ready_at: "2025-11-08T11:30:00Z", approval_wait_s: 7200}
+  - {path: batch-job, status: failed, requested_at: "2025-11-09T09:00:00Z"}
+escapes:
+  - {path: batch-job, reason: policy-block}
+  - {path: batch-job, reason: policy-block}
+  - {path: batch-job, reason: policy-block}
+  - {path: batch-job, reason: insufficient-flexibility}
+  - {path: web-svc, reason: manual-preference}
+outcomes:
+  - {path: web-svc, incident: false, rollback: false}
+  - {path: web-svc, incident: false, rollback: false}
+  - {path: web-svc, incident: false, rollback: false}
+  - {path: batch-job, incident: true, rollback: true}
+  - {path: batch-job, incident: true, rollback: true}
+  - {path: custom, incident: true, rollback: false}

platformforge/data/lab/scenarios/argo-bad-rollout/expected.yaml

@@ -0,0 +1,6 @@
+tier: smoke
+description: "Automated sync without self-heal or prune — partial rollouts persist."
+analyzers: [gitops]
+violated_rules: [PF-GITOPS-002, PF-GITOPS-003]
+absent_rules: [PF-GITOPS-001]
+fact_kinds: [gitops.argocd_app]

platformforge/data/lab/scenarios/argo-bad-rollout/fixture/app.yaml

@@ -0,0 +1,9 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata: {name: shop, namespace: argocd}
+spec:
+  project: default
+  source: {repoURL: https://git.internal/shop.git, path: k8s}
+  destination: {server: https://kubernetes.default.svc, namespace: prod}
+  syncPolicy:
+    automated: {}   # sync but no selfHeal, no prune

platformforge/data/lab/scenarios/aws-dump/expected.yaml

@@ -0,0 +1,19 @@
+tier: standard
+description: "§93 AWS dump regression — Organizations, IAM, VPC/EC2/EKS,
+  S3/RDS shapes produce T1 cloud.aws facts; nothing is silently dropped."
+analyzers: [cloud-aws]
+violated_rules: []
+fact_kinds:
+  - cloud.aws.organization
+  - cloud.aws.account
+  - cloud.aws.role
+  - cloud.aws.policy
+  - cloud.aws.principal
+  - cloud.aws.vpc
+  - cloud.aws.subnet
+  - cloud.aws.internet_gateway
+  - cloud.aws.instance
+  - cloud.aws.cluster
+  - cloud.aws.bucket
+  - cloud.aws.database
+absent_rules: []

platformforge/data/lab/scenarios/aws-dump/fixture/compute.json

@@ -0,0 +1,4 @@
+{"Reservations": [{"Instances": [{"InstanceId": "i-1", "InstanceType": "t3.large",
+    "State": {"Name": "running"}, "PublicIpAddress": "54.1.2.3", "SubnetId": "sn-1"}]}],
+ "Clusters": [{"clusterName": "prod", "arn": "arn:aws:eks:us-east-1:111:cluster/prod",
+               "version": "1.29", "status": "ACTIVE"}]}

platformforge/data/lab/scenarios/aws-dump/fixture/iam.json

@@ -0,0 +1,7 @@
+{"Roles": [{"Arn": "arn:aws:iam::111:role/deploy", "RoleName": "deploy",
+            "AssumeRolePolicyDocument": {"Statement": [{"Principal": {"Service": "ec2.amazonaws.com"}}]}}],
+ "Policies": [{"Arn": "arn:aws:iam::aws:policy/ReadOnlyAccess", "PolicyName": "ReadOnlyAccess", "AttachmentCount": 3},
+              {"Arn": "arn:aws:iam::111:policy/wildcard", "PolicyName": "wildcard", "AttachmentCount": 1}],
+ "Users": [{"Arn": "arn:aws:iam::111:user/ci", "UserName": "ci"}],
+ "Policy": {"Arn": "arn:aws:iam::111:policy/wildcard"},
+ "PolicyVersion": {"Document": {"Statement": [{"Effect": "Allow", "Action": "*", "Resource": "*"}]}}}

platformforge/data/lab/scenarios/aws-dump/fixture/network.json

@@ -0,0 +1,6 @@
+{"Vpcs": [{"VpcId": "vpc-1", "CidrBlock": "10.0.0.0/16", "OwnerId": "111"}],
+ "Subnets": [{"SubnetId": "sn-1", "VpcId": "vpc-1", "CidrBlock": "10.0.1.0/24",
+              "AvailabilityZone": "us-east-1a", "MapPublicIpOnLaunch": true}],
+ "InternetGateways": [{"InternetGatewayId": "igw-1", "Attachments": [{"VpcId": "vpc-1"}]}],
+ "SecurityGroups": [{"GroupId": "sg-1", "GroupName": "web",
+                     "IpPermissions": [{"FromPort": 22, "IpRanges": [{"CidrIp": "0.0.0.0/0"}]}]}]}

platformforge/data/lab/scenarios/aws-dump/fixture/org.json

@@ -0,0 +1,4 @@
+{"Organization": {"Id": "o-example", "Arn": "arn:aws:organizations::111:organization/o-example", "MasterAccountId": "111"},
+ "Accounts": [{"Id": "111", "Name": "root", "Status": "ACTIVE"},
+              {"Id": "222", "Name": "prod", "Status": "ACTIVE"}],
+ "OrganizationalUnits": [{"Id": "ou-1", "Name": "workloads"}]}

platformforge/data/lab/scenarios/aws-dump/fixture/storage.json

@@ -0,0 +1,4 @@
+{"Buckets": [{"Name": "logs-prod"}, {"Name": "data-lake"}],
+ "DBInstances": [{"DBInstanceArn": "arn:aws:rds:us-east-1:111:db/orders",
+                  "Engine": "postgres", "PubliclyAccessible": false,
+                  "StorageEncrypted": true, "MultiAZ": true}]}

platformforge/data/lab/scenarios/container-unsigned/expected.yaml

@@ -0,0 +1,5 @@
+tier: smoke
+description: "Container image unpinned, unsigned, no SLSA provenance."
+analyzers: [supply]
+violated_rules: [PF-SEC-030, PF-SEC-031]
+fact_kinds: [security.artifact]

platformforge/data/lab/scenarios/container-unsigned/fixture/supply.json

@@ -0,0 +1,11 @@
+{
+  "artifacts": [
+    {
+      "name": "payments-api",
+      "image": "registry.internal/payments-api:latest",
+      "digest": "sha256:nothexdigest",
+      "signed": false,
+      "slsa_provenance": false
+    }
+  ]
+}

platformforge/data/lab/scenarios/cost-idle-workload/expected.yaml

@@ -0,0 +1,5 @@
+tier: smoke
+description: "Spend-bearing resource with no cost_center tag."
+analyzers: [finops]
+violated_rules: [PF-FIN-001]
+fact_kinds: [finops.cost]

platformforge/data/lab/scenarios/cost-idle-workload/fixture/costs.json

@@ -0,0 +1,12 @@
+{
+  "rows": [
+    {
+      "resource": "eks/prod/nodegroup-m5.8xlarge-3",
+      "amount": 1400.0,
+      "currency": "USD",
+      "period": "2025-01",
+      "service": "idle-etl",
+      "tags": {}
+    }
+  ]
+}

platformforge/data/lab/scenarios/crossplane-platform/expected.yaml

@@ -0,0 +1,16 @@
+tier: standard
+description: "Crossplane platform: XRD + pipeline Composition + Upbound AWS
+  provider family (Provider, ProviderConfig, S3 Bucket MR) + XR bound by
+  compositionRef. Negative docs (plain CRD, Upbound Spaces ControlPlane
+  without MR shape) must produce no facts — §53/§58."
+analyzers: [crossplane]
+violated_rules:
+  - PF-XR-001   # data-lake-prod carries deletionPolicy: Delete
+fact_kinds:
+  - platform.xrd
+  - platform.composition
+  - platform.crossplane_provider
+  - platform.provider_config
+  - platform.managed_resource
+  - platform.xr
+absent_rules: []

platformforge/data/lab/scenarios/crossplane-platform/fixture/negative.yaml

@@ -0,0 +1,18 @@
+# Negative cases — none of these may classify as Crossplane objects.
+apiVersion: foo.example.com/v1
+kind: Widget
+metadata:
+  name: plain-crd-instance
+spec:
+  size: large
+---
+# Upbound Spaces control plane — .upbound.io group but NOT a managed
+# resource (no forProvider/providerConfigRef structural evidence).
+apiVersion: spaces.upbound.io/v1beta1
+kind: ControlPlane
+metadata:
+  name: org-ctp
+spec:
+  writeConnectionSecretToRef:
+    name: ctp-kubeconfig
+    namespace: crossplane-system

platformforge/data/lab/scenarios/crossplane-platform/fixture/xrd.yaml

@@ -0,0 +1,90 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: xbuckets.platform.example.org
+spec:
+  group: platform.example.org
+  names:
+    kind: XBucket
+    plural: xbuckets
+  claimNames:
+    kind: BucketClaim
+    plural: bucketclaims
+  connectionSecretKeys:
+    - endpoint
+  versions:
+    - name: v1alpha1
+      kind: XBucket
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                region:
+                  type: string
+---
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: bucket-aws
+spec:
+  compositeTypeRef:
+    apiVersion: platform.example.org/v1alpha1
+    kind: XBucket
+  mode: Pipeline
+  pipeline:
+    - step: s3-bucket
+      functionRef:
+        name: function-auto-ready
+    - step: patch
+      functionRef:
+        name: function-patch-and-transform
+---
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-aws-s3
+spec:
+  package: xpkg.upbound.io/upbound/provider-aws-s3:v1.14.0
+---
+apiVersion: aws.upbound.io/v1beta1
+kind: ProviderConfig
+metadata:
+  name: aws-prod
+spec:
+  credentials:
+    source: Secret
+    secretRef:
+      namespace: crossplane-system
+      name: aws-creds
+      key: creds
+---
+apiVersion: s3.aws.upbound.io/v1beta1
+kind: Bucket
+metadata:
+  name: data-lake-prod
+spec:
+  forProvider:
+    region: us-east-1
+  managementPolicies:
+    - "*"
+  deletionPolicy: Delete
+  providerConfigRef:
+    name: aws-prod
+---
+apiVersion: platform.example.org/v1alpha1
+kind: XBucket
+metadata:
+  name: analytics-bucket
+spec:
+  compositionRef:
+    name: bucket-aws
+  resourceRefs:
+    - apiVersion: s3.aws.upbound.io/v1beta1
+      kind: Bucket
+      name: data-lake-prod
+  region: us-east-1

platformforge/data/lab/scenarios/demo-platform/expected.yaml

@@ -0,0 +1,16 @@
+tier: standard
+description: "Small platform repo: a public S3 bucket, a privileged
+  deployment without probes, and a dangerous GitHub Actions workflow."
+analyzers: [iac, k8s, gha]
+violated_rules:
+  - PF-IAC-001
+  - PF-K8S-001
+  - PF-K8S-002
+  - PF-K8S-004
+  - PF-CICD-002
+fact_kinds:
+  - iac.resource
+  - k8s.workload
+  - cicd.github_workflow
+absent_rules:
+  - PF-IAC-010   # no plan in fixture — destroy never claimed

platformforge/data/lab/scenarios/demo-platform/fixture/.github/workflows/ci.yml

@@ -0,0 +1,10 @@
+name: ci
+on:
+  pull_request_target:
+permissions: {}
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+      - run: make test

platformforge/data/lab/scenarios/demo-platform/fixture/deploy.yaml

@@ -0,0 +1,16 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+  namespace: prod
+spec:
+  replicas: 2
+  selector: {matchLabels: {app: web}}
+  template:
+    metadata:
+      labels: {app: web}
+    spec:
+      containers:
+        - name: web
+          image: nginx:latest
+          securityContext: {privileged: true}

platformforge/data/lab/scenarios/demo-platform/fixture/infra.tf

@@ -0,0 +1,5 @@
+resource "aws_s3_bucket" "assets" {
+  bucket = "acme-assets"
+  acl    = "public-read"
+  tags   = { team = "web" }
+}

platformforge/data/lab/scenarios/fleet-ai/expected.yaml

@@ -0,0 +1,12 @@
+id: fleet-ai
+name: AI platform — GPU workloads detected; cost/token needs denominator
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - ai:
+      min_detected: 2
+      unit_economics:
+        cost: 9800
+        tokens: null
+        expect: null

platformforge/data/lab/scenarios/fleet-capacity/expected.yaml

@@ -0,0 +1,12 @@
+id: fleet-capacity
+name: Fleet capacity — prod-1 and gpu-1 saturated; unknown never zero
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - capacity:
+      min_hot: 2
+  - capacity:
+      member: "cluster:gpu-1"
+      criticality: high
+      expect_risk: high

platformforge/data/lab/scenarios/fleet-cost/expected.yaml

@@ -0,0 +1,18 @@
+id: fleet-cost
+name: Fleet cost — hierarchy totals, unallocated visible, idle not deletable
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - cost:
+      hierarchy:
+        min_unallocated: 1
+  - cost:
+      trend:
+        direction: up
+  - cost:
+      idle:
+        min: 2
+  - cost:
+      rightsizing:
+        min: 1

platformforge/data/lab/scenarios/fleet-federation/expected.yaml

@@ -0,0 +1,11 @@
+id: fleet-federation
+name: Federation — secrets never exported; restricted classification denied
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - federation:
+      exports:
+        - {action: aggregate}
+        - {action: deny}
+        - {action: deny}

platformforge/data/lab/scenarios/fleet-golden-path/expected.yaml

@@ -0,0 +1,18 @@
+id: fleet-golden-path
+name: Golden path — batch-job fails often, escapes, worse outcomes
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - fleet_query:
+      question: outside-golden-path
+      min_count: 3
+      node_ids:
+        - "service/service-batch-etl"
+        - "service/service-ml-inference"
+  - golden_path:
+      path: batch-job
+      expect:
+        failed: 4
+      escape_reason: policy-block
+      min_recs: 1

platformforge/data/lab/scenarios/fleet-op-hotspot/expected.yaml

@@ -0,0 +1,11 @@
+id: fleet-op-hotspot
+name: Operation hotspot — rollout_restart toil + remediation recurrence
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - operations:
+      min_count: 3
+      min_hotspots: 1
+      min_recurrence: 1
+      no_auto_remediate: true

platformforge/data/lab/scenarios/fleet-ownership/expected.yaml

@@ -0,0 +1,17 @@
+id: fleet-ownership
+name: Fleet ownership — orphan API and unowned resources surface
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - fleet_query:
+      question: unowned
+      min_count: 5
+      node_ids:
+        - "service/service-orphan-api"
+        - "service/service-batch-etl"
+        - "service/service-ml-inference"
+  - fleet_query:
+      question: no-slo
+      min_count: 2
+      node_ids: ["service/service-payments", "service/service-ml-inference"]

platformforge/data/lab/scenarios/fleet-partial/expected.yaml

@@ -0,0 +1,10 @@
+id: fleet-partial
+name: Partial fleet — permission-limited member keeps coverage <1, never silent
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - coverage:
+      max_coverage: 0.99
+  - capacity:
+      min_hot: 0

platformforge/data/lab/scenarios/fleet-policy-friction/expected.yaml

@@ -0,0 +1,10 @@
+id: fleet-policy-friction
+name: Policy friction — require-owner denies + exceptions; recs never execute
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - policy_analytics:
+      min_fp: 1
+      min_recs: 1
+      no_auto_apply: true

platformforge/data/lab/scenarios/fleet-recurring-incident/expected.yaml

@@ -0,0 +1,12 @@
+id: fleet-recurring-incident
+name: Recurring incident — batch-etl incidents repeat with deploy correlation
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - history_pattern:
+      window: 90d
+      min_support: 3
+      max_confidence: high
+  - reliability:
+      min_hotspots: 1

platformforge/data/lab/scenarios/fleet-report/expected.yaml

@@ -0,0 +1,13 @@
+id: fleet-report
+name: Fleet report — north-star receipt, cited invest list, bounded coverage
+kind: fleet
+tier: standard
+shared_fixture: lab/fleets/acme
+checks:
+  - fleet_report:
+      limit: 5
+      min_invest: 1
+      min_suppressed: 1
+      dimensions: [security, standardization, reliability, platform-product, cost]
+      invest_cited: true
+      coverage_below: 1.0

platformforge/data/lab/scenarios/fleet-risk/expected.yaml

@@ -0,0 +1,18 @@
+id: fleet-risk
+name: Fleet risk — unsupported K8s, public exposure, IAM wildcard
+kind: fleet
+tier: smoke
+shared_fixture: lab/fleets/acme
+checks:
+  - fleet_query:
+      question: public-services
+      min_count: 2
+      node_ids: ["service/service-checkout", "service/service-orphan-api"]
+  - fleet_query:
+      question: unsupported-k8s
+      min_count: 1
+      node_ids: ["workload/workload-legacy-batch"]
+  - fleet_query:
+      question: wildcard-iam
+      min_count: 1
+      node_ids: ["role/role-wildcard-admin"]

platformforge/data/lab/scenarios/gitops-drift/expected.yaml

@@ -0,0 +1,6 @@
+tier: smoke
+description: "ArgoCD app without automated sync — git drift stays live."
+analyzers: [gitops]
+violated_rules: [PF-GITOPS-001]
+absent_rules: [PF-GITOPS-003]
+fact_kinds: [gitops.argocd_app]

platformforge/data/lab/scenarios/gitops-drift/fixture/app.yaml

@@ -0,0 +1,12 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata: {name: payments, namespace: argocd}
+spec:
+  project: default
+  source:
+    repoURL: https://git.internal/platform.git
+    path: manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: prod
+  # no syncPolicy.automated — drift never reconciles