platformforge 0.1.0__py3-none-any.whl

platformforge/data/lab/scenarios/k8s-bad-readiness/expected.yaml

@@ -0,0 +1,6 @@
+tier: smoke
+description: "Workload with limits but no health probes."
+analyzers: [k8s]
+violated_rules: [PF-K8S-003]
+absent_rules: [PF-K8S-002, PF-K8S-012]
+fact_kinds: [k8s.workload]

platformforge/data/lab/scenarios/k8s-bad-readiness/fixture/deploy.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: prod
+spec:
+  replicas: 3
+  selector:
+    matchLabels: {app: api}
+  template:
+    metadata:
+      labels: {app: api}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+      containers:
+      - name: app
+        image: registry.internal/api:1.4.2
+        resources:
+          requests: {cpu: 50m}
+          limits: {cpu: 500m, memory: 256Mi}
+

platformforge/data/lab/scenarios/k8s-bad-readiness/fixture/netpol.yaml

@@ -0,0 +1,9 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata: {name: api, namespace: prod}
+spec: {podSelector: {matchLabels: {app: api}}}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata: {name: api, namespace: prod}
+spec: {minAvailable: 1, selector: {matchLabels: {app: api}}}

platformforge/data/lab/scenarios/k8s-missing-limits/expected.yaml

@@ -0,0 +1,6 @@
+tier: smoke
+description: "Deployment requests resources but sets no limits."
+analyzers: [k8s]
+violated_rules: [PF-K8S-002]
+absent_rules: [PF-K8S-001, PF-K8S-003, PF-K8S-012]
+fact_kinds: [k8s.workload]

platformforge/data/lab/scenarios/k8s-missing-limits/fixture/deploy.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: worker
+  namespace: prod
+spec:
+  replicas: 2
+  selector:
+    matchLabels: {app: worker}
+  template:
+    metadata:
+      labels: {app: worker}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+      containers:
+      - name: app
+        image: registry.internal/worker:1.4.2
+        readinessProbe:
+          httpGet: {path: /healthz, port: 8080}
+        livenessProbe:
+          httpGet: {path: /healthz, port: 8080}
+        resources:
+          requests: {cpu: 100m, memory: 128Mi}
+

platformforge/data/lab/scenarios/k8s-missing-limits/fixture/netpol.yaml

@@ -0,0 +1,9 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata: {name: worker, namespace: prod}
+spec: {podSelector: {matchLabels: {app: worker}}}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata: {name: worker, namespace: prod}
+spec: {minAvailable: 1, selector: {matchLabels: {app: worker}}}

platformforge/data/lab/scenarios/k8s-single-replica/expected.yaml

@@ -0,0 +1,5 @@
+tier: smoke
+description: "Single-replica workload — no redundancy across failure domains."
+analyzers: [k8s]
+violated_rules: [PF-K8S-011]
+fact_kinds: [k8s.workload]

platformforge/data/lab/scenarios/k8s-single-replica/fixture/deploy.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: solo
+  namespace: prod
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: solo}
+  template:
+    metadata:
+      labels: {app: solo}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+      containers:
+      - name: app
+        image: registry.internal/solo:1.4.2
+        readinessProbe:
+          httpGet: {path: /, port: 80}
+        livenessProbe:
+          httpGet: {path: /, port: 80}
+        resources:
+          limits: {cpu: 200m, memory: 128Mi}
+

platformforge/data/lab/scenarios/k8s-single-replica/fixture/netpol.yaml

@@ -0,0 +1,4 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata: {name: solo, namespace: prod}
+spec: {podSelector: {matchLabels: {app: solo}}}

platformforge/data/lab/scenarios/live-aws-collect/expected.yaml

@@ -0,0 +1,4 @@
+tier: standard
+description: fixture-replayed aws CLI collector — offline determinism
+analyzers: [live-aws]
+fact_kinds: [live.observation, live.object]

platformforge/data/lab/scenarios/live-aws-collect/fixture/aws/ec2_describe-vpcs.json

@@ -0,0 +1,15 @@
+{
+  "Vpcs": [
+    {
+      "VpcId": "vpc-0a1b2c3d",
+      "CidrBlock": "10.0.0.0/16",
+      "State": "available",
+      "Tags": [{"Key": "Name", "Value": "prod-vpc"}]
+    },
+    {
+      "VpcId": "vpc-9z8y7x6w",
+      "CidrBlock": "172.16.0.0/16",
+      "State": "available"
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-aws-collect/fixture/aws/iam_list-users.denied.txt

@@ -0,0 +1 @@
+An error occurred (AccessDenied) when calling the ListUsers operation: User is not authorized to perform iam:ListUsers

platformforge/data/lab/scenarios/live-aws-collect/fixture/aws/sts_get-caller-identity.json

@@ -0,0 +1,5 @@
+{
+  "Account": "123456789012",
+  "Arn": "arn:aws:iam::123456789012:role/pf-live-readonly",
+  "UserId": "AIDAXXXX:pf-live"
+}

platformforge/data/lab/scenarios/live-k8s-collect/expected.yaml

@@ -0,0 +1,4 @@
+tier: standard
+description: fixture-replayed kubectl collector — offline determinism
+analyzers: [live-k8s]
+fact_kinds: [live.observation, live.object]

platformforge/data/lab/scenarios/live-k8s-collect/fixture/kubectl/get_configmaps.denied.txt

@@ -0,0 +1 @@
+Error from server (Forbidden): configmaps is forbidden: User "pf-live" cannot list resource "configmaps"

platformforge/data/lab/scenarios/live-k8s-collect/fixture/kubectl/get_deployments.apps.json

@@ -0,0 +1,25 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "apps/v1", "kind": "Deployment",
+      "metadata": {
+        "namespace": "prod", "name": "api",
+        "uid": "uid-deploy-api-1", "resourceVersion": "4820",
+        "labels": {"app": "api"},
+        "annotations": {"deploy.note": "fine",
+                        "deploy.token": "should-be-stripped"}},
+      "spec": {"replicas": 3, "selector": {"matchLabels": {"app": "api"}}},
+      "status": {"phase": "Running"}
+    },
+    {
+      "apiVersion": "apps/v1", "kind": "Deployment",
+      "metadata": {
+        "namespace": "prod", "name": "worker",
+        "uid": "uid-deploy-worker-2"},
+      "spec": {"replicas": 2}
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-k8s-collect/fixture/kubectl/get_pods.json

@@ -0,0 +1,17 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "v1", "kind": "Pod",
+      "metadata": {
+        "namespace": "prod", "name": "api-abc12",
+        "uid": "uid-pod-1",
+        "ownerReferences": [
+          {"kind": "ReplicaSet", "name": "api-6f9", "uid": "uid-rs-1"}]},
+      "spec": {"serviceAccountName": "api-sa"},
+      "status": {"phase": "Running"}
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-k8s-collect/fixture/kubectl/get_secrets.json

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "v1", "kind": "Secret", "type": "Opaque",
+      "metadata": {"namespace": "prod", "name": "db-creds",
+                   "uid": "uid-secret-1"},
+      "data": {"password": "c3VwZXJzZWNyZXQ="}
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-kind/expected.yaml

@@ -0,0 +1,14 @@
+tier: full
+profile: kubernetes
+description: >
+  kind-cluster collection replay — mirrors what `live snapshot` reads
+  from a kind cluster (kind create cluster → kubectl get -o json).
+  Fixture replay is byte-identical to the transport contract; a real
+  kind run is host-side and gated by --allow-profile.
+safety:
+  credentials: user kubeconfig — collector never parses it
+  region_or_context: kind-live
+  budget_limit: 40 api calls / 512KiB
+  cleanup: kind delete cluster --name pf-lab
+analyzers: [live-k8s]
+fact_kinds: [live.observation, live.object]

platformforge/data/lab/scenarios/live-kind/fixture/kubectl/get_configmaps.denied.txt

@@ -0,0 +1 @@
+Error from server (Forbidden): configmaps is forbidden: User "pf-live" cannot list resource "configmaps"

platformforge/data/lab/scenarios/live-kind/fixture/kubectl/get_deployments.apps.json

@@ -0,0 +1,25 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "apps/v1", "kind": "Deployment",
+      "metadata": {
+        "namespace": "prod", "name": "api",
+        "uid": "uid-deploy-api-1", "resourceVersion": "4820",
+        "labels": {"app": "api"},
+        "annotations": {"deploy.note": "fine",
+                        "deploy.token": "should-be-stripped"}},
+      "spec": {"replicas": 3, "selector": {"matchLabels": {"app": "api"}}},
+      "status": {"phase": "Running"}
+    },
+    {
+      "apiVersion": "apps/v1", "kind": "Deployment",
+      "metadata": {
+        "namespace": "prod", "name": "worker",
+        "uid": "uid-deploy-worker-2"},
+      "spec": {"replicas": 2}
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-kind/fixture/kubectl/get_pods.json

@@ -0,0 +1,17 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "v1", "kind": "Pod",
+      "metadata": {
+        "namespace": "prod", "name": "api-abc12",
+        "uid": "uid-pod-1",
+        "ownerReferences": [
+          {"kind": "ReplicaSet", "name": "api-6f9", "uid": "uid-rs-1"}]},
+      "spec": {"serviceAccountName": "api-sa"},
+      "status": {"phase": "Running"}
+    }
+  ]
+}

platformforge/data/lab/scenarios/live-kind/fixture/kubectl/get_secrets.json

@@ -0,0 +1,13 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "metadata": {"resourceVersion": "4821"},
+  "items": [
+    {
+      "apiVersion": "v1", "kind": "Secret", "type": "Opaque",
+      "metadata": {"namespace": "prod", "name": "db-creds",
+                   "uid": "uid-secret-1"},
+      "data": {"password": "c3VwZXJzZWNyZXQ="}
+    }
+  ]
+}

platformforge/data/lab/scenarios/network-policy-missing/expected.yaml

@@ -0,0 +1,6 @@
+tier: smoke
+description: "Workload in a namespace with no NetworkPolicy selecting it."
+analyzers: [k8s]
+violated_rules: [PF-K8S-012]
+absent_rules: [PF-K8S-002, PF-K8S-003]
+fact_kinds: [k8s.workload]

platformforge/data/lab/scenarios/network-policy-missing/fixture/deploy.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: prod
+spec:
+  replicas: 2
+  selector:
+    matchLabels: {app: backend}
+  template:
+    metadata:
+      labels: {app: backend}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+      containers:
+      - name: app
+        image: registry.internal/backend:1.4.2
+        readinessProbe:
+          tcpSocket: {port: 9000}
+        livenessProbe:
+          tcpSocket: {port: 9000}
+        resources:
+          limits: {cpu: 1, memory: 512Mi}
+

platformforge/data/lab/scenarios/ops-bad-rollout/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "rollout restart + SLO regression → regressed"

platformforge/data/lab/scenarios/ops-bad-rollout/fixture/ops.yaml

@@ -0,0 +1,33 @@
+intent:
+  intent_id: lab-i3
+  owner: team-a
+  requested_by: bob
+  reason: {type: incident}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {restart: true}
+steps:
+  - step_id: restart
+    action: kubernetes.rollout_restart
+    params: {kind: Deployment, name: web, namespace: apps}
+expected_delta:
+  changes: {resources: [{id: "dep/web", restarted: true}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+pre_state:
+  restart: {revision: "7"}
+post_rollback:
+  restart: {revision: "7"}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, role: owner}
+environment: lab
+auto_rollback: true
+transports: {kubernetes: {rc: 0, stdout: "restarted"}}
+verify:
+  observations:
+    immediate: {changes: {resources: [{id: "dep/web", restarted: true}]}}
+    stabilization: {changes: {resources: [{id: "dep/web", restarted: true}]}}
+    extended: {changes: {resources: [{id: "dep/web", restarted: true}]}}
+  slo: {error_rate_max: 0.01}
+  metrics: {error_rate: 0.4}
+expect: {ok: true, state: rolled-back, convergence: regressed}

platformforge/data/lab/scenarios/ops-break-glass/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "freeze + valid break-glass → executes with audit"

platformforge/data/lab/scenarios/ops-break-glass/fixture/ops.yaml

@@ -0,0 +1,21 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+environment: lab
+transports: {kubernetes: {rc: 0, stdout: "scaled"}}
+freeze_active: true
+break_glass: {ticket_id: BG-77, actor: oncall, reason: "sev1 mitigation", expires_at: "2999-01-01T00:00:00Z", scope: ["k8s:lab/apps/Deployment/web"]}
+expect: {ok: true, ledger_event: step.completed}

platformforge/data/lab/scenarios/ops-broken-selector/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "broken service selector → git PR remediation"

platformforge/data/lab/scenarios/ops-broken-selector/fixture/ops.yaml

@@ -0,0 +1,21 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: fix-selector
+    action: git.open_pr
+    params: {repo: "org/infra", title: "fix svc selector", head: fix, base: main, body: "evidence"}
+expected_delta:
+  changes: {network: [{id: "svc/web", selector: "fixed"}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, role: owner}
+environment: lab
+transports: {git: {rc: 0, stdout: "pr opened"}}
+expect: {ok: true, ledger_event: step.completed}

platformforge/data/lab/scenarios/ops-changed-plan-hash/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "approval bound to stale subject → NO-APPROVAL"

platformforge/data/lab/scenarios/ops-changed-plan-hash/fixture/ops.yaml

@@ -0,0 +1,20 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: plan, actor: alice}
+environment: lab
+expect: {ok: false, stage: approval, refusal: PF-OPS-NO-APPROVAL}

platformforge/data/lab/scenarios/ops-conflicting-operation/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "resource lock collision → lock refusal"

platformforge/data/lab/scenarios/ops-conflicting-operation/fixture/ops.yaml

@@ -0,0 +1,21 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, role: owner}
+environment: lab
+conflicting_operation: true
+expect: {ok: false, stage: locking}

platformforge/data/lab/scenarios/ops-expired-approval/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "TTL-elapsed approval → PF-OPS-APPROVAL-EXPIRED"

platformforge/data/lab/scenarios/ops-expired-approval/fixture/ops.yaml

@@ -0,0 +1,20 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, expires_at: "2000-01-01T00:00:00Z"}
+environment: lab
+expect: {ok: false, stage: approval, refusal: PF-OPS-APPROVAL-EXPIRED}

platformforge/data/lab/scenarios/ops-partial-failure/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "step failure mid-DAG → failed + downstream skipped"

platformforge/data/lab/scenarios/ops-partial-failure/fixture/ops.yaml

@@ -0,0 +1,24 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3}
+  - step_id: annotate
+    action: kubernetes.annotate
+    params: {kind: Deployment, name: web, namespace: apps, resource_version: "1", annotations: {x: y}}
+expected_delta:
+  changes: {resources: [{id: "dep/web"}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, role: owner}
+environment: lab
+transports: {kubernetes: {rc: 2, stderr: "boom"}}
+expect: {ok: false, stage: execute, state: failed}

platformforge/data/lab/scenarios/ops-policy-denial/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "deny policy → envelope never mints"

platformforge/data/lab/scenarios/ops-policy-denial/fixture/ops.yaml

@@ -0,0 +1,17 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+policies:
+  - {policy_id: no-lab-mutate, priority: 1, when: {environment: lab}, then: {decision: deny, reason: frozen}}
+environment: lab
+expect: {ok: false, stage: mint, refusal: PF-OPS-POLICY-BLOCK}

platformforge/data/lab/scenarios/ops-replica-drift/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "detect drift → scale → verify converged"

platformforge/data/lab/scenarios/ops-replica-drift/fixture/ops.yaml

@@ -0,0 +1,28 @@
+intent:
+  intent_id: lab-i1
+  owner: team-a
+  requested_by: bob
+  reason: {type: drift, drift_ids: [d1]}
+  target_resources: ["k8s:lab/apps/Deployment/web"]
+  desired_change: {replicas: 3}
+steps:
+  - step_id: scale
+    action: kubernetes.scale
+    params: {kind: Deployment, name: web, namespace: apps, replicas: 3, current_replicas: 5}
+expected_delta:
+  changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}
+observation:
+  captured_at: "2999-01-01T00:00:00Z"
+  coverage: {complete: true}
+approvals:
+  - {approval_id: ap1, binds: envelope, actor: alice, role: owner}
+environment: lab
+transports: {kubernetes: {rc: 0, stdout: "deployment scaled"}}
+verify:
+  observations:
+    immediate: {changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}}
+    stabilization: {changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}}
+    extended: {changes: {resources: [{id: "dep/web", replicas: [5, 3]}]}}
+  slo: {error_rate_max: 0.01}
+  metrics: {error_rate: 0.001}
+expect: {ok: true, state: converged, convergence: converged, ledger_event: verified}

platformforge/data/lab/scenarios/ops-rollback-annotate/expected.yaml

@@ -0,0 +1,3 @@
+kind: ops
+tier: standard
+description: "§133 annotation restore — exact previous metadata"